Information Technology Security (ITS)/Cyber Security (CS) – Responsibilities, Knowledge Base, Policy, Procedures and Working Orders – A broad interpretation

This post is written in English in purpose. I wish to share the experience I gained in over 30 years of dealing with this subject with as much audience as possible. For this purpose, the English language is better than Hebrew. (The Hebrew version was posted some hours ago).

1.    Definitions + Interpretations:

1.1.      Information Technology Security / Cyber Security(Hereafter: ITS/CS)

1.1.1.     The overall means planned and implemented in the physical, computational (some call it logical as opposed to physical), procedural and  human fields of activities, to achieve and preserve Confidentiality, Integrity, Availability and Survivability for Information, Information Technology systems, and  other technological systems.

1.2.      Knowledge Base

1.2.1.       A collection of documents.

1.2.2.      Includes all the knowledge needed to perform all the ITS/CS activities. (you may call it the "Bible of ITS/CS). See more on "knowledge base" in chapter 3 of this document.

1.3.      Policy

1.3.1.      A written document.

1.3.2.      Signed by top management/board of directors of an organization.

1.3.3.      Demonstrates and clarifies their position on a specific topic.

1.3.4.      Includes the guiding principles on that topic for the organization, while at the same time expresses their (of the signing body) own obligation to the policy.

1.3.5.      The content depends on several variables.

1.3.6.      Responsibility for writing the document:

1.3.6.1.     ITS/(CS) Director/Manager. But is there such a manager in the organization? Commonly NOT. So the one who is responsible will be the Chief Information Security Officer (CISO or as he is commonly referred to as the "Information Security manager") who will have a double role:

A.     Writing the different chapters of the document:

1.  Writing his part. (What is it? Look at his role description and you'll quickly find out. In Israel, in the Finance sector for example his responsibility is generally confined to preserving the "C" – Confidentiality part of the triangle C-I-A).

2.  See to it that every manager in the organization having responsibility for part/parts of the ITS/CS writes his part.

B.    Integrating all the chapters to ONE INTEGRATED DOCUMENT bearing the title: "The {organization name} ITS/CS POLICY.

Why is it his task? Because he is the secretary of the ITS/CS steering committee and why is he? Because more than half of the ITS/CS tasks are concentrated around him or directly/indirectly guided or performed by him.

If there is ONE person to name, he is the one.

1.4.      Procedure

1.4.1.      A written document.

1.4.2.      Contains clear guidance how to perform a specific task mentioned in a policy.

1.4.3.      Is directed towards an identified specific audience. To make it clear, a procedure IS NOT a full description of a task performed by many units in the organization, this would be the workflow document for that task not the procedure document.

1.4.4.      Responsibility for writing the document

1.4.4.1.     The organizational department that owns the task.

1.4.4.2.     Some organizations designated an organizational department with the task of writing all the procedures for the organization. In this case, the department that owns the task is responsible to deliver the content of the procedure the department responsible to write the procedures. This department will perform the technical writing of the procedure by following the standards of the organization BUT preserve the original ownership of the department that owns the task.

1.5.      Work Order

1.5.1.      A written document.

1.5.2.      Contains detailed instructions (sometimes highly technical/step-by-step) how to perform a specific task.

1.5.3.      Responsibility for writing the document: the unit responsible to perform the task.

1.6.      Steering Committee for ITS/CS

1.6.1.      A group of top managers appointed by the CEO or one of his deputies to oversee/navigate/control the entire ITS/CS activities in the organization.

1.6.2.      Usually, the members of the steering committee represent the different organizational units responsible for the different parts of the ITS/CS. (e.g.: IT, Physical security, procurement, manpower, legal, business units and so on).

1.6.3.      The chairperson of the committee will be the CEO or one of the top managers.

1.6.4.      The secretary of the committee should be the manager responsible for ITS/CS. When such a manager does not exist in the organization (generally this is the case), the Information Security manager (CISO) should be appointed as the secretary.

1.6.5.      Meeting periodically (2-6 times a year). Optionally, the chairperson has the authority to summon additional meeting if necessary.

1.6.6.      The committee's authority includes (inter alia) inviting to its sessions other representatives from the organization or outside the organization as relevant to the subject under discussion.

2.    Responsibilities for ITS/CS

2.1.      Following the definitions above, it seems NO ONE MANAGER in an organization has the ability to act as the solely responsible manager for the overall ITS/CS activities in an organization.

2.2.      Some examples to clarify the somewhat overwhelming above statement:

2.2.1.      Manpower department is responsible for managing the lifecycle of the manpower in the organization. Part of this responsibility might be the performance of screening the candidates. One of the screening parameters should be integrity/reliability of the candidate. So it might be that the manpower department should get some input from the Information Security manager or the physical security manager or from both of them what to look for during the  integrity/reliability screening process. Take for example the case of a candidate for the role of a Information Technology System Administrator. Isn't this a highly sensitive role that requires a thorough background checks and a variety of reliability tests before deciding to hire him/her? The same goes for sensitive roles in various business departments. Take the role of the treasurer for example. What about temporarily freezing of permissions for employees taking a long vacation or deleting the permissions totally when terminating the job for good? All those activities start at the manpower department as they are responsible for the manpower lifecycle in the organization. They are also responsible to define (together with the business units) what roles exist in the organization. These roles are the foundations for permissions in the organization. And what about disciplinary actions that should be planned, made public to the employees and activated against employees violating ITS/CS policy/procedures/work orders? This too falls under the umbrella of the manpower department responsibilities.

2.2.2.      Procurement department handles all the procurement in the organization. Some of it may be Information Technology, or any procurement process that its result may be a change in the current ITS/CS level. For example: buying new smartphones for top management that will contain organizational information of some sort.

2.2.3.      Physical security department is responsible for securing people, property and information by handling the physical side of the security process. One example might be means to secure laptops while being moved outside the organizational premises. Physical security in that case might cover guidelines for how to carry the laptop, how to handle it in the private car, in public transportation, in the airport, during fight and so on. To complete the picture in this one simple example, the Information Security department will cover how to protect the data stored in the laptop (by encryption for example).

2.2.4.      Business units are the reason why an organization exists at all. A business unit is responsible for one or more organizational processes. The meaning of this responsibility should be accountability for all the aspects of the process. One of them should be managing the risks accompanied with the process. Those risks may include breach of confidential data, unreliable or incomplete data that is part of the process and therefor having to repeat the process (if the process is repeatable at all), inability to perform the process at the agreed upon SLA (Service Level Agreement). As organizations are grouped in sectors (Health, Finance, Education etc.) and therefore differ in business units I shall try to give an example that fits almost all of the organizations. The example will be the marketing department. This department is responsible for the marketing process. Today, an Internet site of an organization is a common marketing tool. Now what about the risks? It's marketing information open to all. Who bothers? Nothing confidential there. Correct. BUT what about the INTEGRITY/COMPLETENESS of the information showed to the public? Oh yeh. This is important. And what about the AVAILABILITY of the Internet site? Oh Yeh, this is important too. Have heard about Defacement? DDOS (Distributed Denial Of Service) attacks? OPISRAEL and others? No marketing manager likes the phone call from his CEO telling him the Internet site has been corrupted (defaced) by some hackers and therefore must be taken offline. Having the right measures in place against the RELEVANT threats/risks  for a process, is a result of performing risk management for that process. This risk management is the responsibility of the PROCESS OWNER. 

As more and more organizational processes become technological dependent, the owners must have the ability to take the responsibility of managing also the technological threats/risks accompanied with the process they are responsible of.

2.3.      As mentioned, the above are examples for the huge organizational task to achieve and sustain ITS/CS. I hope that at this point it is already clear that this task is an organizational task overseen/navigated/controlled by the ITS/CS steering committee, with more than one department having different responsibilities in this task. The responsibilities correspond/relate to those departments' natural responsibilities in the organization.

2.4.      Let us assume that the abovementioned conclusion is the reality. The question now to be answered is what are the building blocks? How will everyone in the organizational puzzle know what to do? The answer lies in the methodology of writing and publishing the organizational formal documents of POLICY, PROCEDURES and WORKING ORDERS. This is the next Chapter in the document.    

3.    Conveying the ITS/CS knowledge in an organization

3.1.      The name of the chapter – an explanation

3.1.1.      Why is the name of the chapter "conveying the knowledge…" and not "writing the documents"?

3.1.2.      The answer is that before writing how the organization should act upon ITS/CS, the organization has to adopt the knowledge base for ITS/CS.

3.1.3.      This knowledge base can be one of the following:

3.1.3.1.     A knowledge base prepared by a competent authority for that purpose and for this organization. In this case, it is common that the organization MUST adopt this knowledge base as this could be  part of a national law. In this case arises another question to answer: how complete is this forced knowledge base vis-à-vis the organizational task of ITS/CS? From my experience, it is generally incomplete. If so, it remains an organizational task to extend/complete the knowledge base at least to an acceptable degree for the organization.  

3.1.3.2.     A widely accepted knowledge base such as an International Standard or a group of internationally accepted standards prepared by an authorized standards institute or institutes. An example can be the ISO 27002 for organizations with common/conventional IT systems or in another example the combination of ISO 27002, ISO 27799 and a knowledge base for ITS/CS specified for medical devices for a Health Delivery Organization.

3.1.3.3.     A knowledge base prepared specifically for the organization by outside or inside professionals.

3.1.3.4.     Any combination of the above.

3.1.4.      In any case, and whatsoever knowledge base the organization chooses to adopt or is forced to adopt, the starting point is a knowledge base. NOT writing a POLICY.

3.2.      Following, the details about the documents. Trying not to repeat what I already wrote in the 1^st chapter (Definitions + Interpretations).

3.3.      ITS/CS policy

3.3.1.      Should cover in "policy statements" all the aspects of ITS/CS the organizations thinks it must include. Keep in mind that formally, omitting something from the policy document prohibits writing a procedure for it. Lack of a procedure may cause that something that should have been performed might be neglected.

3.3.2.      Should be a double purpose document:

A.   For inner (organizational) use: Serves as the base for all the ITS/CS activities in the organization.

B.   For outside use: should serve as the base for testing if the organization can possibly achieve ITS/CS.

3.3.3.      When Writing a policy, four major elements have to be counted for:

1.     The knowledge base for ITS/CS adopted by the organization.

2.     The independence of the organization (e.g. if there exist/doesn't exist any legal or other binding restrictions) in addition to the knowledge base.

3.     What would be considered absolutely required to be included?

4.     What are the unique requirements (e.g. the "finger prints" of this specific organization) to be included. In other words, what are the real differences between this organizations' policy from others in the same sector.

3.3.4.       A typical ITS/CS policy document should contain the following paragraphs:

3.3.4.1.     1^st Chapter: Definitions,

3.3.4.2.     2^nd Chapter: General description of the organization including its main area of business & IT/Cyber components,

3.3.4.3.     3^rd Chapter: The objectives of the POLICY document (it differs from the objectives of implementing the policy document),

3.3.4.4.     4^th Chapter: Main threats & risks to Information, Information Technology systems and other Technological systems in the organization (why ITS/CS is needed),

3.3.4.5.     5^th Chapter: Managing the risks of using Information, Information Technology systems and other Technological systems in the organization (ITS/CS knowledge base highlights – mainly a very short explanation what is ITS/CS?),

3.3.4.6.     6^th Chapter: The objectives of implementing this policy,

3.3.4.7.     7^th Chapter: Applicability. To whom the policy is applicable.

3.3.4.8.    8^th Chapter: ITS/CS Authorities & Responsibilities in the organization (e.g. CISO, steering committee, responsibilities of various departments in the organization in achieving ITS/CS  posture),

3.3.4.9.     9^th Chapter: Organizational specific highlights – principles for implementing ITS/CS in the organization. For example:

1.    Information classification,

2.    Personal responsibility for ITS/CS,

3.    Handling the human factor (inner & outside),

4.    Identification & Authentication to the IT systems/other technological systems,

5.    Separation of duties & compartmentalization,

6.    Remote access to information, Information technology systems and other technologies owned/operated  by the organization,

7.    Security (Physical, computational, procedural and human) requirements imposed on outside elements (Outsourcing, suppliers, vendors, etc.)

8.    Integrating security requirements during the processes of: procurement, development, change & upgrades of systems,

9.    Auditing,

10. Technical controls,

11. Physical security controls (ITS/CS starts with physical security),

12. Safety measures in the main computing plant,

13. Business Continuity Planning    

3.3.4.10.  10^th Chapter: Deviation from the policy document

3.3.4.11.  11^th Chapter: Updating the policy document

3.4.      Procedures

3.4.1.      The name of the chapter – an explanation

3.4.1.1.     Why is the name of the chapter "Procedures" and not "ITS/CS procedures"?

3.4.1.2.     The answer is the heart of the matter I wish to clarify. As defined in the 1^st chapter, a procedure is written by the owner of the process. As explained before, only part of the ITS/CS activities can hold the title an "ITS/CS process". An example can be planning and managing ITS/CS surveys and penetration tests. Many other activities that contribute to achieve ITS/CS goals are performed or better said should be integrated into processes performed by a variety of departments in the organization. Procedures that are written by different organizational departments, describing their activities while integrating their ITS/CS requirements, are NOT ITS/CS procedures. They are procedures written and performed by those departments according to their roles in the organization. And what about ITS/CS? This will be explained in this chapter.

3.4.1.3.     From here on I make no difference between a procedure and a working order. It is left to the reader or the implementer to make the distinction when it is needed to have both (meaning having a procedure and a working order having the same title) and when one of them will be enough.

3.4.1.4.     I'll have a separate chapter explaining the unique situation when an organization or a department is ISO 9001 certified.

3.4.2.      ITS/CS procedures

3.4.2.1.     Identify the real activities that can be labeled "ITS/CS processes". I already gave the example of ITS/CS surveys and penetration testing. Another example can be planning the annual work plan of ITS/CS, and so on.

3.4.2.2.    For each Identified ITS/CS activity, a procedure should be written.

3.4.2.3.     Who does it? As I mentioned before, generally this is the CISO. He is the one person in the organization that his job description is centered around ITS/CS activities. BUT he is not the only one in the organization to have ITS/CS duties to fulfill. What about the others? The CISO is a central figure in their ability to know what to do, BUT he is NOT the owner of their processes and therefore is NOT writing their procedures NOR is he writing procedures for them or instead of them. What he does do is to guide them. About ITS/CS guidance in the next sub chapter.

3.4.2.4.    How to write a Procedure? Doesn't have to be an ITS/CS procedure. The following guidance is relevant for all kinds of procedures.

1.    Write all procedures in the organization using ONE format. The content must vary of course, but the structure (the chapters' names) should be identical throughout the organization. That's the best way to ensure simplicity in writing, reading, understanding and implementing. As the saying goes: Keep It Simple.

2.    An example for an organizational format for procedure's chapters structure & content implementing the above advice:

A.   1^st Chapter: GENERAL – explains the reason/s what is the need to write this procedure.

B.   2^nd Chapter – OBJECTIVE/S – What is the objective or what are the objectives to achieve in the activity or activities described in the procedure.

C.   3^rd Chapter – DEFINITIONS – defining terms needed for understanding the procedure. (Optional. The meaning is that the 3^rd Chapter will always be DEFINITIONS, but if there are terms to define, next to the chapter's heading the word ":NONE" will appear).

D.   4^th Chapter – RESPONSIBILITY – who is responsible for writing/updating the procedure.

E.   5^th Chapter -   APPLICABILITY – to whom in the organization the procedure applies.

F.    6^th Chapter - METHOD – this is the main body of the procedure. This chapter describes as clearly as possible the activity/activities that have be done by those that are mentioned in the 5^th chapter. (see above).

G.   7^th Chapter – Annexes: forms, guidance and other documents that the procedure's writer thinks are of relevance to this procedure.

3.4.3.      ITS/CS guidelines/requirements

3.4.3.1.     An assumption: The CISO is the key figure in the ITS/CS activities in the organization. What does this mean?

The practical meaning is that he has to write guidelines to other departments in the organization. I use the word: "guidelines", because I think this is the right word, BUT those guidelines are actually ITS/CS requirements.  

What is the content of those guidelines? What is their purpose?

3.4.3.2.     ITS/CS guidelines – content:

A.   An extraction from the knowledge base.

B.   For each department, the relevant information should be extracted.

3.4.3.3.     ITS/CS guidelines – purpose:

A.   Each department according to its natural role in the organization should integrate their ITS/CS guidelines into its procedures.

3.4.3.4.     ITS/CS guidelines – results (overall):

A.   Procedures/working orders for all the departments include the ITS/CS guidelines extracted from the adopted organizational knowledge base.

B.   ITS/CS activities are integrated into the processes of all the departments in the organization.

3.4.3.5.     There might be left some special guidelines that are directed towards the entire organization. If it is possible I suggest/prefer to integrate those guidelines whenever possible in other departments guidelines and NOT leave them as ITS/CS singular/special guidelines. The best example would be ITS/CS guidelines for the IT end users. ITS/CS guidelines for end users should be integrated into the overall guidelines to the employees that are published by the man power department. This is the "main rout" the organization chooses to convey to the employees their rights and duties. Why not use it to convey their ITS/CS duties? They are different from other duties? Well NOT. This is my message, they are just part of being employed by the organization, not more but NOT LESS.

3.4.3.6.     Enforcement the implementation of ITS/CS guidelines throughout the organizational departments:

A.   Why should any department integrate those guidelines? Who the hell is the CISO to guide all the organization? From where does the CISO draw his authority to guide?

B.   Two simple answers:

1.     From the ITS/CS POLICY document. The policy document should include the CISO's authority to guide the organization.

2.      The ITS/CS steering committee.

C.   It is recommended that the yearly audit plan of the internal auditor of the organization, should permanently include auditing the integration & implementation of ITS/CS guidelines as performed by a sample of organizational units.

D.   If any department is ISO 9001 certified (Quality management), then the ITS/CS processes enforcement might be easier as there should be in place inherent processes such as the Internal Quality Audits, Management reviews, corrective actions and more. The interrelation/interaction of ITS/CS and Quality Management as followed after the ISO 9001 family of standards deserve a broader treatment than just a marginal reference as above. It will done later on.

4.    Two examples:

4.1.      The topic: HARDENING OF IT COMPONENTS

4.1.1.      Professional Knowledge Base

4.1.1.1.     Hardening documents.

4.1.2.      POLICY

4.1.2.1.     In the organization's ITS/CS policy appears something like that:

"… IT/Cyber components (like Operating systems, Data bases, Communication components, Infrastructure S/W) that serve in the production environment will be hardened using hardening documents supplied and certified by the CISO"

4.1.3.      PROCEDURES/WORKING ORDERS

4.1.3.1.     For the CISO. The procedure/working order includes the following steps:

1.     Find out what IT components are used in the Organization and establish a procedure to be notified before any changes are taking place,

2.     Prepare the correct hardening documents,

3.     Set a working procedure with the IT manager responsible for the hardening operations in the IT department.

4.     Deliver the Hardening documents periodically.

5.     Get notice that the hardening document arrived and Time table set for start/finish the process of hardening.

6.     Get notice the hardening process ended.

7.     Check the IT component that was hardened if the result of the hardening process meets the requirements and act upon the audit results. 

4.1.3.2.     For the IT Manager  responsible for performing the hardening process:

1.     He should write a corresponding procedure/working order that describes his "chain of operations" when he receives a new or updated "hardening document".

4.2. The topic: SECURE DEVELOPMENT REQUIRMENT

4.2.1.      Professional Knowledge Base

4.2.1.1.     The "secure coding practice document" certified by the CISO.

4.2.2.      POLICY

4.2.2.1.     In the organization's Information Security policy appears something like that:

"… In any contract with a vendor or bid a section of ITS/CS will be included. Implementing ITS/CS requirements is a condition for establishing the engagement"

4.2.3.      PROCEDURES/WORKING ORDERS

4.2.3.1.     For the CISO. The procedure/working order includes (inter alia) the following:

1.     When writing code is part of the procurement / bid process than one of the requirement is "using practice of secure coding certified by the CISO"…

Or

"Those taking part in designing and writing code have a formal training in secure coding practice certified by the CISO"

4.2.3.2.     For the Procurement manager  responsible for the procurement process:

1.     In his procurement procedure/working order the CISO's requirements/guidance should be integrated.

2.     The contract signed by the vendor should include the relevant secrecy and ITS/CS requirements certified by the organization.