[BreachExchange] How to Operationalize Security with Enterprise-Wide Engagement

[Audrey McNeil]

https://securitytoday.com/articles/2017/04/10/how-to-
operationalize-security-with-enterprise-wide-engagement.
aspx?admgarea=ht.businessconti

Security in the modern business environment – when executed correctly – is
the sum of two parts. It requires analysis of external cyber threats, which
helps identify and design the best defenses, but also a high level of
operational transparency within your organization. Without that
transparency, your security team can’t engage the necessary parties, and it
becomes impossible to make sure everyone is adhering to your cybersecurity
standards.

Organizations that first turn to specialized cybersecurity tools and
services are surprisingly not as prepared as they should be. No matter how
well-defended a castle’s front gate is, occupants are still vulnerable if
other points of entry aren’t covered with a guard shift. Similarly, each
unit should only have access to the wings it needs to accomplish its
duties. Companies today have such complex operations that it’s very rare
for the security team – much less the CISO – to have full visibility into
all potential vulnerabilities.


Additionally, “63% of confirmed data breaches involved weak, default or
stolen passwords,” according to the 2016 Data Breach Investigations Report.
Battening down the hatches therefore doesn’t require sophisticated security
technology, but improved governance. According to Ponemon Institute
research, up to 58 percent of companies use "mostly manual monitoring and
testing" to monitor access policy compliance. This makes it easier for
attackers to exploit privileged access rights. Indeed, manual processes
make it extraordinarily difficult to enforce permissions/access rights and
to detect unusual behavior.

Why Governance Holds Your Security Program Together

No matter how much you spend on new hardware, software, and services, if
you don’t enforce strong policies – specifically, those related to
passwords, asset management, and access rights – you won’t be able to
identify and manage your vulnerabilities. There are simply too many
changing processes owned by too many departments for one individual or team
to handle. Security teams need to break responsibilities into manageable
components, make each department accountable for a certain piece, and
finally, ensure action is taken on those areas of responsibility. All this
activity then needs to be aggregated and reported on.

Without proper governance oversight, silos operate in the blind, and
they’re unable to coordinate activities and responsibilities. This leads to
redundancy, inefficiency, and worst of all, risks that slip under the radar
and lead to incidents.

Since a majority of breaches result from preventable behavior, not poor
technology, operationalizing an effective process has three main
components. All three require cooperation between multiple departments:

Identify areas of vulnerability: Attain full visibility across the
organization by involving the right parties. The security team is
ultimately responsible for making sure all employees follow secure
practices and all assets are protected from cyber risks. To do so, security
needs to tap into the asset oversight capabilities of the finance
department.


Finance handles the acquisition and billing of all assets, including
hardware, internal software, and third-party applications. By reaching out
to finance and accessing this master asset list, security can take the
first step to operationalizing your meticulously crafted cyber policy:
identifying all vulnerabilities, or points of access, through which data
breaches might be initiated.

Assign roles to appropriate process owners: Once security has a map of all
the applications and devices to evaluate, the team still needs a way to
notify the managers (throughout the organization) who have direct oversight
of those assets. How many employees have administrative access to the
payroll system, for example? Is that number limited only to the accounting
team and any other essential personnel? As another example, does every
employee using a software that handles sensitive data log in with a unique,
secure password that meets the requirements stated in your policy? Do
consultants or employees have access appropriate to their needs/roles?

If left to its own devices, which is the case in an organization with poor
governance, security will be unable to individually contact each process
owner to acquire this information. The more difficult it is to understand
who can handle which component of the policy, the more difficult it is to
create accountability, and the less likely it is that the policy will
become a reality.

Perform regular monitoring to enforce the policy: As mentioned previously,
it’s not the existence of a security policy that protects your
organization, but the successful implementation and maintenance of that
policy. Requiring individual managers to handle certain components of the
policy is half the battle; this breaks the process down into manageable
components and prevents the paralysis that often afflicts security teams
that don’t have access to other departments’ resources.


The second half of the battle is creating a system of accountability. Are
process owners executing action items on time? Which line items are
outstanding, and what’s their timeframe for completion? Managers should be
notified of impending due dates and what they need to do to meet those
deadlines.

What Connects It All?

The process discussed in this article is enterprise-wide. It allows you to
make full use of resources that already exist within your company. An
enterprise risk management system allows security to automate the
interaction with each department and process owner. It provides a
centralized location for all departments, uncovering relationships (such as
finance’s access to an asset list) that wouldn’t otherwise be visible. It
must also allow security to push out assessments, notifications, and tasks
to the appropriate party. Together, these capabilities create visibility
into all parts of the security implementation process, and alerts go out
for any exceptions.

Enterprise risk management (ERM) systems bridge silos by allowing you to
tap into relationships and dependencies that already exist, mostly under
the radar. Unlike spreadsheets, ERM automates the process, sending
recurring notifications and mapping connections between access and assets.
Automated reports sent to key stakeholders make it easy to identify missing
pieces, implement your policy, and report to senior management and
regulators. Robust reports provide protection from class action law suits
for negligence, and will meet cyberinsurance requirements to perform the
above activities.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.riskbasedsecurity.com/pipermail/breachexchange/attachments/20170411/e187b58b/attachment.html>