Security Maturity Assessment

Schlumberger PublicAssessing the Security Maturityof an OrganizationClaude R. BaudoinColin R. Elliott

Overview Organizations need to measure their level of readiness w.r.t. security risks  You cannot improve what you do not measure This is an irrational exercise absent a standard or methodology that provides objective and comparable measurements Schlumberger Public A standard like ISO 17799 does not automatically allow an organization to:  establish its level of compliance  measures progress over time  decide on required actions  prioritize them in view of finite budgets and resources We have developed a new assessment tool, the Security Maturity Assessment  based on the SEI Capability Maturity Model (CMM) approach  includes practical advice on how to conduct an assessment  fits within an overall security improvement plan  patent pending

The ChallengeThe CIO or CSO needs to know:  How secure am I?  Am I better off now than I was at this time last year? Schlumberger Public  Am I spending the right amount of money?  How do I compare with my peers?Conflicting inputs and constraints:  Clients and regulators demand provable assurances  Vendors propose products  Budget constraints

A Source for Best Practices – ISO 17799 Originally “British Standard 7799” Adopted internationally as ISO 17799 in 2000 Divides security into 10 areas:  Information Security Policy Schlumberger Public  Organizational Security  Asset Classification and Control  Personnel Security  Physical and Environmental Security  Communication and Operations Management  Access Control  System Development and Maintenance  Business Continuity Management  Compliance

“Capability Maturity Model” Concept Created in 1995 by the Software Engineering Level 5: Optimizing • Process Change Management Continuous process capability Institute (SEI) at improvement • Defect Prevention • Technology Change Management Carnegie-Mellon Level 4: Managed Schlumberger Public Product quality planning; tracking University to improve of measured software progress. • Software and Quality Management • Quantitative Process Management Level 3: Defined software processes Software process defined and institutionalized to provide • Organization Process Focus • Organization Process Definition 5 levels product quality control. • Training Program • Integrated Software Management • Software Product Engineering “Key Process Areas” Level 2: Repeatable • Intergroup Coordination • Peer Reviews must be in place to Management oversight and tracking of projects; stable • Requirements Management qualify for each level planning and product baselines. • Project Planning • Project Tracking / Oversight Level 1: Initial • Subcontract Management Widely adopted by the Ad hoc, unpredictable, chaotic. • Configuration Management software industry

Mapping ISO 17799 to Maturity Levels3.1.1 Information Security Policy Document “A policy document should be approved by management, published and communicated, as appropriate, to all employees. It should state Defined management commitment and set out the Schlumberger Public organization’s approach to managing information security.” Managed3.1.2 Review and Evaluation “The policy should have an owner” There should be a “defined review process” Optimized ensuring that “a review takes place in response to any changes affecting the basis of the original risk assessment…”  Regroup these three4.1.7 Independent review of information security concerns into Levels 3, 4 The implementation of the Information Security and 5 of the same row of Policy should be “reviewed independently to the assessment matrix provide assurance that organizational practices properly reflect the policy.”

The Assessment Matrix (sample row)ISO 17799 Level 1 Level 2 Level 3 Level 4 (Managed) Level 5Categories (Initial) (Repeatable) (Defined) (Optimizing) Level • Informal, ad • Formal & • Enforced & • Dynamic Definitions hoc documented measured • Process exists • Not written (in writing) • Responsibilities for catching down, may be are defined deviations and communicated explicitly making through constant Schlumberger Public coaching improvementsIII.1 Information Coverage of No Security policy exists, Specific policy Security policy covers Clear responsibilities Security Security Policy security but as a general exists supporting all areas of business. and mechanisms in Policy Review of policy in statement. business goals, Security policy is place to upgrade effective place Inferring what is clearly stating in owned by appropriate policy if required after implementation specifically mandated detail what is functions including IT every breach of policy, of information or prohibited requires mandated or but also Finance, HR, and if business security policy consulting specialized prohibited. Legal, etc. changes occur such Review of personnel. A "normal" person Organization policies as acquisition, Information No regular reviews. can easily define the roles and divestiture, or major Security Policy understand it. responsibilities in changes in business Reviews carried following procedures. processes. out at intervals, Reviews carried out -- but no clear intervals and management responsibility for the responsibility to reviews are defined trigger reviews or explicitly in the policy. exploit results A report on non- compliance is created and distributed to the business units for their review and action.

SMA – Part of an Overall SecurityImprovement Process Schlumberger Public 2. Security 3. Corrective Maturity Action Plan Assessment 1. Management Awareness and Commitment 5. Ongoing 4. Action Plan Monitoring Execution

Conducting the Assessment Communicate the purpose and process of the assessment Determine who will be interviewed Conduct the interviews and collect documentation Schlumberger Public Ask follow-up questions Tabulate the results Evaluate the results and form an initial conclusion Present the draft of the assessment results to the client Obtain any information to correct factual errors or omissions Deliver the final report

Pragmatic Aspects of an Assessment Interviewee Selection and Psychology  Include non-IT and non-manager personnel  Each type of person in the organization has hopes and fear Schlumberger Public  They have agendas, which often conflict Objective Questions  Bad question: “Do you think you have a good security policy?”  Good question: “Were you asked to read and sign a security policy when you joined the company?”  A good question allows independent verification Judging SMA Levels  CMM levels are much easier to apply than 0—10 scales

Presenting the Results Graphically Schlumberger Public

cbaudoin@cebe-itkm.com

Security Maturity Assessment

by Claude Baudoin

Accessibility

Categories

Upload Details

Usage Rights

Statistics

Security Maturity Assessment Presentation Transcript