Professional Documents
Culture Documents
CISM MySlides 23
CISM MySlides 23
Certified
Information
Security Manager
(CISM)
New York • San Francisco • London • Sydney • Dubai • Singapore • Vancouver • Bangalore © 2022 The Knowledge Academy Ltd.
About The Knowledge Academy
The world's largest provider of classroom and online training courses
Course Syllabus
• Domain 1: Information Security
Governance
Domain 1
• An effective governance program will use the metrics, balanced scorecard, and other
means for monitoring these key processes.
• IT is the force multiplier and enabler that facilitates the business processes for fulfilling
the objectives of organisation.
Business Objectives
Security Policy
Feedback
• This is represented in the given figure. Security Standards
Security Processes
Security Metrics
• Information security governance refers to the set of top-down activities that control the
security organisation to ensure that information security supports the organisation. The
following are some activities that flow out of healthy security governance:
Program and
Processes Controls Project Metrics
Management
• This has increased to the point where organisations fully depend upon the integrity and
availability of their information system for continuing business operations.
• While building the structure of security governance, these three need to be considered.
• For the protection of these assets, the required tools, controls, and processes are as
complex as the information system which is designed for protection.
organisation will see that the information system will be adequately protected.
• The following are activities are necessary for the protection of the organisation:
Business Continuity
Incident Response Improved Compliance and Disaster Recovery
Planning
Improved IT
Metrics Resource Management
Governance
• These activities are carried out by scripted interactions among key business and IT
executives periodically.
• Meetings will consist of a discussion of the alignment with business objects, the impact
of regulatory changes, recent incidents, the effectiveness of measurements, recent
audits, and risk assessments.
• Other discussions may consist of such things like recent business results, changes to
the business, and any anticipated business events like mergers and acquisitions. The
following are the two key results of an effective security governance program:
1 2
Improved
Increased Trust
Reputation
• Usually, only high-risk averse organisations like insurance companies, banks, and
public utilities will define the risk appetite in actual terms.
• Other organisations are more tolerant of risk and make the risk decisions individually
on the basis of their gut feeling.
• So, many organisations are finding it important to articulate and document the risk
appetite of the organisation because of the increased influence and mandates by
customers.
• The CISO (Chief Information Security Officer) is rarely a person who takes the
decisions for risk treatment and is accountable for that decision. © 2022 The Knowledge Academy Ltd
Organisation Culture
• Transparency and accountability in the organisational culture have a great impact on
theknowledgeacademy
information security.
• Individual backgrounds, values, work ethics, experiences, filters or blind spots, and life
views that individuals bring to the workplace all have an impact on culture.
• Every enterprise has a culture, whether it was purposefully created or evolved over
time as a reflection of the leadership, and it must be taken into account when
ascertaining roles and duties.
• A good information security programme manager will determine the need of developing
both kinds of abilities as necessary for effective management.
• Employees in their different roles must do their duties in a way that safeguards
information assets in order to build a security-aware culture.
• All employees, regardless of their role or level within the organisation, should be
capable of defining how information security associates with their job.
• All participants must understand what behaviour is acceptable, what activities are
necessary, and what acts are explicitly prohibited in order to maintain a risk-aware and
secure enterprise culture.
• This policy can describe the expectations and responsibilities of all users in daily words
and in a straightforward, concise manner.
• It is essential to effectively convey and ensure that the acceptable use policy is read
and understood by all users. Regardless of job status, all new staff who will have
access to information assets should be provided with the use policy.
• The policy and standards for access control, categorisation, labelling, and handling of
documents and information, reporting requirements, disclosure limits, mobile
computing, unlawful uses, and enforcement are typically included in the rules of use for
all workers.
• They may also contain email and Internet usage policies. The usage guidelines serve
as a broad security baseline for the entire enterprise.
• The information security manager should collaborate with the compliance department
or Human Resources (HR) to ensure that new hires understand and agree to the
acceptable use policy.
• This strategy is most commonly used when personnel is required to perform sensitive
tasks such as penetration testing, monitoring user activities, and accessing sensitive
personal data.
• To ensure consistent and complete consideration, ethical conduct aims and activities
should be integrated with privacy and data protection activities and objectives.
• These activities may involve the incorporation of data ethics frameworks, which can aid
in the definition of protocols for ethical and responsible data use in the enterprise.
international and local legislation, other regulatory monitoring mandates, and contract-
specific information associated with security clauses.
• In order to create a strategy, the information security manager must acquire as much
information on these overarching criteria as feasible.
• Privacy, intellectual property, and contractual, civil, and criminal law are all inextricably
linked to information security.
• Any attempt to create and implement an effective information security strategy must be
founded on a thorough grasp of the applicable legal requirements and constraints.
• As a result, they are not always directly tracking regulatory requirements, and the
information security manager should not depend on the legal department to do so. The
impacted department is usually the most aware of legal and regulatory issues.
• To assure clarity on the enterprise's official position on the topic, the information
security manager should request legal review and interpretation of legislative
requirements that have security consequences.
• Automated governance, risk, and compliance (GRC) skills may aid in the maintenance
of a comprehensive catalogue of legal and regulatory requirements.
• Because business records comprise a substantial portion of the information that will be
secured by the security strategy that will be developed, it is essential for the information
security manager to understand the underlying requirements for those records.
• As a contributor to strategy development, the information security leader must know the
business requirements for all sorts of company records.
• Representatives from the company legal department can usually assist in determining
what types of records must be safeguarded to preserve their confidentiality, integrity,
and availability.
• Legal affairs representatives can also advise on legal and regulatory requirements for
enterprise documentation.
• Due to the nature of the enterprise's activity, business requirements may surpass the
legal and regulatory standards set by competent legislating bodies.
(Continued)
theknowledgeacademy
• The information security manager will be responsible for staying current with these
regulations and ensuring compliance as part of the enterprise's retention strategy.
• There may also be requirements arising from any lawful preservation order requiring an
organisation or individual to maintain specified data at the request of law enforcement
or other authorities.
• They are responsible for the appointment of the CEO (Chief Executive Officer), in a
non-government organisation.
• Executive management has the responsibility of carrying out the directives issued by
the board of directors.
Functional
Access Revocation Physical Location
Definition
• Data management positions are responsible for the development and implementation
of database designs, and the maintenance of databases.
Database
Data Manager Data Scientist
Analyst
Database Database
Architect Administrator
• Security operations positions are responsible for building, designing, and monitoring
the security controls and security systems for the assurance of confidentiality, integrity,
and availability of information systems.
Access
Security Architect Security Engineer Security Analyst
Administrator
Performance Position
360 Feedback
Evaluation Benchmarking
management.
• The information security strategy covers management actions and structures that are
distinct from governance activities.
• The information security strategy will give a plan of action for the information security
manager to meet enterprise needs, such as achieving an acceptable level of risk while
optimising resources.
board of directors and senior management with the aim of providing strategic direction,
assuring that objectives are met, risk is appropriately managed, and enterprise's
resources are used responsibly.
• A strategy is a plan for attaining a goal. The objectives outlined in the plan define the
business's strategic orientation.
• Information security must support the business strategy and the activities that take
place to attain the objectives in order to be valuable to the firm.
• It confirms that the risk of information security is correctly controlled and that enterprise
information resources are used efficiently and effectively.
developed to ascertain whether those objectives are being accomplished. The six
identified outcomes of security governance will often provide high-level direction. The
outcomes are as follows:
Strategic
Alignment
Effective Risk
Management Value
Delivery Resource
Optimisation Performance
Measurement Assurance
Process
Integration
• The plan must explain what each of the chosen areas means to the enterprise, how
each result might be attained, and what constitutes success.
• The data owner is the person who ascertains the classification level for data and is
usually the best source for ascertaining the potential implications of data leakage.
• The categorisation level will then serve as the foundation for security operations and
access control. Most businesses will employ three or four levels of sensitivity and
criticality, like confidential, internal, and public.
• Asset classification is a difficult process for most enterprises, but it is necessary for
existing information if security governance is to be effective, efficient, and relevant.
• If this assignment is not completed, it will get increasingly more difficult over time.
Policies, processes, and standards must be defined concurrently in order to mandate
classification and avoid related problems from worsening.
Implementing a procedure to make sure that every asset has a specified owner.
• For a variety of reasons, defining long-term goals in terms of a desired level of security is
essential.
• The resulting non-integrated systems will cost more money, impossible or difficult to
secure, and be harder or impossible to manage. Various businesses wait until a
significant catastrophe occurs before allocating enough resources to solve these
problems.
• This could lead to outcomes that are much more costly than dealing with problems
appropriately from the start. © 2022 The Knowledge Academy Ltd
Ensuring Objective and Business Integration
(Continued)
theknowledgeacademy
• For instance, the establishment of a Public Key Infrastructure (PKI) might permit high-
value transactions between dependable business partners or clients.
• By using Virtual Private Networks (VPNs), the sales force may be given access to
secure remote connectivity and be able to protect sensitive data well.
• In other words, information security enables business operations that would otherwise
be too risky to carry out or, as is commonly the case, be carried out in the hopes that
everything will work out as planned.
Business Linkages
theknowledgeacademy
• A direct connection to particular business activities and goals must be made when
formulating strategic objectives.
• These connections can begin from the viewpoint of a particular line of business,
considering specific objectives.
• A review and analysis of each component of a specific product line can show how this
strategy might function.
• A look into the process's past might turn up past mistakes that could point out system
flaws. The research may reveal ways to reduce errors, either by putting in place more
or better controls or by assuring redundancy for more trustable automated operations,
as human error accounts for the majority of system failures.
(Continued)
theknowledgeacademy
• If high-level members of the key departments and business units are involved, one of
the beneficial outcomes of an information security steering group can be improving
business links continuously.
• Regular meetings with business owners to address security-related topics can help
create connections.
• This could be a chance to inform the owners of business processes about the possible
advantages that more security could bring to their system.
that may have an undue influence on the objectives to be fulfilled and the activities
carried out to achieve corporate goals.
• Experiments and investigations have revealed a number of underlying reasons for poor
decision making. Awareness may result in solutions to mitigate the negative impacts.
Some of the most common pitfalls are:
• As per COBIT, it can involve high-level objectives like “protecting the interests of
individuals who rely on information, as well as the systems, processes, and
communications that manage, store, and distribute the information, against harm
caused by failures of confidentiality, availability, and integrity”.
• Because IT and related activities are involved in many elements of information security,
it can serve as a framework for ascertaining the intended state for effective information
security.
• COBIT has various emphasis areas, each of which describes a specific governance
domain, topic, or issue that can be addressed by a set of governance and management
objectives and their components.
• Focus areas may include a mix of generic governance components and modifications,
as well as issues for information security governance.
1. Based on
2. Open and
Conceptual Model
Flexible
3. Aligned to
Major Standards
• To more effectively manage security, the BMIS model employs systems thinking to
elucidate complex relationships inside the company.
• To be fully understood, a system must be regarded holistically rather than simply as the
sum of its elements.
• This is at the heart of systems theory. A holistic approach looks at the system as a
whole and as a functional entity.
• Another principle of systems theory is that understanding one aspect of the system
allows you to understand other areas of the system.
Organisation
Design/Strategy
Governance
Process
People Technology
Human Factor
1 3
Organisation
Design and People Process Technology
Strategy
2 4
• Behaviours and actions in the dynamic interconnections might throw the model off
balance or bring it back into balance. The six dynamic interconnections are as follows:
Enablement and
Governance Culture
Support
• GRC refers to a strategy that enterprises can use to integrate these three areas.
• Governance is the duty of the board of directors and senior management, and it
focuses on developing the procedures that an enterprise needs to ensure that
employees follow defined policies and processes.
• People, procedures, technology, and other resources are typically included in a road
map to attain a stated, secure desired state.
• Its purpose is to map the pathways and steps that need to be taken to achieve the
strategy's objectives.
• The interactions and relationships between numerous strategy elements are likely to be
complex. As a result, it is advisable to think about the early stages of designing a
security architecture.
• Architectures can help define business drivers, resource relations, and process flows in
a systematic way.
• Architecture can also assist in ensuring that conceptual and contextual factors, like
business drivers and effects, are taken into account during the strategy creation stage.
• COBIT defines some governance system elements as factors that collectively and
individually impact whether something will work—in this case, management and
governance of information security and enterprise IT.
• The objectives cascade drives these components (i.e., higher-level goals describe what
the different enablers must attain). The following are the components of the
governance system:
1. Principles, Policies, and Framework: The vehicle for translating desired behaviour
into practical guidance for daily management.
2. Processes: An organised set of actions and practises to attain specific goals and
produce a number of outputs in support of attaining overall objectives.
4. Culture, Ethics, and Behaviour: Individual and enterprise characteristics that are
usually overlooked as success elements in governance and management activities.
7. People, Skills, and Competencies: Necessary for carrying out all tasks successfully,
reaching the right conclusions, and for taking actions appropriately.
• The balanced scorecard of each organisation will represent the unique set of
measurements that reflects the type of business, style of management, and business
model of an organisation.
• It needs to be used for the measurement of the overall progress and effectiveness of
an organisation.
• The security balanced scorecard is similar to the balanced scorecard, which can be
used to measure the results and performance of a security organisation.
• The security balanced scorecard has the same four perspectives as the balanced
scorecard.
• The four perspectives of the security balanced scorecard are mapped to key activities,
shown in below table:
Vulnerability Reduce vulnerabilities Protect against Manage risks Learn from incidents
Management vulnerabilities
Business Continuity Ensure continuity Provide core services Test continuity Ensure awareness
Program Ensure efficiency Include customer input Reduce reactive Continue improvement
Management processes
Architecture (EISA).
• Linkages to the business side of information protection and techniques for its design
are provided by a variety of architectural approaches.
The Risk Management Code of Practice, British Standard (BS) 31100, provides a
procedure for executing and maintaining the concepts stated in ISO 31000,
involving essential functions such as identifying, responding, assessing, reporting,
and reviewing.
• The 14 sections of the ISO/IEC 27001:2013 standard can be used to assess the
comprehensiveness of an organisational security strategy and assure that all important
security elements are addressed.
• It is important to build organisational standards and policies that can be traced directly
to each standard element.
• The NIST Cybersecurity Framework, formally known as the NIST Framework for
Improving Critical Infrastructure Cybersecurity, provides high-level guidelines for
aligning a cybersecurity programme with organisational goals.
• The NIST Cybersecurity Framework does not provide any controls that can be used.
• The NIST Risk Management Framework (RMF) gives a procedure for integrating
privacy, security, and cyber supply chain risk management activities into the system
development life cycle.
• The RMF provides provisions for assessing the continuous efficacy and efficiency of
risk management procedures, as well as a risk-based approach to categorise relevant
assets, selection, and implementation controls to attain adequate protection.
strategy that must be taken into account as a preventive measure for securing an
enterprise.
• Because the most damaging and costly compromises are generally the consequence
of insider activity, whether unintentional or intentional, the first line of defence should
be to try to assure the trustworthiness and integrity of new and existing people.
• The information security program will implement the mechanisms for assuring these
traits in the workforce (including in-house people and external service providers), but
needs and plans must be incorporated into the strategy.
• This is becoming more common as the importance and prominence of the information
security function in the organisational hierarchy have grown.
• Although reporting to the CIO was appropriate in the past, that structure has become
insufficient for successfully managing increased risk, escalating losses, and the
sophistication of attackers. Furthermore, it frequently leads to a conflict of interest.
Information Security
• The cultural mix of an enterprise will influence many aspects of strategy, involving
whether a centralised or decentralised approach is more beneficial for the security
enterprise.
• While centralisation and standardisation of security can provide many benefits, the
structure of an enterprise often renders this an inefficient approach.
• For instance, some nations may forbid the storage or processing of business data
outside of their borders, and other governments may levy taxes, such as a withholding
tax, on any software or hardware used by entities under their jurisdiction, regardless of
where that software or hardware is physically located.
• It is crucial that the plan include a mechanism that defines all security duties and
responsibilities and incorporates them in employee job descriptions due to the
numerous tasks that employees must do.
• The annual job performance and goals of an employee may contain security-related
metrics.
• To describe security roles and duties, the information security manager should
collaborate with the HR director. Each job position's specific competencies should be
identified and recorded.
• Choosing a plan that employs existing abilities is likely to be the most cost-effective
option, although it may be necessary to develop new skills or outsource certain critical
functions at times.
• Proficiency testing may be useful in determining whether the necessary skills are
available or may be acquired through training.
• Because security is frequently weakest at the end-user level, training, education, and
awareness are critical components of the overall plan.
• It is critical to evaluate the requirement for the development of methods and processes
that make policies, standards, and procedures easier to follow, implement, and
monitor.
• A periodic security awareness campaign intended for end users underlines the
importance of information security, and it is now required by law in several jurisdictions
for a variety of sectors.
• Evidence suggests that the majority of employees in most businesses are unaware of
security policies and regulations, even if they exist.
• Audits, both external and internal, are one of the primary methods for ascertaining
information security deficiencies in terms of controls and compliance, and they are an
important resource in strategy creation.
• Internal audits are typically undertaken by an internal audit department that reports to
either an audit committee of the board of directors or senior management in larger
enterprises.
• External audits are often performed by an independent third party and may involve IT
and information security domains, depending on audit objectives.
• Because audits can give the information security manager valuable monitoring tools,
the security department must have access to this information.
• It is critical for the information security manager to have solid working relationships
with other assurance providers in order to facilitate the flow of information that is
required for effective security management.
• Many enterprises are required to file numerous audits and other reports with regulatory
bodies as a result of increased regulatory oversight.
• Many of these reports have implications for information security and can give helpful
intelligence and monitoring data to the information security manager.
SECRET PRIVATE
(Serious Damage) Class 2 (Serious Damage)
CONFIDENTIAL SENSITIVE
(Damage) Class 1 (Damage)
UNCLASSIFIED PUBLIC
Class 0
Label
Data Classifications
Assurance Provisions
Compliance Enforcement
theknowledgeacademy
• Security violations are a constant worry for information security managers, and it is
essential to develop methods for dealing with them as part of the strategy
development.
• Senior management buy-in and support for these procedures are crucial, particularly in
terms of enforcement.
• The most effective way to comply in an enterprise where transparency and trust are
valued and fostered by management is likely to be a system of self-reporting and
voluntary compliance based on the knowledge that security is clearly in everyone's
best interest.
should be included in the information security strategy. Strategic planning involves the
determination of how to attain risk direction in order to safeguard diverse enterprise
assets from a wide variety of threats and vulnerabilities.
• The following are the elements that must be considered in strategic planning,
and subsequent operation and implementation as a part of information security
itself:
Other
Vulnerability Organisation
Assessment Insurance
l Support
and
Insurance
• A gap analysis is necessary for several strategy components, including maturity levels,
control targets, and risk and impact objectives.
• The analysis will determine the steps required to transition from the present state to
the desired state in order to meet the set objectives.
• Working backward from the endpoint to the current state to find the intermediate steps
required to achieve the objectives is a common technique for gap analysis.
• The strategy's implementation plan will necessitate mechanisms for monitoring and
measuring progress and achievement of goals.
• As with any project plan, costs and progress must be reviewed on a continuous basis to
ensure plan compliance and to allow for prompt mid-course modifications.
• There will very certainly be a number of short-term objectives, each of which will
necessitate resources and a plan of action to attain.
• The following are some essential objectives for an information security plan:
• The findings of the testing must be signed by the CFO and CEO and confirmed by
independent auditors. The findings must subsequently be published in the company's
public filings with the SEC.
• Appropriate testing plans that are consistent with the established goals and incorporate
the CSFs must be developed in order for tracking progress in the testing effort.
• Management will require reporting on the progress and outcomes of testing due to the
limited time available to execute the essential tests.
• Considerations for information security metrics involve confirming that what is being
assessed is, in fact, appropriate.
• Metrics serve only one purpose: to deliver the information required to make decisions. It
is therefore vital to understand what decisions must be taken and who makes them, and
then to devise means to provide that information in an accurate and timely manner.
• Different metrics are more or less valuable for different segments of the organisation
and should be determined in consultation with business process management and
owners.
• While technical metrics are crucial to the IT security manager, senior management
usually wants a summary of information that is important from a management viewpoint
- information that normally excludes comprehensive technical data.
Audit findings.
• The information security manager might require more in-depth tactical data, such as:
• Once the overarching strategy has been completed, most enterprises may easily define
a variety of specific near-term targets that are in line with the overall information security
strategy.
• If the security strategy objective is to attain CMMI level 4 certification and compliance,
then an example of near-term action may explain the following:
The current applications being used must be identified by each business unit.
Twenty-five percent of all data that has been kept needs to be examined to
determine who owns it and how sensitive it is.
In order to identify important resources, each business unit must complete a BIA for
information resources. © 2022 The Knowledge Academy Ltd
Action Plan to Implement Strategy
(Continued)
theknowledgeacademy
To ensure that all policies are consistent with strategic security goals, all policies must
be evaluated and amended as appropriate.
action plan.
• The program is essentially the project plan for implementing and establishing ongoing
management of some or all of the strategy's components.
• The information security program protects persons who rely on information as well as
the procedures, systems, and communications that handle, store, and transmit it.
• Its goal is to keep them safe from harm caused by failures in availability, confidentiality,
and integrity. Concepts such as information utility and possession are emerging
definitions (the latter to cope with theft, deception, and fraud).
• The networked economy has undoubtedly increased the importance of trust and
accountability in electronic transactions.
When needed, information is available and usable, and the systems that provide it
can withstand attacks (availability).
Information is only observed or released to those who have a legal right to know
(confidentiality).
Domain 2
Risk identification is the process of determining the nature and type of viable threats
and examining the enterprise's vulnerabilities that are subject to those threats.
The vulnerabilities that identified threats may exploit constitute an identified risk.
Only identified risks can be assessed and treated appropriately, so risk identification is
essential to effective risk management.
It is essential to identify all information assets, involving those held by third parties. It is
necessary to identify viable threats, both potential and actual.
The viability of a threat is determined by two factors: The threat exists or could
reasonably be anticipated to materialise, and the threat is under control in some way.
These exercises consider that all significant enterprise vulnerabilities are known, as
well as the types and nature of threats that could exploit them.
Business
Risk Scenario Approaches Goals
• Identified Business Objectives
• Identify Scenarios with highest impact on achievement of
business objectives
Business
Goals
Generic Risk
Scenarios
Bottom
Up
• Internal threats are related to the employees of the organisation and the employees
may be the intentional actors of these threats.
• For the constitution of threats, the following events can take place:
• These can include both deliberate and accidental assets, like internal threats.
• The security manager who is performing a risk assessment should understand the full
range of threat actors, along with their motivations.
• Advanced Persistent Threats (APIs) are highly skilled, advanced attackers with a
strong motivation to exploit systems and networks.
• The increased skills available to the hacking community, as well as the efficiency of the
tools they use, raises the risk of compromise significantly.
• The information security manager should be aware that APTs pose a significant risk to
businesses of all sizes around the world and must ensure that adequate measures are
in place to detect and identify this threat.
• There are several standards and publications available to guide information technology
and security risk management approaches.
• Examples include:
o COBIT
• In several cases, compromised enterprises have proof of emergent threats in their logs
well before the actual compromise, but the evidence is not acted on or not noticed.
• When combined with a threat, a lack of effective monitoring can result in a breach.
• Most technologies are designed with an emphasis on function and aim, with little
regard for security implications.
• As a result, new technology is often a source of new vulnerabilities and, in some cases,
can act as a threat agent within an information system.
• The information security manager should be aware of new technologies and plan for
their introduction in the enterprise, especially if the technologies promise cost savings
or a competitive benefit.
of uncertainty on objectives." This means that results can be either positive or negative.
• Risk will be evaluated primarily from a negative viewpoint, with negative risk defined as
the likelihood of an event and its consequences.
• The likelihood, also known as probability, is a measure of the frequency that an event
may arise.
• When determining risk, likelihood is used to estimate the level of risk on the basis of
the frequency of events as well as the influence of those events that may arise in a
given time duration.
elements.
• The register must act as a central repository for all information security risks, involving
specific threats, exposures, vulnerabilities, and assets at risk. It must involve the owner
of the asset, the risk owner, and any other stakeholders.
• Because the risk register is a living repository, content must be filled out as the
assessment process begins.
• Once the efforts for risk identification, evaluation, analysis, and response have been
achieved, and other relevant information has been entered into the register, it will act
as an authoritative reference point for every risk management-related activity.
• Risk registers improve responsibility by assigning risk to risk owners and also give a
tracking mechanism to ensure risk has been mitigated in accordance with agreed-upon
action plans and timelines. There is no accountability if there is no risk register.
• The risk register gives an overview of the enterprise's risk profile. A risk profile is a
necessary component of active information risk management.
• It will provide a thorough overview of the overall risk to which the enterprise is exposed,
as well as other pertinent information.
Module 2A2:
Vulnerability and Control Deficiency
Analysis
condition.
• The extent of exposure should be considered because it influences the likelihood that a
vulnerability will be compromised.
• These differences are important when prioritising risk management efforts, ascertaining
the level of risk within a scenario, and explaining conclusions and suggestions to
management.
• Many vulnerabilities are system conditions that should be identified before they can be
addressed.
• A vulnerability assessment should consider both process and procedural flaws as well
as logical flaws. There is a risk where there are vulnerabilities.
• Various types of testing or subject matter expert estimates can be used to estimate the
degree of vulnerability. Estimates, like other types of valuations, can be quantitative or
qualitative.
• Using ranges or distributions to indicate both unlikely maximums and more probable
values is an effective approach for reflecting uncertainty in values. © 2022 The Knowledge Academy Ltd
Introduction
(Continued)
theknowledgeacademy
• Understanding the other controls in place that may mitigate the overall exposure is
required to determine the ultimate relevance of a weak control.
• It would be inaccurate and unfair to portray a control as a major issue when, in fact, the
mixture of controls is quite robust.
• Several IT system flaws are discovered utilising automated scanning equipment, and
these can act as leading symbols of potential compromise.
• Process and performance vulnerabilities are more challenging to identify and may need
a thorough review and analysis.
• To be efficient, the assessment must take into account process, procedural, and
physical vulnerabilities, as well as technological flaws.
the information security risk management framework, which also includes controls.
It is intended to give reasonable assurance that the business goals are attained and
the potential consequences of undesired events are adequately addressed.
The framework should consider people, procedures, and technology, as well as the
enterprise's physical, contractual, technical, and procedural elements.
Safeguards are proactive controls because they are applied and utilised to prevent an
event from occurring.
Intrusion Prevention Systems (IPs), Employee background checks, and turnstile gates
are instances of proactive controls or safeguards.
Any significant incident needs a risk assessment and a root cause analysis of the
failure, which may need increasing or altering baseline security by changing
appropriate policies, procedures, processes, standards, or controls.
Information security managers must monitor and assess events that affect security
baselines and, as a result, might influence the security posture of the enterprise.
Based on this evaluation, the information security manager should determine whether
the enterprise's security strategy, roadmap, and test plans need to be altered to
address changing risks.
These involve weighing policy alternatives with interested parties, taking risk
assessment and other factors into account, and selecting suitable prevention and
control options with acceptable costs and influences on the enterprise's capability to
operate efficiently.
Risk management functions typically involve the execution of the following processes:
Recommen
Perform d Risk Accept Communica
Establish Identify
Risk Treatment Residual te About
Scope and Assets and
Assessmen or Risk and Monitor
Boundaries Valuation
t Response Risk
Identify and
Assess Risk
Implement Risk
Management
Plan
© 2022 The Knowledge Academy Ltd
Introduction
(Continued)
theknowledgeacademy
Context
Establishment
Risk
Risk Analysis
Risk Evaluation
Risk Treatment
costs.
The scope of risk management activities and the environment in which risk
management operates is defined by the context, which involves the organisational
structure, culture, principles, people, infrastructure, and skills.
Roles and responsibilities, not only for the various parts of the enterprise involved in
the risk management process but also for risk and control ownership.
The risk-evaluation criteria should be determined and agreed upon. Whether or not risk
treatment is needed is usually determined by technical, operational, regulatory,
financial, legal, social, or environmental criteria or a mixture of these.
The criteria must be consistent with the scope and analysis of the enterprise's internal
policies and processes, and they should support the enterprise's objectives and goals.
Risk Appetite/Risk Tolerance: The rules that ascertain whether the risk level is
such that additional treatment activities are needed.
These criteria may require to be modified later in the risk management process as a
result of changing circumstances or as a result of the risk assessment and evaluation
process itself.
Most of the time, incident management is sufficient for managing materialised risk,
minimising significant disturbance to operations and potential influences.
In some cases, incidents will escalate to tragedies, requiring business continuity and
disaster recovery.
evaluation, analysis, assessment, and response activities are integrated into life cycle
processes.
• The necessity to minimise an enterprise's negative influence and to establish a solid basis
for decision-making are the primary reasons enterprises implement a risk management
process for their IT systems.
• Risk management must be fully integrated into the System Development Life Cycle (SDLC)
for it to be effective. The SDLC of an information technology system has five phases:
initiation, development or acquisition, implementation, operation or maintenance, and
disposal.
• In some cases, an IT system may be in multiple phases at the same time. However,
regardless of the SDLC phase for which the assessment is performed, the risk management
methodology is the same.
• Risk management is an iterative procedure that can be conducted throughout every major
phase of the SDLC. © 2022 The Knowledge Academy Ltd.
Risk Management Integration with IT Life Cycle
Management Processes
theknowledgeacademy
(Continued)
• Other business areas and activities may already have change management processes in
place.
• One advantage is that many enterprises now have change management processes in place
that cover the whole enterprise.
• The information security manager should be familiar with these change management
activities and assure that security is properly integrated with business operations so that
changes are not made without considering the implications for the enterprise's information
assets' overall security.
• One way to help assure this is for information security management to join the change
management committee and assure that all changes are subject to security review and
approval and that proposed changes satisfy policy and standard requirements.
• Any proposed variations must be identified and documented for further investigation.
© 2022 The Knowledge Academy Ltd.
Risk Management Integration with IT Life Cycle
Management Processes
theknowledgeacademy
(Continued)
• While the normal focus of change management is on hardware and software changes and
security influence, the change management process must extend far beyond system owners
and the IT population.
• Change management must involve facilities management for data centre infrastructure and
any other area that may have an influence on overall information security.
• Changes in these areas are frequently not documented in a timely manner. It is possible that
facilities do not have current single-line drawings and blueprints.
(Continued)
IT Risk
Identification
Risk Response
and Mitigation
Consequences,
Resulting Asset/ Resource
Actor Type Of Threat Results or Frequency
Event
Impact
1 2 3 4
The information security manager has access to a variety of risk management models
theknowledgeacademy
and assessment approaches. The approach chosen must be specified by the best
form, fit, and function.
Depending on the enterprise and the specific requirements, approaches such as the
Holistic Approach to Risk Management (HARM), Factor Analysis of Information Risk
(FAIR), risk factor analysis, and value at risk (VAR) may be more appropriate.
Risk scenarios in the COBIT approach include the process of identifying risk, followed
by analysis. The next step is to evaluate the risk to see if it exceeds acceptable levels.
These three steps enable the risk assessment to produce a suggestion for the best risk
response, or risk treatment.
Priorities for response are determined by a cost-benefit and risk-level analysis, with
high cost-benefit and high likelihood.
• A few of these advancements are being executed in the field of information security,
and it is likely that more refined techniques and methods will continue to be developed.
resulting outcomes.
This step involves ascertaining threat actor abilities and motivations, as well as the
efficiency of existing controls and the extent to which they may affect a specific
identified risk. Risk analysis includes:
The degree to which information assets are vulnerable to potential threats and their
impact on likelihood. The potential negative effects of successfully attacking the
assets.
The likelihood of those consequences occurring, as well as the factors that influence
them.
to and prioritises risk based on the foregoing analysis, with assistance made for the
probable margin of error, which can be significant if reliable data is unavailable.
• This is done within the context of the enterprise's defined tolerance criteria, risk
appetite, and capacity creating a method to advise on a reasonable and suitable risk
response.
• Acceptance is the most likely treatment option if the risk meets the acceptable risk
criteria.
• If the risk exceeds the acceptable level and is not within the tolerance range, the most
likely treatment will be some form of mitigation.
• A system redesign can reduce technical risk, or risk sharing may be the most cost-
effective alternative. © 2022 The Knowledge Academy Ltd
Risk Evaluation
(Continued)
theknowledgeacademy
• If there are no cost-effective alternatives for mitigating extreme risk, management may
take the decision that the activity is not worth the risk, or it may decide to take the risk if
the advantages outweigh the risks.
• Typically, risk transfer is chosen for risks with a lower likelihood but a high influence.
• Control risk should be considered if the risk is mitigated through the use of controls.
• If the results are ambiguous, inaccurate, or misleading, the risk assessment may lead
to a decision to conduct additional analysis.
• The risk ranking is derived from a mixture of all risk elements, such as threat
recognition and the characteristics and abilities of a threat source, the severity of a
vulnerability, the likelihood of occurrence when considering the effectiveness of
controls, control risk, and the influence to the enterprise should the risk be realised.
• When these are added together, they indicate the level of risk associated with a threat.
Risk treatment pits available resources against the requirement of risk reduction.
Not all risks can be mitigated or eliminated because there is not a sufficient amount of
resources to treat them all in the enterprise environment.
Risk analysts and technology architects can devise ways to bring about the greatest
possible risk reduction when risk treatment is performed at the enterprise level.
Every enterprise has a specific risk capacity, which is defined as the maximum amount of
loss that an enterprise can tolerate without jeopardising its continued existence.
The risk appetite of an enterprise is determined by its owners or board of directors, subject
to the absolute maximum imposed by this risk capacity.
Risk appetite is described as the amount of risk that an entity is willing to accept in the
pursuit of its mission on a broad scale.
As part of strategic planning, the board of directors may delegate risk appetite setting to
senior management in some cases.
Acceptable risk appetite or risk determination, as well as assessment criteria, are important
to almost all elements of information security and most other elements of organisational
activities.
(Continued)
Many aspects of strategy, such as control objectives, baseline security, control execution,
cost-benefit calculations, severity criteria determination, risk management options, required
incident response abilities, insurance requirements, and feasibility assessments, will be
determined by risk appetite.
Risk appetite is translated into several standards and policies that must be adjusted or
confirmed on a regular basis in order to keep the risk level within the boundaries set by the
risk appetite.
The risk may be accepted within the boundaries, a formal and explicit process that confirms
that the risk requires and warrants no additional response by the enterprise as long as the
specific risk and risk environment remain substantially the same and accountability for the
risk is assigned to a specific owner.
Risk acceptance should not exceed the enterprise's risk appetite, but it should also not
exceed the risk capacity. © 2022 The Knowledge Academy Ltd.
Risk Response Options
For risk treatment, the following are the four primary ways:
theknowledgeacademy
Risk Risk
Mitigation Transfer
Risk
Risk
Acceptanc
Avoidance
e
High Risk acceptance possible at the department level (e.g., CFO, COO, CIO)
The risk that stays after controls are executed is referred to as residual risk. Risk can
never be eradicated because a certain level of residual risk always exists even when
appropriate controls are implemented.
It must be noted that lowering one risk invariably raises another, hopefully of a lower
magnitude.
The goal is to assure that residual risk is similar to the enterprise's acceptable risk
criteria or satisfies risk tolerance criteria.
Risk tolerance is defined as the allowable variation from acceptable risk, which is
typically expressed as a percentage or range.
Acceptable residual risk must be the result of meeting the defined control objectives
and be equivalent to the enterprise's defined security baselines.
© 2022 The Knowledge Academy Ltd
Inherent and Residual Risk
(Continued)
theknowledgeacademy
Residual risk above an acceptable level must be treated further, with the option of
additional mitigation through the execution of more stringent controls.
Risk levels below the acceptable level must be assessed to determine whether the
controls in place are still necessary and whether they can be reduced in cost by
removing or modifying them.
Vulnerabilities and threats that do not have an impact are usually insignificant and are
not regarded as a risk.
Loss of reputation/goodwill/image.
While layering controls is a good idea, utilising too many controls to address the same
risk is wasteful and often decreases productivity. It is essential to assure that the
various controls are not all exposed to the same risk, as this would defeat the objective
of layering them.
Risk assessments must be conducted from the beginning to the end of a process in
order to be effective and reasonably accurate.
influence. Senior management should do this in order to determine the suitable level of
compliance and priority.
Legal general counsel must evaluate regulations to specify the exposure the enterprise
subject as a result of the regulation and the current level at which the enterprise can
demonstrate compliance.
Because enforcement actions are typically initiated against those who are least
compliant, the enterprise must consider the level of enforcement and its relative
position in relation to its peers.
These evaluations serve as the base for senior management to specify the nature and
scope of relevant compliance activities for the enterprise.
The information security manager should be aware that senior management may
decide that risking sanctions is slightly expensive than attaining compliance, or that
compliance is not warranted because enforcement is limited, or even non-existent.
This is a management decision that must be weighed against risk and impact.
If the costs of specific controls outweigh the benefits of mitigating a particular risk, the
enterprise may decide to accept the risk instead of incurring the cost of mitigation.
Cost-benefit analysis provides a financial perspective on risk and specifies the cost of
protecting what is essential.
Yet, cost-benefit analysis is also about making wise decisions on the basis of the costs
of risk mitigation versus potential losses. Both ideas are directly related to good
governance practises.
Most information security crime and loss metrics, however, are not as well established
as traditional robbery and theft statistics.
Employee productivity impacts, revenue losses, and direct cost loss events are three
common measures of potential losses.
analysed, and evaluated, its owner must be identified as a manager or senior official
within the organisation.
A risk owner is responsible for accepting risk based on the organisation's tolerance
criteria and risk appetite, and they should be able to choose the appropriate risk
response based on analyses and guidance provided by the information security
manager.
This accountability includes approving controls when risk mitigation is the preferred risk
response.
The idea is to establish a direct link so that all risk is addressed through appropriate
treatment and all controls are justified by the risk that requires their existence.
Due to the shared relationship between risk and controls, the owner of a risk should
also own any controls associated with that risk and be held accountable for ensuring
their effectiveness.
© 2022 The Knowledge Academy Ltd
Risk Ownership and Accountability
(Continued)
theknowledgeacademy
Risk owners may be required to prepare standard reports on the status of risk, any
incidents that may have occurred, the level of rink currently encountered by the
enterprise, and the tested effectiveness of controls in areas where there are regulations
or laws that apply to risk.
Control
and authority for making risk-based decisions, as well as the person who bears the loss
related to realised risk plan.
Strategically, senior management is the risk owner who is ultimately responsible for risk
response across the enterprise. From an operational and management standpoint,
directors, vice presidents, managers, and so on have the power and accountability and
must be held responsible for making risk-related decisions as part of routine
operations.
The control owner and the risk owner are usually the same people because any
changes or removal of a control will impact the risk being treated, probably causing the
risk to exceed the defined risk appetite.
Control ownership, like risk ownership, falls to individuals within the enterprise who
have the authority to make control decisions and will be held responsible for how risk is
managed.
On a regular basis, the results and status of this ongoing analysis must be documented
and reported to senior management.
Senior management will usually be less interested in technical details and will instead
want an overview of the current situation and indicators of any impending or immediate
threat that needs attention.
Security dashboards, stoplight charts, and heat charts are generally used to display an
overall evaluation of the security posture. Other representations of security status, like
spider charts or bar graphs, may be more effective at conveying trends, depending on
the recipients.
The information security manager is accountable for managing the reporting process to
assure that it occurs, regardless of the form of reporting, and that the results are
sufficiently analysed and acted on in a timely manner.
© 2022 The Knowledge Academy Ltd
Key Risk Indicators
One approach that is gaining popularity is the use of key risk indicators to report and
theknowledgeacademy
monitor risk (KRIs). KRIs are measures that indicate when an enterprise is exposed to
risk that exceeds a predefined risk level.
These indicators are generally developed based on experience and emerge from
trends in factors known to increase risk. They can range from increased absenteeism
or turnover in key employees to an increase in security events or incidents.
KRIS can give early warnings about potential issues or areas of particular risk. As a
means of ongoing monitoring, a variety of risk indicators can be developed for various
parts of an enterprise.
Aside from experience, KRIs can be chosen based on sources such as industry
benchmarks, external threat-reporting services, or any other factor that can be
monitored and indicates changes in risk to the enterprise.
To the root cause of events rather than only focusing on symptoms, confirming that
the chosen indicators drill down.
To represent a risk status with the related and appropriate stakeholders and with top
management on the overall risk profile of the enterprise, involving modifications in risk
level and status of any open risk, the information security manager should have regular
meetings.
Also, the security program should contain a procedure in that a substantial security
event or breach will trigger a report to top management and a reassessment of risk and
suitable controls because all security incidents or events are the consequence of the
loss of or deficiency of, controls.
For evaluating security events based on affect tp the enterprise, the information
security manager should have defined procedure.
© 2022 The Knowledge Academy Ltd
Risk Communication, Awareness and Consulting
enterprise at every step of the risk management procedure for risk management to
become part of culture of the enterprise.
This procedure will permit deviations in perceptions and needs to be addressed and
identified more effectively.
Risk Awareness
theknowledgeacademy
Awareness is a strong mean in building the culture, shaping values and affecting the
manners of the members of an enterprise.
The risk and security awareness program should contain communication of security
and risk information, regular testing as a measure for awareness, and a medium for
staff to report security and risk issues.
The operational teams of an enterprise are usually the first to be aware of any
abnormal activities or problems.
Each team member can assist recognising vulnerabilities, suspect activity and potential
attacks.
This may allow a more rapid reaction and more suitable containment of a risk when an
attack occurs.
(Continued)
theknowledgeacademy
This is acknowledge by the risk awareness that risk is an essential part of the business.
It aims to confirm the following:
The enterprise uses and recognises the available tools to manage risk.
Decisions regarding the extent and nature of documentation includes related benefits
and costs. The risk management policy, program and strategy describe the
documentation required.
Documentation should include the following at each stage of the risk management
procedure:
Information Decision
Objectives Audience Assumptions
Resources Criteria
Management:
A risk register.
Domain 3
It relied upon a conceptual model with specified key relationships and components.
Implements a flexible and open strategy that can be modified based on adjustments
and priorities from key stakeholders while keeping consistency and integrity.
increasing the support of the business functions and decreasing operational operation is
the objective the information security program.
• The primary task will be revolving high-level strategy into physical and logical reality
through a series of initiatives and projects for a well developed security strategy.
• Another prospect is that more useful resolutions may become available during program
development or eventually.
• A great deal of design and planning will be needed to accomplish working project plans
whether a procedure has been developed in significant detail or only to the conceptual
level.
• It is important to determine the details that drive the business requirement for the
information security program. The following are the primary drivers for an information
security program:
developed, it will still be necessary to define overall objectives for security activities.
• It will still be essential to define overall objectives for security activities if security
governance has not been executed or a strategy has not been developed.
• Many projects include complex or unusual technical components and may need precise
specification, engineering efforts and design.
© 2022 The Knowledge Academy Ltd
Information Security Program Concepts
Management and Process Concepts
theknowledgeacademy
• Managing and implementing a security program will need the information security
manager to have knowledge of a number of management and procedure concepts
involving:
Architectures
Budgeting, costing and financial issues
Business case development
Business process reengineering
Communications
Contingency planning
Control design and development
Control implementation and testing
Control monitoring and metrics
Control objectives
Critical thinking
Documentation
Personnel issues
© 2022 The Knowledge Academy Ltd
Information Security Program Concepts
Technology Resources
theknowledgeacademy
• Including the applicability and viability of available solutions in the terms of the goals
and objectives of the program, the information security manager must be qualified to
take decision with respect of technology.
• It is crucial that the information security manager understand here a given technology
fits into the detection, containment, prevention, recovery and reaction framework and
the it will serve to execute strategic components. The information security manager
should be similar with the following:
• The information security manager will to determine the responsibilities, charter and the
scope of the program whether forming a new security program or coming into a current
one.
• The security manager will find it hard to determine what to manage or how well a given
security function is meeting objectives without clearly defined responsibilities.
• It is essential to understand the location of information security function fits into the
whole organisational structure in terms of the chain of command.
• It would be sensitive to use any time available to achieve insight into the existing
situation if the prior manager is available for orientation.
• Reviews of recent incidents, audits and other related reports will be useful.
surprising array of unexpected conditions for the information security manager. These
involves:
Management Support
theknowledgeacademy
• Because such enterprises are not required to address information security, they
frequently regard it as a minor issue that adds cost with little value.
• Management may require direction on what actions are expected, as well as information
on approaches taken by industry peers to address information security.
• Even if initial education does not result in an immediate increase in support, ongoing
education should be carried out to raise awareness of security needs. The information
security programme strategy must include provisions for managing changes and
updates.
Funding
theknowledgeacademy
• One of the most challenging and frustrating issues the information security must
address is inadequate funding for information security initiatives. While this problem
may be a sign of an underlying deficiency of management support, there are usually
other aspects the information security manager is capable to influence.
Staffing
theknowledgeacademy
• The root cause of funding problems is usually insufficient staff to meet security program
requirements. Barriers to acquiring adequate staffing levels might incorporate:
Physical
theknowledgeacademy
• The prominent ones contain space, environmental hazards, capacity and availability of
infrastructure.
• The program and security strategy should make certain that conditions are made for the
consideration of adequate infrastructure capacity and environmental hazards.
• Contemplation should contain physical needs for recovery in the case of a disaster.
Culture
theknowledgeacademy
• The culture in that the enterprise works must also be considered. A program that is at
probabilities with cultural standards may encounter resistance and may be hard to
execute successfully.
Organisational Structure
• Organisational structure will have a critical affect on how a management strategy can
be developed, executed and translated into an information security program.
Costs
theknowledgeacademy
• With safety projects, however, control of precise compliance and risk with regulations
are generally the primary drivers.
Personnel
• A security strategy must assess what resistance may be experience during execution.
Resistance to important changes, along with probable displeasure against new
restriction possibly viewed as making tasks more time-consuming or difficult, should be
expected.
Resources
theknowledgeacademy
• An adequate method must evaluate available budgets; the total cost of ownership
(TCO) of additional and new technologies; and the manpower needs of implementation,
design, maintenance, operation and eventual disarm.
• Generally, the TCO must be developed for the whole life cycle of processes, personnel,
and technologies.
Capabilities
• The resources available to execute a procedure should involve the known abilities of
the enterprise, involving skills and expertise.
• A method that depends on shown abilities is more likely to achieve than one that does
not.
Time
theknowledgeacademy
• There may be windows of opportunity for certain business activities that require distinct
timelines for execution of particular strategies.
Technology
• Technological complexness may restrain the execution of a protection strategy
compatible across the enterprise.
• There may be unsupported systems and existing legacy that are impotent to support the
security control execution until they are inactivated. Exemption procedured may be
developed to manage and assess the risk occurring from these constraints.
• This is required because the business value is a portion of the risk determination. The
valuation process, which includes connecting all values in a typical financial form, is
straightforward for some assets.
• Other possible effects can occur if the individuals suffering identity theft losses file
lawsuits for injuries, or if lawyers file class-action lawsuits on behalf of a lot of victims.
• Types of distinct information assets that must be allocated a value and protected
involve, but are not limited to the following:
Proprietary processes and information of all kinds, containing information that can harm
the enterprise.
Future projections and current financial records.
Merger plans or acquisition.
Strategic marketing plans.
Trade secrets.
Patent-related information.
Privacy-related information, involving protected health information (PHI) and PII.
Customer data, concluding payment card information (PCI).
• Many enterprises do not have an exact list of information assets, and the struggle to
categorise and inventory their assets can seem to be a daunting task. The
accurateness of the valuation is not as essential as having a constant strategy to
prioritise efforts.
• Values within the similar order of importance as the real loss are adequate for planning
objectives. Media reports include many well-documented failure strategies and loss
amounts on which to establish a valuation.
• Quantitative valuation methodologies are typically the most accurate but can be quite
difficult once downstream and actual effects have been analysed.
© 2022 The Knowledge Academy Ltd
Information Asset Classification
• Information asset classification is needed to determine the criticality of information
theknowledgeacademy
• The foremost step in the classification process is to confirm the information asset list is
done, involving the identification of the location and purpose of each asset.
• A great benefit of information asset classification is the fact that connecting security to
business goals decreases the risk of either under-protection or expensive
overprotection of information assets.
• Providing the same high level of protection to all assets can be very costly, if the
enterprise is risk-averse and needs a high level of security,
The information security manager may use the methodologies outlined within MST,
COBIT and other frameworks that are representatives of the resources. It is essential,
however, to confirm that concerns contain both the direct impact and any downstream
outcomes.
The foremost step to determining
information asset significance is to
crack the organisational or corporate
structure into departments or
business units.
(Continued)
Identifying the critical organisational functions is the next step. The focus for each
business department or unit is to define what tasks are essential to the unit in attaining
its goals.
(Continued)
(Continued)
Asset Vulnerabilities
• An enterprise information security architecture (EISA) can be a strong tool for the
theknowledgeacademy
• Even though technical security has significantly improved, the lack of architecture has
resulted over time in functionally less security integration and increasing vulnerability
across the enterprise.
(Continued)
theknowledgeacademy
(Continued)
theknowledgeacademy
2. Data architecture, that defines the structure of an enterprise's physical and logical
data assets and the related data management resources.
3. Applications architecture, that gives a blueprint for the individual application systems
to be used, the relations among the application systems, and their relationships to
the centre business procedures of the enterprise with the frameworks for services to
be revealed as business functions for integration
(Continued)
theknowledgeacademy
• A data architecture defines the structure of an enterprise's physical and logical data
management resources and data assets.
• To give a framework for successfully managing complexity, one of the main functions of
architecture as a tool.
• Both directly and indirectly, these objectives include demonstrating the following:
(Continued)
theknowledgeacademy
The program is being worked efficiently and with consideration for cost problems.
The program contains conditions for the continuity of business of the enterprise.
• COBIT allows IT and information to be managed and governed entirely for the
enterprise, managing the IT and business functional areas of responsibility, and
thinking the information-related interests of internal and external stakeholders.
• COBIT is relied on two sets of principles: 1) principles that defines the central
necessities of a governance system for enterprise information and technology, 2)
principles for a framework that can be employed to create a governance system for the
enterprise.
• COBIT involves multiple focus locations that define particular governance topics,
issues and domains that can be directed by a group of governance and management
goals and their elements.
ISO/IEC 27001:2013
theknowledgeacademy
• Based on the British Standard, this standard has been slightly expanded to include the
following control areas:
A.5 Information Security Policies
A.6 Information Security Organisation
A.7 Human Resource Activity
A.8 Asset Management
A.9 Access Control
A.10 Cryptography
A.11 Environmental and Physical Security
A.12 Operations Security
A.13 Communications Security
A.14 System Development and Maintenance
A.15 Supplier Relationships
A.16 Information Security Incident Management
A.17 Information Security Aspects of Business Continuity Management
A.18 Compliance
• Formally titled the NIST Framework for Enhancing Critical Infrastructure Cybersecurity,
this model gives high-level advice for aligning a cybersecurity program with enterprise
goals. The framework underlines the requirement for adequate risk management
integration and it greatly supports progress in supply chain risk management.
• The MST Cybersecurity Framework does not give commands to be used. Examination
of the gaps in conditions allows the use of controls-based frameworks to enhance
information security risk management. The following are the Components of the MST
Cybersecurity Framework:
Framework
The Framework Framework
Implementation
Core Profile
Tiers
• The system development life cycle can be integrated with security, privacy, and cyber
supply chain risk management tasks using the KIST Risk Management Framework
(RMF).
• The RMF includes provisions for monitoring the ongoing efficacy and efficiency of risk
management procedures as well as a risk-based method for categorising pertinent
assets, choosing and implementing controls to ensure adequate protection, and
categorising relevant assets. The following are the RMF steps:
Technical Components
theknowledgeacademy
• It is important that all technology elements have an recognised owner and that there
are no orphan methods. This is required to confirm accountability and responsibility for
keeping all systems in adherence with security policies and for proper treatment and
ownership of associated risk to acceptable levels.
• The extensive majority of the enterprise's information will reside with IT and will be a
major priority of the information security framework, from an information security
perspective.
• The information security function must sufficiently regulate the IT function and give
direction to confirm policy compliance adequate to acquire acceptable risk levels
constant with the information security strategy goals. © 2022 The Knowledge Academy Ltd
Information Security Frameworks Components
Operational Components
theknowledgeacademy
• These operational components contain items like business operation security practices,
SOPs, administration and maintenance of security technologies.
• They are usually performed on a daily to weekly timeline. The information security
manager should give current management of the operational information security
elements.
Management Components
theknowledgeacademy
• These activities usually take place less often than operational components, possibly on
a timeline measured in years, months or quarters.
• Management policies, necessities and objectives are key in shaping the information
security program, that, in turn, describes what must be managed.
• To be the basis for changing security policies and modifying and developing standards,
periodic or ongoing analysis of risk, assets, threats and organisational impact must
continue.
Administrative Components
theknowledgeacademy
• The information security manager must create a working rapport with the finance
department of the enterprise to confirm a strong working relationship, support, and
keeping with financial procedures and policies.
• Employee awareness and education about security risk is often merged with initial
training and employee orientation.
• General organisational procedures and policies, such as adequate use policies and
employee observe policies, should be administered and communicated at the HR level
of the enterprise.
• At the business unit level, responsibilities and issues that are distinct to role of an
employee or enterprise should be administrated and communicated.
• Interactive education techniques, like role-playing and online testing, are usually more
adequate than a cleanly informational approach.
• The information security manager should cooperate with business and HR departments
to recognise information security education requirements.
intent.
• For extended periods, well-developed policies in a mature enterprise can stay fairly
static.
• Policies must be lined up with and support the planned security objectives of the
enterprise.
• To modify or create standards and policies as required, one of the most essential
aspects of the action plan to implement the strategy.
• The road map must demonstrate the sequence and steps, milestones and
dependencies.
• To implement the strategy following the road map the action plan is essentially a project
plan.
• Each of the related 14 domains and major subsections must be the subject of one or
more policies, if the objective is ISO/IEC 27001:2013 compliance.
• This can be effectively accomplished with about two dozen particular policies for large
organisations in practice. The finished strategy gives the basis for modification or
creation of existing policies.
requirements of policy.
• Boundaries are set in terms of permitted limits on people, technologies and processes.
• Multiple standards will normally exist for each policy, relying on the classification level
or security domain.
• For example, the password standard would be more restraining when retrieving high-
security domains.
• Standards are extremely effective security management tools. They define the
permitted boundaries for technology and system procedures and practises, as well as
for people and events.
• They are the legislation to the policy constitution when properly applied. They serve as
a yardstick for policy compliance and a solid foundation for audits. Standards are the
primary tool for executing good security governance, and the information security
manager must own them.
• Additional standards and norms governing format, content, and mandatory approvals
must be established. Standards must be communicated to those who are regulated by
them as well as those who are affected by them.
• Processes for review and change must also be developed. Exception processes must
be designed for standards that are not easily achievable due to technological or other
constraints.
© 2022 The Knowledge Academy Ltd
Procedures
• Procedures fall under the purview of operations, including security operations, however
theknowledgeacademy
• Procedures must be clear and include all procedures required to complete certain jobs.
They must define the expected outcomes, displays, and prerequisite circumstances for
execution. Procedures must also include the procedures to take if unexpected findings
arise.
• Procedures and terminology must be precise and unambiguous. For example, the
phrases "must" and "shall" are used for any necessary task.
• The word "should" must be used to refer to a desired but not required action. The
words "may" or "can" must only be used to indicate completely discretionary action.
should include information that will be useful in carrying out procedures, such as policy
and standard clarification, dependencies, ideas and examples, narratives defining the
procedures, background information that may be valuable, and instruments that can be
employed.
• Guidelines can be beneficial in a variety of other situations, but they are discussed here
in the context of information security governance.
• It is usually a good idea to have an intranet or another mechanism to keep them so that
the proper audience may access them when needed.
goal to be measured.
• Technical metrics can be used to manage the tactical operational aspects of technical
security systems.
• They can show that the infrastructure is in good working order and that technical
vulnerabilities have been found and resolved.
• They provide few indicators of policy compliance or whether objectives for acceptable
levels of potential effect are being met, and they provide little information on whether
the information security program is on track and achieving the anticipated results.
goal of metrics, measures, and monitoring is to aid in decision making. The key to good
metrics is to employ a set of criteria to identify which of the virtually limitless number of
metrics candidates is the most appropriate. Good metrics include:
• The total security program's performance will be too far downstream to offer timely
information on implementation, thus another solution will be required.
• KGIs and KPIs can be used to offer information on the achievement of process or
service goals, as well as to identify whether organisational milestones and objectives
are accomplished.
• The litmus test is the ability to reverse-engineer a specific control to a specific business
requirement.
• Risk management is the main goal of all information security activities and
organisational assurance efforts. A successful risk management program is one that
meets expectations and achieves set objectives while keeping risk at levels acceptable
to management in an efficient, effective, and consistent manner. Indicators of effective
risk management may include:
• Information security resource management refers to the processes that are used to
organise, assign, and govern information security resources, such as people,
processes, and technology, in order to improve the efficiency and effectiveness of
business solutions. The following are some indicators of effective resource
management:
• To guarantee that organisational goals are met, information security processes must be
measured, monitored, and reported on. Effective performance measurement indicators
include:
• Metrics for information security programes that directly correspond to these control
objectives are critical for program management.
• That is, measurements that lack a reference point in the form of objectives or goals are
not metrics and are unlikely to be effective in program guiding.
• Metrics ultimately serve only one purpose: decision assistance. It measures to offer
information on which to build educated judgments on what it is attempting to achieve.
• The information required at the strategic level is primarily navigational in nature (i.e.,
determining whether the security program is headed in the right direction to achieve the
defined objectives leading to the desired outcomes).
• Both of the information security manager and senior management require this
information in order to provide adequate oversight.
• Management (or tactical) metrics are those required to run the security program, such
as policy and standard compliance, incident management and response effectiveness,
and personnel and resource utilisation.
• The most popular technical and procedural metrics are operational metrics, which
include open vulnerabilities and patch management status. Purely technical metrics are
particularly important for IT security managers and system administrators. There are
various other considerations for development, including:
They include many of the previous elements (such as policies, procedures, guidelines,
practises, and organisational structures) and are the primary elements to consider
when developing an information security program.
Controls are executed to attain specific goals, and they collaborate to enable
stakeholder goals through the strategic program plan.
Control objectives aid in the alignment and achievement of security and privacy goals.
controls should be based on several factors, including assuring their effectiveness, cost
or potential restriction of business activities, and optimal form of control.
IT Controls
As information and technology play such an important role in the operations of many
businesses, IT controls account for the majority of the controls they require. While
technical controls are included, many IT controls are both technical and administrative
in nature.
Non-IT Controls
The information security manager should be aware that information security controls for
non-IT-related information processes, such as secure marking, handling, and storage
requirements for physical information, and considerations for dealing with and
preventing social engineering, must also be developed. Environmental controls should
be considered so that otherwise secure systems are not simply stolen, as has
happened in some well-publicised cases. © 2022 The Knowledge Academy Ltd
Managing Risk Through Controls
Layered Defences
theknowledgeacademy
The layers should be designed in such a way that the failure of one layer does not
result in the failure of the next layer. The number of layers required will be determined
by asset sensitivity and criticality, defence reliability, and degree of exposure.
A human firewall, which can serve as an additional layer of defence, can be created
through education and awareness. Another defensive layer can be created by
segmenting the network.
Several security technologies have been developed over the last few decades to
address the ever-increasing threats to information resources.
The information security manager must understand how technologies can be used as
controls to achieve the desired level of security.
General, or common, controls are control activities that, as part of the security
infrastructure, support the entire enterprise in a centralised fashion.
Subordinate system-level activities can then inherit these general controls to achieve
control objectives.
This is due to the fact that control objectives are largely determined by management's
defined acceptable risk levels. The controls must be designed to achieve the objectives
of acceptable risk levels.
As a result, the control objectives serve as both the design objective and the
subsequent control metric for effectiveness.
Control objectives must be defined during program development and apply to physical,
administrative, and technical controls.
Control objectives necessitate the use of a variety of control types. A technical control,
such as a firewall, may necessitate a physical protection control, a configuration
procedural control, and administrative oversight.
use of technical and nontechnical methods. Technical controls are safeguards built into
computer hardware, software, or firmware.
Category Description
Managerial Controls pertaining to a process's oversight, reporting, procedures, and operations. Policies,
processes, balancing, employee development, and compliance reporting are examples of
these.
Technical Controls are provided by technology, a piece of equipment, or a device. Firewalls, network or
host-based intrusion detection systems, passwords, and antivirus software are some
examples. To function properly, a technical control requires proper managerial controls.
Physical Locks, fences, closed-circuit television (CCTV), and other devices installed to physically
restrict access to a facility or hardware. Physical controls necessitate maintenance,
monitoring, and the ability to assess and respond to an alert in the event of a problem.
Countermeasures are controls that are put in place in response to a known threat.
They can be preventive, investigative, or corrective in nature, or any combination of the
three. Nontechnical countermeasures can also be used, like offering a reward for
information leading to the arrest of hackers.
All efforts to protect information are built on a strong physical barrier that protects the
physical media on which the information is stored. Physical security is often provided
as part of facilities management in many businesses.
The physical security organisation may establish requirements building by building and
enforce those requirements through a combination of physical security technology and
manual procedures.
Physical and environmental controls are a subset of general controls that are used by
all computing facilities and personnel. Furthermore, some technologies include features
that enable physical mechanisms to override logical controls.
Consider operational authority and the types of controls available when determining the
types of control technologies that must be considered by the information security
manager.
As the majority of technical controls are under the direct control of the IT department, it
is necessary to consider how security will be maintained. IT and the security
department may share operational authority in some cases.
In terms of the types of controls available, technologies typically fall into one of three
categories:
1 2 3
Native Supplemental Support
Control Control Control
Technologies Technologies Technologies
The information security manager should assure that the technical security architecture
components are in sync with the enterprise's risk and threat postures as well as its
business requirements.
© 2022 The Knowledge Academy Ltd
theknowledgeacademy
The strategy's development includes determining acceptable risk and risk tolerance.
Control objectives, which define the main requirements for the controls, are determined
using acceptable risk levels.
Controls must also meet some or all of the criteria outlined in the preceding section.
Controls that affect all aspects of an enterprise, including people, technology, and
processes, are required for effective information security.
Access control, for example, is a preventive control that prevents unauthorised access
that could harm systems. Because it detects unauthorised access, intrusion detection
is a detective control.
Backup and restoration procedures are a corrective measure that allows a system to
be recovered if the damage is severe enough that data is lost or irreparably damaged,
resulting in impact.
The same firewall may have more advanced features, such as the ability to scan
inbound network traffic for malware and send alerts to an operations centre if
suspicious traffic passes through the device. This is a control for detectives.
The firewall may also include a feature that lets operations to redirect incoming traffic to
a backup site if it is discovered that a virus has reduced capacity at the primary site
after responding to the virus alert.
As a deterrent control against unauthorised access, the proxy service that runs on the
firewall may be capable of displaying a warning banner.
© 2022 The Knowledge Academy Ltd
Introduction
(Continued)
theknowledgeacademy
1 2 3 4
Access Principle of
(Logical) Secure Least Compartmentalising to
Control Failure Privilege Minimise Damage
5 6 7 8
Segregation of
Transparency Trust Zero Trust
Duties (Sod)
The information security manager should understand the enterprise's risk tolerance
and must consult industry and regional sources to establish a baseline set of security
functions that are appropriate for organisational policies and acceptable risk levels.
Based on vulnerability, threat, and risk analysis, additional controls may be warranted,
and these controls must be involved in the requirements-gathering process.
During the design and development phases, the information security team may be
consulted to assess how well solution options meet acceptable risk requirements.
There is almost never a perfect solution, and there will always be trade-offs between
security requirements, performance, costs, and other demands.
To ensure that coding practises and security logic are adequate, the information
security manager should use internal or external resources to review them during
development.
The goal, as with other elements of the security strategy and program, is to make sure
that the layers of controls implemented achieve the agreed-upon acceptable level of
risk, rather than to ensure that the controls completely eliminate any risk.
Throughout the operation of the security program, testing and evaluation of the various
management, technical, and physical controls will be ongoing, including system-
specific controls that will be continuously assessed throughout the system life cycle.
As changes arise to risk objectives, the threat landscape, and system operation
change, the evaluation procedure should evolve to assure that control objectives, such
as cost-effectiveness and mission alignment, are met.
and the quantitative and qualitative compliance testing results can be used to
determine control strength.
Yet, a careful examination of the procedure may reveal that there is no evidence of
review and that subsequent response actions, including resolution, cannot be
measured. The control fails in this scenario.
However, if handwritten notes with initials and dates are recorded within IDS log reports
on a daily basis, and if the same notes contain analysis, action plans, ticket numbers,
and resolution, then the manual control is far more effective than the automated one.
Of course, no final conclusion about the strength of the control can be reached until it
has been thoroughly tested.
© 2022 The Knowledge Academy Ltd
Control Strength
(Continued)
theknowledgeacademy
A control's strength can be measured in terms of its inherent (or design) strength and
likelihood of effectiveness. Balancing the books to account for all cash and dividing
accounting accountabilities within numerous employees are two examples of inherently
strong controls.
This assures that information security and IT governance initiatives are automatically
followed, and that cost justification for the treatment procedure is self-explanatory and
easily available.
Controls that could mitigate or eliminate the identified risk (as appropriate to the
enterprise's operations) to an acceptable level are provided during this step of the
process.
Control recommendations are the outcomes of the risk assessment and analysis
process, and they serve as input to the risk treatment process.
The recommended procedural and technical security controls are evaluated, prioritised,
and implemented during the risk treatment process.
To determine which are required and appropriate for a specific enterprise, a cost-
benefit analysis for the proposed controls should be performed to demonstrate that the
costs of implementing the controls can be justified by a reduction in the level of risk or
impact.
The control implementation process should seek input from the appropriate business
unit owner for effective results.
effect of controls or introduce new vulnerabilities that existing controls are not designed
to address.
Control testing is required in most publicly traded companies and must be executed as
a regular practise in all businesses to assure that procedural controls are carried out
consistently and effectively.
The information security manager must conduct an analysis of the proposed control
environment to determine if there are any new or recurring vulnerabilities in the design
and to assure that the control is designed properly.
• Employee awareness should begin when they join the company and continue on a
regular basis.
• All enterprise personnel and, when applicable, third-party users must get proper
training and regular updates on the importance of enterprise security policies,
standards, and procedures.
• The information security manager should adopt a rigorous approach to developing and
theknowledgeacademy
conducting the education and awareness programme, taking into account factors such
as:
employees and third-party partners, the security program should also include training
relevant to the duties of those in security-specific work tasks, including leadership
roles. Particular considerations include:
1. Executive, leader, and manager training to help them understand their roles in
defining risk expectations.
3. Physical security personnel training focuses on those who are responsible for
physical security, including environmental variables that support the confidentiality,
integrity, and availability of critical organisational assets.
assessing and tracking course delivery and results should be implemented. Consider
the following when conducting such tracking:
1 2 3
Automation
Coverage Grading and
Deployment
1. Service providers
2. Outsourced operations
3. Trading partners
4. Merged or acquired enterprises
• The capacity to manage security effectively in these partnerships is a big problem for
the information security manager.
• Concerns may also be raised about incident response, business continuity, and
catastrophe recovery capabilities.
Ensuring that suitable controls and processes are in place to support outsourcing.
Ensuring that proper information risk management terms are included in the
outsourcing contract.
Ensuring that a risk assessment is completed for the outsourced process.
Ensuring that enough due diligence is completed prior to contract signature.
Day-to-day management of information risk for outsourced services.
Ensuring that major changes to the relationship are identified and that updated risk
assessments are conducted as needed.
Ensuring that right procedures are followed when ending relationships.
• It is also likely that when the business grows, it may want more services, which may
necessitate substantially greater fees from the outsourcer.
• This could happen if the organisation determines that the constraints imposed by
outsourcing are unacceptable, or if the costs connected with a new arrangement are
prohibitively expensive. Other essential and potentially negative factors to consider
while examining outsourcing possibilities are:
security manager, such as external firms that may be hesitant to share technical
specifics on the nature and scope of their information protection measures.
• From the standpoint of risk management, it is critical that incident management and
response, business continuity planning/disaster recovery planning, and testing include
all critical outsourced services and operations.
• Key clauses that should be included in a third-party contract include, but are not limited
to:
aware of their responsibilities and rights within the relationship; and 2) to give a way to
resolve problems after the contract is in effect.
• The information security manager should be aware with specific security and
information protection provisions within that framework.
• The most prevalent type of security provision is one that addresses secrecy or
nondisclosure. The information security manager must identify the particular amount of
destruction required.
• The contract may also require either or both parties to maintain security procedures to
guarantee that the systems and information used in the agreement are adequately
protected.
• The contract should explain what is meant by "suitable," as well as the conditions for
demonstrating the effectiveness of those safeguards.
• Access should be granted using the least privilege, need-to-know, and need-to-do
criteria. Third-party access must be based on clearly defined means of access, access
permissions, and levels of functionality, and access must need the asset owner's
agreement.
• Access usage should be fully logged and examined on a regular basis by the security
manager. The frequency of reviews should be determined by considerations such as:
• It is also critical for the information security manager to reevaluate the program's
efficacy in light of changes in organisational demands, settings, and limits on a regular
basis.
• The findings of such an analysis should be shared with the information security
steering committee or other stakeholders for discussion and formulation of necessary
program improvements.
• While the information security manager must decide the most appropriate scope for
current state assessment, the following section offers many essential topics for
consideration.
• The information security manager must assess the program's documented security
objectives. Important considerations include:
Has an information security plan and roadmap for development been developed?
Have appropriate risk and impact criteria been established?
Are policies, standards, and processes complete and up to date?
Are program objectives in sync with governance objectives?
Are the objectives measurable, reasonable, and tied to specified deadlines?
Do the program objectives correspond to the organisation's goals, initiatives, compliance
requirements, and operational environment?
Is there agreement on program goals? Were goals developed collaboratively?
Have measures been implemented to track program performance and shortfalls?
Is there a regular assessment of objectives and accomplishments by management?
• Compliance criteria alignment and fulfilment are two of the most apparent indicators of
security management status. Because numerous standards specify
program management requirements, the information security manager must compare
the management program—framework and components—to mandatory and optional
compliance standards. Important considerations include:
Has management established the level of compliance that the organisation will pursue, as
well as the timetables and milestones?
Is close cooperation between the compliance and information security groups facilitated? Are
the requirements for information security compliance well defined?
Does the information security program incorporate compliance requirements precisely into its
policies, standards, procedures, operations, and success metrics?
Do the technical, operational, and management components of the program correspond to
the components required by regulatory standards?
• The level of management support and the overall depth of the existing program are
revealed by evaluating program management components. Consider the following
programme management components:
Is the program itself thoroughly documented? Have essential policies, standards, and
procedures been reduced to simple operational instructions and given to those responsible?
Do those in positions of responsibility understand their roles and responsibilities?
Are the duties and responsibilities of members of senior management, boards, and so on
defined? Do these organisations recognise and act on their responsibilities?
Are information security duties reflected in company managers' objectives and included in
their performance evaluations?
Have policies and standards been finalised, formally approved, and disseminated?
• The success with which the information security programme implements security
operational operations, both within the security organisation and in other organisational
units, must be evaluated by the information security manager. Among the most
important considerations are:
Are security requirements and processes addressed in security, technology, and business unit
standard operating procedures?
Do security-related SOPs mandate accountability, process transparency, and management
oversight?
Do security-related operations such as configuration management, access management,
security system maintenance, event analysis, and incident response have established SOPs?
Is a timetable of routinely conducted procedures (for example, technical configuration review)
in place? Is it possible to keep track of scheduled activities in the program?
Are there technological standards for configuring specific networks, systems, apps, and other
technology components for security?
Are there standards that address architectural security challenges like as topology,
communication protocols, and crucial system compartmentalisation?
Do high-level policies and requirements support and enforce standards? Are standards
developed in collaboration with technical, operations, and security personnel?
Are technical standards applied consistently? Do mechanisms exist to evaluate and report on
technical standard compliance on a regular basis? Is there a systematic method in place to
handle exceptions?
Are important controls continuously monitored? Do controls provide failure notifications?
© 2022 The Knowledge Academy Ltd
Program Management Evaluation
Resource Levels
theknowledgeacademy
• The information security manager must examine the program's financial, human, and
technical resources.
of controls that are established and executed to address or minimise threats, risks,
vulnerabilities, and impacts.
• The total quality management (TQM) system's concepts and procedures are well
suited to the unique reliance on effective, efficient management of a business process
such as information security.
strategy to analysing and evaluating the state of various parts of the program during its
creation and management.
• Using a consistent strategy will provide trend information over time and can act as a
metre for program improvements. This is possible through a security assessment
procedure similar to an audit. Security reviews, like regular auditing procedures, have:
• Auditors identify, examine, test, and assess the effectiveness of controls in the
professional field of information systems auditing.
• Work papers are documents that may or may not be presented with the final report.
• The information security manager must establish effective working relationships with
auditors, both internal and external. Internal and external auditing operations must be
included into the information security program.
• If issues are discovered during an audit, the information security manager should
collaborate with the auditors to determine the related risk, mitigating variables, and
acceptable control objectives.
• The findings of the audit give robust, impartial input for the steering committee and
management to utilise in evaluating the performance of the information security
program.
© 2022 The Knowledge Academy Ltd
Compliance Monitoring and Enforcement
• Compliance enforcement mechanisms must be considered throughout program
theknowledgeacademy
• Compliance enforcement refers to any activity inside the information security program
that is aimed to ensure compliance with the enterprise's security policies, standards,
and procedures.
• Enforcement processes should be created with the assumption that control activities
are in place to support control objectives.
• These procedures add another layer of control to guarantee that the procedures
defined by management are followed.
• Policies serve as the foundation for all accountability for security duties across the
company.
• It is the responsibility of the information security manager to guarantee that there are
no orphan systems or systems without policy compliance owners during the
assignment process.
• This is a technique for business units or departments to analyse a policy and decide
not to implement it based on a variety of considerations.
© 2022 The Knowledge Academy Ltd
Compliance Monitoring and Enforcement
Standards Compliance
theknowledgeacademy
• Standards define the possibilities for systems, processes, and behaviours that
nevertheless adhere to policy.
• Based on the criticality and sensitivity of the resources, the standards must be created
to ensure that all systems of the same type within the same security domain are
configured and operated in the same manner.
• Standards exceptions, like policy exceptions, must entail risk assessment and
acceptance by competent management. If exceptions must go through the change
management process (if one exists), analysing the risk of the change will be a standard
element of the procedure.
Compliance Enforcement
• Conformity enforcement is a continuous collection of activities aimed at bringing policy
and, by default, standards requirements that are not being met into compliance.
• Legal and internal audit divisions are frequently in charge of evaluating business plans
and operations, respectively.
• Another common approach for determining system vulnerabilities is the use of external
and internal scanning and penetration testing, albeit this will only reveal the efficacy of
one aspect of the whole program.
• Continuous DDS and firewall monitoring can provide real-time information on efforts to
penetrate perimeter defences. Training help desk staff to escalate suspicious reports
that could indicate a breach or an attack can act as an effective monitoring and early
warning system. © 2022 The Knowledge Academy Ltd
Monitoring Approaches
Determining Success of Information Security Investments
theknowledgeacademy
• Processes must be in place for the information security manager to determine the
overall efficacy of security investments and the extent to which objectives have been
met.
• The information security manager should confirm that KPIs are created and agreed
upon during the design and implementation of the security program, and that a method
to assess progress against those indicators is implemented.
• The information security manager should understand how to develop processes and
theknowledgeacademy
systems that allow the information security program's successes and shortfalls to be
assessed. Measuring success entails creating quantifiable objectives, recording the
most relevant metrics, and assessing results on a regular basis to identify areas of
success and improvement potential.
• The information security program must support the primary goals of the organisation.
The information security steering committee and executive management might assess
the following qualitative measures:
Were there organisational goals that were not fulfilled because information security
objectives were not met?
How strong is the agreement that programme objectives are full and suitable among
business units, upper management, and other information security stakeholders?
• Productivity is a measure of the amount of work produced per unit of resource. The
information security manager should establish regular targets for boosting the
program's productivity through specialised activities.
• This procedure starts with precise cost forecasting and budgeting. The success of this
operation is often determined by comparing budget utilisation to initial forecasts, which
can assist in identifying difficulties with security cost planning.
• The information security manager should create systems to monitor the continuous
cost-efficiency of security components, which is typically performed by tracking cost-
result ratios, in addition to budgeting effectiveness.
• By assessing the overall cost of producing a certain output, this approach creates cost-
efficiency goals for new technologies and improvement goals for existing technologies.
• Personnel actions, even in a well controlled technical setting, might pose hazards that
can only be managed via education and awareness.
• Employees are the most widely used for tracking organisational awareness. The
information security manager should collaborate with the human resources department
to develop metrics for measuring organisational awareness success.
• One of the most visible aspects of an information security programme is generally the
technical security architecture.
• The information security manager must develop quantitative metrics of the technical
control environment's efficacy.
• For reporting and analysis, technical security metrics can be classified by protected
resource and geographic location. The following are some examples of technical
security effectiveness metrics:
1. Network access control devices resist probe and attack attempts; qualify based on asset or
resource targeted, source geography, and attack kind.
2. Internal network probe and attack attempts identified by intrusion detection systems;
differentiate by internal versus external source, resource targeted, and attack type.
3. The number and type of real compromises; categorise by attack severity, attack type, effect
severity, and attack source
© 2022 The Knowledge Academy Ltd
Measuring Information Security Management Performance
program, regardless of its scope. In addition to countless other design issues, new or
updated controls necessitate ways for determining if they are performing as intended.
• Procedural and process controls are often just as important as operational controls,
although they are more complex to install. Monitoring the security of information
systems is an essential operational component of any information security program.
The following are some examples of commonly observed event types:
Domain 4
Incident Management
© 2022 The Knowledge Academy Ltd.
theknowledgeacademy
• The speed with which an enterprise can recognise, assess, respond to, and recover
from an event decreases the enterprise's effect and, ultimately, the incident's expenses.
• This usually leads to senior management realising that the organisation requires an
effective and quick method of responding to an issue.
• There are subtle distinctions and complexities between incident management and incident
response functions.
• The ability to give and ensure the start-to-finish management of an issue within the company
is referred to as incident management.
• This entails determining how tasks and processes interact with one another, how information
is transmitted (internally and externally), and what actions must be coordinated in order to
properly manage an incident.
• The processes, methods, and activities undertaken when responding to an incident are
referred to as incident response, and they focus on the detection, triage, containment,
eradication, and recovery steps taken to restart normal, planned operations.
• Incidents can arise from a variety of sources, including large-scale cyberattacks, losses
theknowledgeacademy
Enterprise Mission, Goals and Objectives: Is the strategy properly matched with
the organisation?
Service to be provided: What services are being committed to address the needs
of constituents?
(Continued)
theknowledgeacademy
Funding for Start-up Costs and ongoing Operations: How will this capability be
supported financially?
• Incident management encompasses all steps taken prior to, during, and after an
information security incident occurs.
(Continued)
theknowledgeacademy
• With the following goals in mind, incident management methods must be devised to
limit the effects of an incident and enable efficient and successful recovery:
• Provide an effective technique of dealing with the problem in order to minimise the impact
on the organisation.
• Maintain or restore enterprise service continuity in accordance with business continuity and
disaster recovery policies.
Triage: The steps performed to categorise, prioritise, and assign events and
incidents in order to maximise the usefulness of limited resources.
Analysis: The attempt to determine what happened, the impact and threat, the
harm that ensued, and the appropriate recovery or mitigation procedures.
• The recording is necessary in order to correctly document material, which may include
forensic data that can be utilised to pursue disciplinary or legal possibilities.
• Incident management comprises initial support operations that allow new occurrences
to be evaluated against known defects and difficulties in order to quickly identify any
previously identified workarounds.
• Throughout the incident's life cycle, the procedure guarantees that it is owned, tracked,
and monitored.
• Major occurrences may necessitate a response that goes above and beyond what is
given by the standard incident process, necessitating the activation of C/DR
capabilities.
• The final step in an incident-handling process is incident response, which includes the
planning, coordination, and execution of appropriate containment, eradication, and
recovery activities and may involve the development of recommendations or lead to
follow-on initiatives identified during the lessons learned.
• Some of the elements that increase the importance of excellent incident management
are as follows:
The enterprise can efficiently deal with unexpected threats to disrupt the business
(e.g., recovery time objective [RTO] and recovery point objective [RPO]).
The enterprise will have adequate detection and monitoring capabilities to ensure
that issues are identified as soon as possible.
The enterprise will have responsiveness that demonstrate a clear support for the
business plan by being sensitive to the criticality and sensitivity of the resources
safeguarded.
The enterprise will serve to proactively manage incident risk in a cost-effective manner,
as well as to provide integration of security-related organisational functions to maximise
effectiveness.
The enterprise will give monitoring and metrics to assess the performance of incident
management and response capabilities, and it will test its capabilities on a regular
basis to confirm that information and plans are up to date, current, and available when
needed.
internal and external resources. These resources in a typical enterprise may include,
but are not limited to, the following:
Facilities Insurance
Compliance Office HR Internal Audit
Management Provider
Sales and
Privacy Offer Public Relations Risk Management Training Partners
Marketing
response plan (IRP). It is critical to have a defined set of policies, standards, and
processes in order to:
Ensure that incident management actions are in line with the mission of the incident
management team (IMT).
Establish requirements for identified alternate personnel for all critical functions.
• This may entail relocating to a different location to resume activities as stated in the
BC/DR plans.
Handle events as they occur so that the exposure can be limited or eliminated,
allowing recovery to occur within recovery time goals (RTOs) and recovery point
objectives (RPOs).
Implement safeguards to protect and minimise the impact on assets in the case of an
incident.
enterprise's strategic plan. The following elements may assist in achieving this
alignment:
Constituency Organisational
Structure
Resources
Mission
Funding
Services
Management Support
response, including an incident response plan (IRP) that lays out the steps for
developing the incident response capability.
• Each enterprise requires a plan that addresses its specific needs, which are related to
the mission, size, structure, and operations of the enterprise.
• The strategy should specify the resources and management assistance that are
required. The following items should be included in the IRP:
1. Mission.
• The enterprise's size, industry, applicable regulatory requirements, and the maturity of BC,
DR, and incident response capabilities will all have an impact on the information security
manager's role in BC, DR planning, and incident response.
• In enterprises, the information security manager may be involved in all aspects of backup
and recovery (BC), disaster recovery (DR), and incident response.
• This includes helping the business units complete their business impact analyses (BIAs),
collaborating with the IT department to find suitable backup and recovery solutions,
coordinating incident response efforts as events become more serious, and providing the
regular information security services the business needs.
incident management also entails a number of procedures that can strike the ideal
balance between containment, prevention, and restoration.
• Effective triage capabilities in incident response guarantee that limited resources are
deployed most effectively to restrict and limit harm.
by CMU/SEI:
• Threats are defined as any incident that has the potential to harm an enterprise's
assets, operations, or staff. There are several threats to be considered, such as:
Vulnerability
• A vulnerability is a flaw in a system, technology, process, person, or control that can be
exploited and lead to compromise. Risk originates from a weakness that adversaries
can exploit. One part of risk management is managing vulnerabilities in order to keep
risk within acceptable boundaries set by the enterprise's risk appetite and tolerance
criteria.
management. The plan specifies the actions, personnel, and activities that will be
carried out if anticipated circumstances result in the loss of data, information systems,
or processes.
• The incident response team should be formed, managed, and maintained as part of the
plan.
• A gap analysis gives information on the gap between present incident response
capabilities and the target level defined by top management. When the two levels are
compared, advances in capabilities, skills, and technology can be found, including:
Processes that must be improved in order to become more efficient and effective
• The gap analysis report produced can be used for planning purposes to establish the
measures required to close the gaps between the present and intended states.
• It can also be used to determine the most effective technique for achieving the goals
and prioritising efforts. Priorities should be determined by the areas with the largest
potential impact and the best cost-benefit ratio.
duties. To put the business recovery strategies into action, key decision-making,
technical, and end-user team leaders must be identified and trained.
• Depending on the size of the business, the team could be made up of just one person.
The involvement of these teams is determined by the severity of the service disruption
and the sorts of assets lost, compromised, damaged, or endangered.
• This will make it easier to estimate the amount of the effort and activate the right team
combination. The following are some examples of the kind of teams that are frequently
required:
Emergency Action Team: First responders who have been designated to deal with
fires or other emergency response circumstances.
Damage Assessment Team: Qualified personnel who analyse the level of asset
damage and make an initial decision as to what is a total loss vs what is restorable or
salvageable.
Security Team: When the organisation does not define a designated/formal capacity,
the security team frequently becomes the de facto CSIRT. It is in charge of monitoring
the security of systems and communication links, containing any ongoing security
threats, fixing any security issues that limit the rapid recovery of systems, and assuring
the appropriate installation and operation of every security software package.
• Training the emergency response teams is not only necessary, but also important. To
theknowledgeacademy
ensure that team members are comfortable with their jobs and responsibilities, the
information security manager should create reasonable, real-world event scenarios and
test the reaction and recovery plans.
• The teams will determine the resources needed for reaction and recovery during this
phase. Training has the extra benefit of discovering and changing unclear procedures
to achieve clarity, as well as determining recovery resources that may be insufficient or
ineffective.
Application development
Business process owners
Cybersecurity
HR
IT department
Legal/general counsel
Network operations
Physical and information security
Privacy department
PR/corporate communications
Risk management
Senior management
Threat intelligence team
© 2022 The Knowledge Academy Ltd
Challenges in Developing an Incident Management Plan
enterprise.
• It identifies the lowest resources required to restore and prioritises the recovery of
processes and supporting systems.
• The BIA is frequently mentioned in the context of BC and DR. Other methodologies, in
addition to the BIA, may be used to assess possible impact.
• The bottom line of risk is impact, and the range of severity in terms of the enterprise
must be identified in order to offer the necessary information and lead risk
management actions.
• Although high likelihood events with little or no individual impact are not always cause
for concern, they should not be discounted without first comprehending the event's
significance within the wider system it supports.
consideration of the relationships between RTO, RPO, SDO, and MTO, as the
transition from incident response to disaster recovery operations for any solution other
than mirrored or duplicate processing sites will take time.
• With the continuing expansion and widespread acceptance of cloud services, there is a
shift away from perceiving IT as a facility and toward viewing IT as a capability.
• The incident management and recovery plan must be compatible with and support the
enterprise's overall IT plan.
Long-Haul
Alternative
Redundancy Diverse Routing Network
Routing
Diversity
• Plans should include operational failover solutions to avoid servers falling down for an
extended amount of time.
• Server recovery should be part of the DRP. The employment of universal power
supplies (UPSs) and failover systems to prevent power failures of varied levels is one
way for offering failover or fault-tolerant capabilities.
• Direct attached storage (DAS) is a data storage and availability solution in which the
storage device (for example, a disc drive) is physically connected to a server or client.
To access the DAS, each user must have direct access to the server that houses the
storage device.
• Current insurance policies for information systems processing typically require a multi-
peril policy tailored to provide several forms of IT coverage. Typically, an organisation
cannot insure against failure to comply with legal and regulatory requirements or any
other violation of the law. There are several types of coverage available, including:
• A disaster could be a regional event spread over a broad geographic region, or it could
happen within a single room boundaries.
• The effect of a disaster will also differ, from a full disruption to a mere slowdown in all
business activities.
Natural Disasters
Human-Caused Disasters
• When developing reaction and recovery plans, various factors must be considered,
theknowledgeacademy
including available resources, expected services, and the categories, types, and
intensity of threats encountered by the company.
• The state of monitoring and detection capabilities must be known, as well as the level
of risk that the enterprise is ready to take.
• An effective recovery plan strategy strikes the most cost-effective balance between risk
management, incident management and response, and BC/DR planning.
• This is done to determine whether it is safe to return and to run tests to determine
whether the primary data centre and facilities are accessible, operational, and capable
of operating at regular capacity and processing load.
• The teams in charge of shifting to the alternate location and making it operational
repeat the process to return to the primary site.
• When the primary facility and data processing capabilities have been fully restored, the
recovery teams will notify the BC leader, who will then declare normalcy in cooperation
with the crisis management team and shift operations back to the primary site.
• If the primary site is completely destroyed or severely damaged, the enterprise may
make a strategic decision to convert the alternative recovery site to the primary
operations site or to identify, acquire, and establish another site where operations will
eventually be restored and which will serve as the primary site.
• The overall cost of a recovery capacity includes the expense of preparing for potential
interruptions as well as the cost of implementing these in the event of an occurrence.
• The effects of disruptions can be mitigated to some extent by various types of business
interruption insurance, which should be regarded as a strategy alternative.
• Depending on the size and scale of the enterprise, as well as the state of recovery
planning, the information security manager should understand that developing an
incident management and response plan is likely to be a challenging and time-
consuming task.
• It may be necessary to develop numerous alternative strategies, each with its own set
of capabilities and costs, before presenting them to management for a final selection.
include:
severe outages occurring, the nature and amount of the impact on the enterprise's
capacity to continue operations, and total cost. Longer and more expensive outages or
calamities that disrupt the primary physical facility are likely to necessitate offsite
backup options. Offsite backup facilities that can be considered include:
Disaster
Reciprocal
Duplicate Sites Mirror Sites Recovery as a
Agreements
Service
recovery strategy:
Nature of the
Proximity
MTO Locations Probable
Factors
Disruptions
and recovery strategy decided by management. It should handle all aspects of disaster
recovery. Several elements should be addressed when constructing the plan, including:
• Pre-incident readiness
• Evacuation procedures
• How to claim a Disaster
• If the incident response fails, the procedures to disaster recovery are taken
• Recognise the business processes and IT resources that must be restored
• Individuals having decision-making authority and duties in the plan should be identified
• Identification of the persons (and alternatives) in charge of each plan function
• Identifying contact information
• A step-by-step breakdown of the recovery alternatives
• Identifying the various resources needed for recovery and ongoing activities
• Making certain that other logistics, such as worker transfer and temporary housing, are
taken into account
Incident Incident
Classification Categorisation
• A set of actions should be stated in the sequence to be executed for every believable
theknowledgeacademy
and actionable event. Every action specified should identify the person responsible,
alternatives in the event of unavailability, and an expected time for completion.
• When all of the activities have been successfully executed, the process should proceed
in the part devoted to the emergency's conclusion. The following entities and personnel
may receive an alert notification, but are not limited to:
• The information security manager should develop protocols for help/service desk
theknowledgeacademy
• The help/service desk is likely to receive the first reports indicating a security issue.
Prompt recognition of an ongoing event and prompt referral to appropriate parties are
crucial for limiting the damage caused by such incidents.
• Proper training also helps to lessen the likelihood that the help/service desk may be
successfully targeted in a social engineering attack aimed to get account access, such
as a perpetrator posing as a user who has been locked out and requires immediate
access to the system.
• It responds to and handles incidents in order to contain and reduce damage, limit
disruptions to business processes, and promptly restore operations.
• Incidents that are poorly managed have the potential to become disasters.
• Understanding the hierarchy and organisational structure associated with the various
incident management positions is critical.
• To avoid miscommunication during a crisis, each position must be clearly defined and
conveyed.
• The duties connected with incident management will differ from company to company.
• Typical responsibilities in incident management activities include, but are not limited to,
the following:
• A business case can demonstrate that, in many cases, effective event management
and response are less expensive than attempting to develop controls for all possible
conditions.
• Tested incident management and response may also provide the firm with more
revenue opportunities by allowing for higher levels of acceptable risk based on a shown
capacity and capability to handle security issues.
• These elements should be included in the business case, which will be utilised to
acquire the necessary senior management commitment to ensure the program's
success.
• The criteria used to measure the efficacy and efficiency of the incident management
function include incident management metrics, measures, and indicators.
• Metrics based on key performance indicators (KPIs) and programme goals (KGIs)
established for incident management should be submitted to top management as
rationale for ongoing support and funding.
• As part of the overall risk evaluation, the information security manager must
understand RTOs and how they apply to the enterprise's information resources.
• The RTO will be determined by the enterprise's business demands, which are typically
described as the amount of time required to restore an acceptable level of regular
operations. The SDO establishes the acceptable level.
• The information security manager should keep in mind that the RTO may change
depending on the month or year.
• Financial data may not be as important at the start of the month, when the new fiscal
month begins. RTOs are defined by doing a BIA in tandem with constructing a BCP.
• Because the interconnectivity of systems and their dependencies affects the order of
restoration, most or all systems associated to important business processes will require
a BIA.
© 2022 The Knowledge Academy Ltd
Incident Management Metrics and Indicators
(Continued)
theknowledgeacademy
• A divisional supervisor's essential information asset may not be critical in the eyes of
the vice president of operations, who is able to integrate the total organisational risk in
the RTO evaluation.
• The outcome will be incorporated into the BCP, as will the extent of the services to be
restored and the priority order for system recovery. In the end, top management makes
the final choice.
• Senior management is in the best position to arbitrate the needs and requirements of
the various aspects of the business, such as the regulatory requirements to which the
enterprise is subject, and to decide that what processes are the most crucial to the
business's continuing existence, in addition to determining acceptable costs.
• The enterprise can create and identify contingency strategies that will meet the RTOs
of the information resources, once the RTOs are known.
• System proprietors consistently favour shorter RTOs, but the tradeoffs in price may not
be certified.
• If the RTO for a given resource is longer, then the cost of recovery is less in general.
• In case of operation disruption, the RPO is determined based on the acceptable data
loss.
• It demonstrates the most current point in period to which it is sufficient to recover the
data, that is generally the latest backup. In case of interruption, RPO effectively
quantifies the allowable amount of data loss.
• It may be preferable to decrease the time between backups to stop a problem where
recovery becomes impossible because of the volume of data to be recovered,
depending on the volume of data.
• Additionally, it is likely that the time needed to restore a significant amount of data
prevents the RTO from being achieved.
• While this is generally the scope of DR and BC planning, it is an essential factor when
creating a risk management strategy.
© 2022 The Knowledge Academy Ltd
Incident Management Metrics and Indicators
Service Delivery Objectives
theknowledgeacademy
• To meet business requirements until normal operations can be resumed, SDOs are
defined as the minimum level of service that must be restored after an event.
• By RPOs and RTOs, SDOs will be affected and must be examined in any risk
management strategy and execution. More levels of service will typically need greater
resources and more current RPOs.
• The factors may affect the MTO, such as accessibility of a recovery site which might
located remotely, limited operational capacity of the recovery site, and availability of
fuel to use emergency generators.
• The RTO will be affected by the variable, that in turn affects the RPO. To minimise risk
of inadequate recovery to the enterprise, the relationship between the MTO, RPO, and
RTO must be considered from a risk management perspective.
• To minimise the risk to the enterprise in the event of a disaster, the MTO should in any
event be as long as the AIW.
• CPIs and 'KGIs for the action should be specified and decided on by stakeholders and
approved by senior management.
• The standard range of KGIs contains the successful handling of circumstances whether
by live testing or beneath existing conditions.
• Considering the recovery and response plan necessities in the change management
process within an enterprise is an important part of adequate response management.
• Along with others not listed, the following factors may affect neccessities and the
requirement for the plan to be updated:
A method that is suitable at one point in period may not be sufficient as the
requirements of an enterprise modification.
• All aspects of the MP should be tested regularly in order to confirm success in incident
response.
1. Identifying gaps
2. Verifying assumptions
3. Testing timelines
• The full scope of incident management responsibilities, including the escalation and the
involvement of, or handover to, the disaster management and recovery operation if it is
the duty of another group, must be tested up to the point of a disaster declaration,
regardless of the structure.
• Periodic testing of the response and recovery plans should be carried out by the
information security manager with help from the recovery team's structure.
• Testing response and recovery plans must contain both critical and infrastructure
theknowledgeacademy
• With securing the systems not only during normal operations but also during disaster
events, the information security manager is tasked with enterprises depending heavily
on IT.
• The information manager can recognise important applications the enterprise needs
and the infrastructure needed to support them, based on the business impact
information and risk assessment.
• The information security manager needs to conduct accurate recovery tests for
ensuring that these are recovered in a timely fashion.
• A recovery test should seek to, at a minimal, achieve the given tasks:
• Confirm the entirety and precision of the response and recovery plan.
• Consider the performance of the personnel included in the practice.
• Evaluate the ascertained level of training and awareness of people who are not part of the
recovery/response team.
• Consider the coordination between the team members and external suppliers and
vendors.
• Count the capacity and ability of the backup site to conduct defined processing.
• Evaluate the critical records recovery capability.
• Consider the quantity and state of equipment and supplies that have been reposition to
the recovery site.
• Count the general implementation of operational and information systems processing
activities connected to maintaining the business entity.
• The following general types of metrics typically apply, although specific measurements
depend on the test and the enterprise:
Percentage or
Time Amount Accuracy Plans
Number
has urged the growth of automated incident management systems in past years.
• Many manual processes are automated by these systems that provide filtered
information that can recognise potential technical incidents and alert the IMT. An
effective SIEM will be able to do the following:
• EDR focuses on recognising threats, malware which are designed to avoid traditional
security defences while trying to be predictive in nature.
• Some king cyberthreat intelligence with machine learning abilities in conjunction with
threat detection and file analysis will leverage by most EDR solutions.
• EDR solutions generally make a historical audit path in which user /system manners
and security events are captured for follow-on examination by security analysts.
• EDR solutions also support in root cause analysis and not only in incident response
efforts.
• A developed version of EDR, XDR takes a holistic strategy to endpoint response and
detection.
• XDR not only gives an enterprise information security teams a suitable view across the
endpoints but also conducts examination of servers, the networks and cloud.
• XDR creates on the abilities of EDR, machine learning, artificial intelligence capabilities
and leveraging automation to give context about security events.
1 2 4
Security
Security Vulnerabilitie
Principles s/Weaknesses The Internet
5 6 7
Programming
Operating Systems Malicious Code Skills
• Team members may be recognised ad hoc, reliable full-time IMT support or committed
currently during incidents.
• The arrangement of team members set and how they will support the IMT will differ
from enterprise to enterprise.
• The team is usually lead by the information security manager. In bigger enterprises, it
may be more adequate to employ a particular IRT leader manager that concentrates on
answering to incidents.
• The SSG also authorises exceptions and deviations to normal practice. The primary
tasks in the IMT/IRT are performed by dedicated team members.
the proper measures to restrict the damage to the enterprise and recover normal
services. Usually, the team will cooperate with general users, complementary groups,
and business managers.
• The Following are the IRT Models that have proven to work:
1. Central IRT
2. Distributed IRT
3. Coordinating IRT
4. Outsourced IRT
Information Security Manager IMT leader and main interface to 1. Maintains and develops response capability and
SSG incident management.
2. Manages incidents and risks effectively.
Incident Response Manager Incident response team leader 1. Supervision of incident response tasks.
2. To effectively perform incident response tasks,
coordinates resources.
3. Represents incident lesson learned and response
plan to SSG members.
IT Security Specialist IRT/IMT team member, IT security 1. As a part of the IRP, performs in-depth and
subject matter expert complex IT security-related tasks.
2. Performs IT security audits/assessment as a part
of vulnerability management and proactive
measure.
IT Representatives/Specialists IT services subject matter expert 1. Give support to IRT/IMT while solving an incident.
2. Keep information system in a good condition per
company good practices and policies.
Human Resources (HR) HR area subject matter expert 1. When there is a need to investigate an employee
suspected of causing an incident, provides help in
incident response/management .
2. Integration of HR policy to support incident
response/management
Ability to Follow
Communication Leadership Skills Presentation Skills Procedures and Team Skills
Policies
Self- Time
Integrity Coping with Stress Problem Solving
Understanding Management
of most people, end users are the foremost line of protection in controlling safety
breaches.
• Within the enterprise, internal audits are performed by specialists and are generally
intended to improve risk and incident management and support compliance
requirements.
• External audits include a third party that conducts the tasks. While most external audits
are employed as part of required conditions, they are normally exploit as part of
business association.
• Both types of audits can be suitable in studying incident management and response
capabilities and plans.
• Periodic audits of the procedures and processes determined in the methods can give
validation that security will not be compromised in policy compliance, legal
requirements and the event of an incident are addressed properly.
• These enterprises might not have the internal resources to offer the requisite IMT/IRT
expertise in a sufficient manner. If incident management is outsourced to the same
vendor as IT operations, businesses who outsource their IT operations may profit from
close integration.
Comparing the enterprise's incident reference numbers with the agents for every
relevant incident.
Integration of the change management functions of the enterprise with the vendor’s.
Need from the vendor for regular review of incidents that happens on a regular basis
• These all are events that have shortage on any context that happen little to no
reference.
• Proper actions can be taken once legitimacy of and event is known. The escalation and
initiation of an event to an incident is performed by the prmary investigation and then
assessing the affect to the enterprise.
• It is also reasonable to assume that the event management and response teams will
face more turmoil, confusion, and issues the more serious the incident.
• An attack that takes down IT systems or a building collapse are both examples of
incidents.
• All reasonably possible events must be expected, planned for, and tested in order to
give a reasonable confidence that the enterprise will be preserved under predicable
conditions.
• In the overall process of carrying out the reaction and recovery plans, developing
appropriate response and recovery methods and alternatives is a crucial step.
• It is crucial to test the plans to make sure they can be carried out as needed.
• Containment is a tactical and short-term action that is intended purely to prevent the
bleeding, not necessarily to recognise or rectify the root cause that permitted the
incident to happen.
• There will be various communication methods and channels that ought to be defined
primary to an incident being announced.
• The IRP should contain a directory of main IRT members, end users, information
systems owners, decision-making personnel, and others mandated to create and bring
response measures.
• Telecommunication networks are liable to the same raw disasters as data bases but
are also weak to disruptive events distinctive to telecommunications.
• Wide area networks, LANs, third-party providers, and telephone voice circuits are
included in telecommunications capabilities.
• Essential capability needs should be recognised for the diverse thresholds of outage,
such as 2 hours, 8 hours or 24 hours, for every telecommunications ability.
• Continuous power supplies (UPSs) should be acceptable to give backup for both
computer and telecommunications equipment.
© 2022 The Knowledge Academy Ltd
theknowledgeacademy
• The focus changes to confirming that the business can successfully return to
operations after the incident has been properly addressed and root cause problems
remediated, that means restoring affected systems to normal. To prevent same events
from happening, the activities should be implemented and planned during the recovery
phase.
• Typical recovery activities conducted after a security incident has been successfully
eliminated contains the following:
procedures allows the information security manager to improve the security programme
on a continuous basis.
• The most valuable part of the effort is the follow-up process in incident response. After
the business has successfully retrieved, activities may contain, but are not limited to,
the given:
• Incident documenting
• Stakeholder feedback and review
• Completing the report for senior management
• Recognising changes required
• Recognising process issues
• Updating procedures as required
externally initiated attacks in security controls that have been executed. An incident
review team should be appointed by the information security manager for a systematic
review of security incidents.
• The root causes of numerous system centres, such as, are nonexistent or weak
vulnerability assessment and patch management efforts.
Who is included?
What was occurred?
Location of the attack originated
Reason of the attack
What was the time frame?
How did the attack happened?
What was the attacker’s motivation?
record of events during and after any actual or potential security incident.
• This information will allow the investigation of events and can be given to a forensics
team or authorities if required.
• To make sure that this record-keeping happens, one or more people must be
specifically charged with incident documentation and evidence preservation.
• Documentation of any event with potential security implications can give clarity on
whether an incident was an accident, a mistake, or a deliberate attack.
efficient reaction to a security incident and the unavoidable wave of regulatory and
legal landmines.
• A customised to the enterprise and has been vetted, tested and developed by key
internal stakeholders and legal counsel is a suitable IRP.
• The check-the-box strategy is not helpful while it may be easy to pull a standards IRP
form from the intermit when an incident actually happens. The IRP should:
Give a method for documenting the events directing to and pursuing the discovery of
a compromise.
• This strategy is mainly recommended for law enforcement relying on the risk of the
evidence being compromised.
• This can happen as a consequence of the system exchange files overwriting evidence,
malware or an intruder removing evidence of compromise. There is the risk of tainting
evidence.
• Sudden power loss and data in memory loss may result in corruption of critical
information on the hard disk as it is one argument against disconnecting power.
Chain of custody.
Checklists to obtain technicians.
Exact activity log templates for obtaining technicians.
An updated case log.
Signed confidentiality/nondisclosure forms for all technicians concerned in retrieving
evidence.
Investigation template of report.
www.theknowledgeacademy.com/tickets
https://uk.trustpilot.com/review/theknowledgeacademy.com
theknowledgeacademy