Security-in-depth is a key and noble concept. It is often implemented very well within the individual disciplines of information, personnel and physical security. Good practitioners also implement it well across the disciplines to achieve holistic, cost effective and efficient protections of an organisation’s people, information and assets. Achieving effective and efficient security-in-depth is dependent not just on controls within and across the disciplines, but also on the interaction of policy development, risk assessment, planning, incident management, assurance and review. QinetiQ Australia assists its clients to take a wholistic approach to the implementation of security; one which sees security as an entire system with component parts. The approach doesn’t stop at security in depth through controls alone, but sees how those controls and the policies that initiate them are properly informed by environment, risk assessment, incident analysis and assurance review. QinetiQ’s consultants possess backgrounds as Agency Security Advisers, policy writers, risk assessors, system auditors and systems engineers. This knowledge and expertise is harnessed to provide the best possible support and advice to government agencies seeking to be compliant with the Protective Security Policy Framework within a resource-constrained environment.

1. Benefits of a truly wholistic approach to Security in Government
Jolyon Keegan, Government Portfolio Lead
Vern Amey, Senior Security Risk Consultant
Des Sengunlu, Senior Physical Protections Consultant

2. Outline 2

3. Outline 3
Introductions
Evolution to PSPF
Observations
Wholistic system
Security risk
A cyclical approach
Benefits
Key takeaways
Discussion

4. Our Three Key Presenters 4

5. Our Three Key Presenters 5
Jolyon Keegan Government Portfolio Lead

6. Our Three Key Presenters 6
Jolyon Keegan Government Portfolio Lead
Vern Amey Senior Security Risk Consultant

7. Our Three Key Presenters 7
Jolyon Keegan Government Portfolio Lead
Vern Amey Senior Security Risk Consultant
Des Sengunlu Senior Physical Protections Consultant

8. Our Background 8

9. Evolution of PSPF Risk-based Approach
Pre 9/11 9

10. Evolution of PSPF Risk-based Approach
Focus on risks associated with foreign espionage
Pre 9/11 10

11. Pre 9/11
Evolution of PSPF Risk-based Approach
Focus on risks associated with foreign espionage
Protection of Australian Government information (aimed more at the higher classification levels – primarily hard copy) 11

12. Evolution of PSPF Risk-based Approach
Focus on risks associated with foreign espionage
Protection of Australian Government information (aimed more at the higher classification levels – primarily hard copy)
Government Agency security less focussed on physical and personnel measures
Pre 9/11 12

13. Evolution of PSPF Risk-based Approach
Focus on risks associated with foreign espionage
Protection of Australian Government information (aimed more at the higher classification levels – primarily hard copy)
Government Agency security less focussed on physical and personnel measures
General Government security policy
Pre 9/11 13

14. 2001 – 2010 14
Evolution of PSPF Risk-based Approach

15. Security risk focus broadened to include risks associated with protection against a high-impact event
2001 – 2010 15
Evolution of PSPF Risk-based Approach

16. Security risk focus broadened to include risks associated with protection against a high-impact event
Australian Government security policy became the Protective Security Manual
2001 – 2010 16
Evolution of PSPF Risk-based Approach

17. Security risk focus broadened to include risks associated with protection against a high-impact event
Australian Government security policy became the Protective Security Manual
So were born the protective security elements of Physical, Personnel and Information security
2001 – 2010 17
Evolution of PSPF Risk-based Approach

18. Security risk focus broadened to include risks associated with protection against a high-impact event
Australian Government security policy became the Protective Security Manual
So were born the protective security elements of Physical, Personnel and Information security
Security risk mitigation strategies became multi-faceted
2001 – 2010 18
Evolution of PSPF Risk-based Approach

19. 2011 19
Evolution of PSPF Risk-based Approach

20. The threat and risk landscape changes
2011 20
Evolution of PSPF Risk-based Approach

21. The threat and risk landscape changes
Risk associated with cyber intrusion become a major focus
2011 21
Evolution of PSPF Risk-based Approach

22. The threat and risk landscape changes
Risk associated with cyber intrusion become a major focus
Security risk again heavily focussed on Information Security
2011 22
Evolution of PSPF Risk-based Approach

23. The threat and risk landscape changes
Risk associated with cyber intrusion become a major focus
Security risk again heavily focussed on Information Security
The Australian Government completes delivery of a revised security policy in the form of the Protective Security Policy Framework
2011 23
Evolution of PSPF Risk-based Approach

24. The threat and risk landscape changes
Risk associated with cyber intrusion become a major focus
Security risk again heavily focussed on Information Security
The Australian Government completes delivery of a revised security policy in the form of the Protective Security Policy Framework
2011 24
Agencies are to take a risk-based approach to protective security
Evolution of PSPF Risk-based Approach

25. 25
Our Key Observations

26. 26
Our Key Observations
Cookie-cutter risk assessments
1.

27. 27
Our Key Observations
Shelved risk assessments
2.
Cookie-cutter risk assessments
1.

28. 28
Our Key Observations
Document present = tick
3.
Shelved risk assessments
2.
Cookie-cutter risk assessments
1.

29. 29
Our Key Observations
Lack of security input to budgets
4.
Document present = tick
3.
Shelved risk assessments
2.
Cookie-cutter risk assessments
1.

30. 30
Our Key Observations
Policy development in blissful isolation
5.

31. 31
Our Key Observations
Security-in-depth overkill or controls mismatch
6.
Policy development in blissful isolation
5.

32. 32
Our Key Observations
Security as an opportunity/enabler, rather than an impost
7.
Security-in-depth overkill or controls mismatch
6.
Policy development in blissful isolation
5.

33. 33
Our Key Observations
A factor in all of these = risk
8.
Security as an opportunity/enabler, rather than an impost
7.
Security-in-depth overkill or controls mismatch
6.
Policy development in blissful isolation
5.

34. Security is a Wholistic System 34

35. Security is a Wholistic System 35
Policies
Physical
Controls
Budgets
Incidents & Investigations
Personnel Controls
Information Controls
Audit, Assurance & Review
Plans

36. Risk as the system driver 36

37. Risk as the system driver 37
Establish the ‘Agency-specific’ threat context

38. Risk as the system driver 38
Establish the ‘Agency-specific’ threat context
Determine risk tolerance

39. Risk as the system driver 39
Establish the ‘Agency-specific’ threat context
Determine risk tolerance
Identify criticality of assets

40. Risk as the system driver 40
Establish the ‘Agency-specific’ threat context
Determine risk tolerance
Identify criticality of assets
Assess what the agency is doing right and what is missing from a protective security perspective

41. Risk as the system driver 41
Establish the ‘Agency-specific’ threat context
Determine risk tolerance
Identify criticality of assets
Assess what the agency is doing right and what is missing from a protective security perspective
Identify relationships between security risk, WH&S, emergency management, business continuity and enterprise risk processes

42. Risk as the system driver 42
Establish the ‘Agency-specific’ threat context
Determine risk tolerance
Identify criticality of assets
Assess what the agency is doing right and what is missing from a protective security perspective
Identify relationships between security risk, WH&S, emergency management, business continuity and enterprise risk processes
Define the pathway to developing wholistic security risk treatment strategies

43. Risk as the system driver 43
Establish the ‘Agency-specific’ threat context
Determine risk tolerance
Identify criticality of assets
Assess what the agency is doing right and what is missing from a protective security perspective
Identify relationships between security risk, WH&S, emergency management, business continuity and enterprise risk processes
Define the pathway to developing wholistic security risk treatment strategies
Agree that security risk management is good business sense

44. Risk as the system driver 44
Establish the ‘Agency-specific’ threat context
Determine risk tolerance
Identify criticality of assets
Assess what the agency is doing right and what is missing from a protective security perspective
Identify relationships between security risk, WH&S, emergency management, business continuity and enterprise risk processes
Define the pathway to developing wholistic security risk treatment strategies
Agree that security risk management is good business sense
When it’s all said and done, don’t walk away

45. Cyclical approach 45

46. Cyclical approach
Security risk assessment/security risk review 46

47. Cyclical approach
Security risk assessment/security risk review
Initial planning/planning updates
Higher planning/higher planning updates 47

48. Cyclical approach
Security risk assessment/security risk review
Initial planning/planning updates
Policy development/ policy review
Higher planning/higher planning updates 48
Higher policy/higher policy updates

49. Cyclical approach
Security risk assessment/security risk review
Initial planning/planning updates
Policy development/ policy review
Implementation planning
Higher planning/higher planning updates 49
Higher policy/higher policy updates

50. Cyclical approach
Security risk assessment/security risk review
Initial planning/planning updates
Policy development/ policy review
Implementation planning
Implementation
Higher planning/higher planning updates
Higher policy/higher policy updates 50

51. Cyclical approach
Security risk assessment/security risk review
Initial planning/planning updates
Policy development/ policy review
Implementation planning
Implementation
Operations
Higher planning/higher planning updates
Higher policy/higher policy updates 51

52. Cyclical approach
Security risk assessment/security risk review
Initial planning/planning updates
Policy development/ policy review
Implementation planning
Implementation
Operations
Higher planning/higher planning updates
Higher policy/higher policy updates
Investigations
Targeted reviews and audits
Incident data analysis
Projects/validation exercises 52

53. Cyclical approach
Security risk assessment/security risk review
Initial planning/planning updates
Policy development/ policy review
Implementation planning
Implementation
Operations
Higher planning/higher planning updates
Ongoing security risk monitoring
Ongoing security risk monitoring
Higher policy/higher policy updates
Investigations
Targeted reviews and audits
Incident data analysis
Projects/validation exercises
Ongoing security risk monitoring 53

54. Cyclical approach
Security risk assessment/security risk review
Initial planning/planning updates
Policy development/ policy review
Implementation planning
Implementation
Operations
PSPF annual assurance
Higher planning/higher planning updates
Ongoing security risk monitoring
Ongoing security risk monitoring
Higher policy/higher policy updates
Investigations
Targeted reviews and audits
Incident data analysis
Projects/validation exercises
Ongoing security risk monitoring 54

55. Benefits 55
Helps protective security in an organisation:
align with the risk-based approach intent of the PSPF

56. Benefits 56
Helps protective security in an organisation:
align with the risk-based approach intent of the PSPF
to be responsive to changing environment

57. Benefits 57
Helps protective security in an organisation:
align with the risk-based approach intent of the PSPF
to be responsive to changing environment
to remain relevant to executive management (risk owners)

58. Key Takeaways and Discussion 58
The component parts must interact – communication essential

59. Key Takeaways and Discussion 59
The component parts must interact – communication essential
Risk context is crucial – tailoring important

60. Key Takeaways and Discussion 60
The component parts must interact – communication essential
Risk context is crucial – tailoring important
Take a cyclical, wholistic approach driven by risk