Communication with the appropriate authorities must be kept open at all times. Processes should be put in place to define when and with whom officials should communicate and how identified information security violations will be reported as soon as possible by organisations.Organisations that have been attacked over the internet may compel authorities to take counter-measures. Maintaining these connections may also be required in information security to assist incident management or business continuity and contingency planning operations. Contacts with regulatory authorities are also beneficial in predicting and planning for any changes in the rules or regulations that the organisation must enforce. You can consider to contact with your data protection regulator that is likely mandated in law, utility companies for power and water, health and safety if relevant, fire departments for business continuity and incident management, perhaps your telecoms provider for routing if lines go down.You are going to have to ensure that:

• you identify and document what authorities apply to you
• in what circumstances you would contact them
• how information security incidents should be reported if relevant
• understand what expectations these authorities have, if any
• include relevant contact steps in your incident management processes
• include relevant contact steps in your business continuity and disaster recovery processes

A 5.5 Contact with authorities

Control

The organization should establish and maintain contact with relevant authorities.

Purpose

To ensure appropriate flow of information takes place with respect to information security between the organization and relevant legal, regulatory and supervisory authorities.

Guidance

The organization should specify when and by whom authorities (e.g. law enforcement, regulatory bodies, supervisory authorities) should be contacted and how identified information security incidents should be reported in a timely manner. Contacts with authorities should also be used to facilitate the understanding about the current and upcoming expectations of these authorities (e.g. applicable information security regulations).

Other information

Organizations under attack can request authorities to take action against the attack source. Maintaining such contacts can be a requirement to support information security incident management or the contingency planning and business continuity processes. Contacts with regulatory bodies are also useful to anticipate and prepare for upcoming changes in
relevant laws or regulations that affect the organization. Contacts with other authorities include utilities, emergency services, electricity suppliers and health and safety [e.g. fire departments (in connection with business continuity), telecommunication providers (in connection with line routing and availability) and water suppliers (in connection with cooling facilities for equipment)].

The organization needs to maintain useful contact information with appropriate authorities.The purpose is to ensure appropriate flow of information take place with respect to information security between the organization and relevant legal, regulatory and supervisory authorities. An appropriate forum for dialogue and cooperation between the Company and relevant legal, regulatory and supervisory authorities must be in place.Obviously, with more significant organizations, the need for this is greater as the interruption of service to a larger part of the population increases. Particularly relevant to utilities, telecoms, banking organizations, and emergency services (and for smaller companies these might be on your list). It covers the requirement, purpose and implementation instructions on how to identify and report information security events in a timely way, as well as who and how to contact in the event of an incident.Where attacks stem from the internet various authorities and providers may need to be called to action in order to divert /suppress/mitigate the threat. You can’t fix everything, but you can be ready should the need arise. This will help with business continuity and security incident management. The objective is to identify which stakeholders (e.g., law enforcement, regulatory bodies, supervisory authorities) would need to be contacted in the event of a security event. It is important that you have already identified these stakeholders before an incident occurs.A protocol for engagement with law enforcement can be a part of the security incident response plan or a broader crisis management procedure for the organization. The plan should be clear about which situations require working with law enforcement, such as when laws are broken. The plan should also clearly state who contacts authorities and under what circumstances (e.g., when law enforcement should be contacted by the information security officer or safety officer). Contact with Authorities means that the organisation should establish and implement informal communication with authorities concerning information security issues, including:

• Ongoing communication with relevant authorities to ensure that the organisation is aware of current threats and vulnerabilities.
• Informing relevant authorities of vulnerabilities discovered in the organisation’s products, services or systems.
• Receiving information from relevant authorities about threats and vulnerabilities.

The main objective of control is to establish the organisation’s relationship with law enforcement agencies as it relates to managing information security risks.To meet the requirements, it is expected that if an information security incident is discovered, the organisation should specify when and by which authorities (such as law enforcement, regulatory bodies, and supervisory authorities) should be notified, as well as how identified information security incidents are to be reported in a timely manner. The exchange of information with authorities should also be used to gain a better knowledge of the existing and forthcoming expectations of these agencies (e.g. applicable information security regulations). This requirement is designed to ensure that the organisation has a coherent strategy for its relationship with law enforcement agencies and that it has identified the most appropriate point of contact in these agencies. Contacts with regulatory bodies are also useful to anticipate and prepare for upcoming changes in relevant laws or regulations that affect the organisation.

Appropriate contacts with relevant authorities must be maintained and the legal responsibilities for contacting authorities such as the Police, the Information Commissioner’s Office or other regulatory bodies should always be continued particularly relevant to utilities, telecoms, banking organisations and the emergency services. Where attacks stem from the internet various authorities and providers may need to be called to action in order to divert /suppress / mitigate the threat. All authorities can be listed and retained in an appropriately shared and access controlled repository.
The ISMS coordinator can keep records up to date and identify which and when contact is made by the appropriate relationship owner with specific contact circumstances, and the nature of the information provided. It should clearly identify who is responsible for contacting authorities (e.g. law enforcement, regulatory bodies, supervisory authorities), which authorities should be contacted (e.g. which region/country), and in what cases this needs to happen. Specification of the manner and timing in which breaches shall be communicated to external authorities so as to ensure appropriate reporting.

.

The purpose of segregation of duties in ISO 27001 is to ensure that a single point of compromise does not have significant impacts on the business.Conflicts can occur when two or more employees have similar or different responsibilities towards a particular task. When this happens, the employees may end up doing the same thing twice, or doing different things that cancel out each other’s efforts. This wastes corporate resources and reduces productivity, which affects both the company’s bottom line and morale.In order to make sure that your organisation does not suffer from this problem, it is important to understand what conflicting areas of responsibilities are, why they happen and how you can prevent them from occurring in your organisation. For the most part, this means separating duties so that different people handle different roles in the organisation.

Conflicting duties and areas of responsibility must be segregated in order to reduce the opportunities for unauthorized or unintentional modification or misuse of any of the organisation’s assets.The risk being that if a single post is responsible for highly privileged actions and is not monitored or controlled, then compromise of that role could result in disastrous impacts to the organisation. For example, malicious system or network admins managing the network could greatly disrupt or leak highly sensitive data if not controlled and monitored through controls. The organisation needs to ask itself whether or not the segregation of duties been considered and implemented where appropriate.To be compliant with this requirement, the organisation must be able to demonstrate that highly privileged role functions and conflicting duties/areas of responsibility are sufficiently segregated. For example, this may be achieved by providing additional layers of authorization for privileged tasks such as issuing or revoking user accounts, or system management functions. A two-man rule might be appropriate in certain circumstances, in others it may be appropriate to provide an extra layer of authorization before a task can be carried out supported by enhanced monitoring of user operations. This provides a defense in depth approach and means that any unauthorized activity can be tracked, monitored and alerted upon.

A 5.3 Segregation of Duties

Control

Conflicting duties and conflicting areas of responsibility should be segregated.

Purpose

To reduce the risk of fraud, error and bypassing of information security controls.

ISO 27002 Implementation Guidance

Segregation of duties and areas of responsibility aims to separate conflicting duties between different individuals in order to prevent one individual from executing potential conflicting duties on their own. The organization should determine which duties and areas of responsibility need to be segregated. The following are examples of activities that can require segregation:

1. initiating, approving and executing a change;
2. requesting, approving and implementing access rights;
3. designing, implementing and reviewing code;
4. developing software and administering production systems;
5. using and administering applications;
6. using applications and administering databases;
7. designing, auditing and assuring information security controls.

The possibility of collusion should be considered in designing the segregation controls. Small organizations can find segregation of duties difficult to achieve, but the principle should be applied as far as is possible and practicable. Whenever it is difficult to segregate, other controls should be considered, such as monitoring of activities, audit trails and management supervision. Care should be taken when using role-based access control systems to ensure that persons are not granted conflicting roles. When there is a large number of roles, the organization should consider using
automated tools to identify conflicts and facilitate their removal. Roles should be carefully defined and provisioned to minimize access problems if a role is removed or reassigned.

Segregation of duties reduces the risk of intentional manipulation or error and increases the element of checking. Functions that should be separated include those of authorization, execution, custody, and recording and, in the case of a computer-based accounting system, systems development, and daily operations. Segregation of duties is the concept of having more than one person required to complete a task. Today’s automated solutions and information and communication technologies allow a few people to handle a great deal of information and processes (e.g., stock exchange operators and air traffic controllers). While this is good to improve productivity, a potential side effect is that these few people may end up gathering excessive knowledge and/or privilege over the operating environment and, in case they are absent or have malicious intent, this can prove to be an unacceptable risk, which must be handled.  This is a best practice, especially in cases where sensitive data is being handled. This is seemingly obvious, but often difficult to do in practice. Essentially try to eliminate processes or situations where someone can access, change or use information assets without detection. For example network access and logging should be conducted by someone different from those authorized to use the data. If in doubt – no-one holds the keys to something from which they could gain.

Segregation of duties is a control put in place by many organizations to mitigate the risk of an insider threat or accidental employee mistakes. Sometimes this isn’t practical or possible, but the institution should be aware of the risks of a single person having too much access. Ideally, critical processes or activities should be split up between multiple people. For example, the initiation of a process, its execution, and authorization should be separated when possible. When this is not possible, monitoring and auditing critical processes are very important. Segregation of duties refers to practices where the knowledge and/or privileges needed to complete a process are broken up and divided among multiple users so that no single one is capable of performing or controlling it by himself.

The main reason to apply segregation of duties is to prevent the perpetration and concealment of fraud and error in the normal course of the activities, since having more than one person to perform a task minimizes the opportunity of wrongdoing and increases the chances to detect it, as well as to detect unintentional errors. Wrongdoing requires three factors to be possible: means, motive, and opportunity. Extremely lean processes increase the risk of wrongdoing by concentrating means and opportunity (access to and privileges over the process). By implementing segregation of duties, an organization minimizes the risk by splitting knowledge and privileges. However, the benefits of segregation of duties to security must be balanced with the increased cost/effort required. By using the ISO 27001 requirements for risk assessment, an organization can identify the most vulnerable and the most mission-critical elements of the business to which segregation of duties will represent real added value to the business and other interested parties.

The principles that can be applicable to segregation of duties are:

• Sequential separation, when an activity is broken into steps performed by different persons (e.g., solicitation, authorization and implementation of access rights)
• Individual separation, when at least two persons must approve an activity before it is done (e.g., contractor payment)
• Spatial separation, when different activities are performed in different locations (e.g., locations to receive and store raw material)
• Factorial separation, when several factors contribute to activity completion (e.g., two-factor access authentication).

These principles can be used in isolation or together, depending upon the security an organization requires to protect its processes.

Segregation can be implemented by:

1. 1.Identification of functions that are indispensable to the organization’s activities, and potentially subject to abuse, considering either business drivers or regulatory compliance (e.g., SOX)
2. 2.Division of the function into separate steps, either considering the knowledge necessary for the function to work or the privileges that enable that function to be abused
3. Definition of one or more segregation principles to be applied to the functions. Examples of functions and segregation principles to be applied are:

• authorization function (e.g., two people need to authorize a payment)
• documentation function (e.g., one person creates a document and another approves it)
• custody of assets (e.g., backup media creation and storage in different sites)
• reconciliation or audit (e.g., one person takes inventory and another validates it )

Sometimes the segregation of duties is impractical because the organization is too small to designate functions to different persons. In other cases, breaking down tasks can reduce business efficiency and increase costs, complexity, and staffing requirements. In these situations, compensating controls should be in place to ensure that even without segregation of duties the identified risks are properly handled. Examples of compensating controls are:

1. Monitoring activities: these allow activities to be supervised while in progress, as a way to ensure they are being properly performed.
2. Audit trails: these enable the organization to recreate the actual events from the starting point to its current status (e.g., who initiated the event, the time of day and date, etc.).

All information security and its responsibilities need to be defined and approved by the management. The responsibilities can be general (e.g. protecting information) or specific (e.g. the responsibility for accessing particular permissions). Consideration should be given to the ownership of information assets or groups of assets when identifying responsibilities. Access to information security should be granted to relevant staff members for eg; CEOs, Business Owners, General Manager; HR managers; and Internal auditors. The auditor will be looking to gain confidence that the organization has made clear who is responsible for, and what is adequate according to the size and nature of the organization. For smaller organisations, it is generally unrealistic to have full-time roles associated with these roles and responsibilities. To protect information security one can choose relevant authority with in the organisation to-hold the responsibly and implementing the process.

A.5.2 Information security roles and responsibilities

Control

Information security roles and responsibilities should be defined and allocated according to the organization needs.

Purpose

To establish a defined, approved and understood structure for the implementation, operation and management of information security within the organization.

ISO 27002 Implementation Guidance

Allocation of information security roles and responsibilities should be done in accordance with the information security policy and topic-specific policies. The organization should define and manage responsibilities for:

1. protection of information and other associated assets;
2. carrying out specific information security processes;
3. information security risk management activities and in particular acceptance of residual risks (e.g. to risk owners);
4. all personnel using an organization’s information and other associated assets.

These responsibilities should be supplemented, where necessary, with more detailed guidance for specific sites and information processing facilities. Individuals with allocated information security responsibilities can assign security tasks to others. However, they remain accountable and should determine that any delegated tasks have been correctly performed.
Each security area for which individuals are responsible should be defined, documented and communicated. Authorization levels should be defined and documented. Individuals who take on a specific information security role should be competent in the knowledge and skills required by the role and should be supported to keep up to date with developments related to the role and required in order to fulfill the responsibilities of the role.

Other information

Many organizations appoint an information security manager to take overall responsibility for the development and implementation of information security and to support the identification of risks and mitigating controls. However, responsibility for resourcing and implementing the controls often remains with individual managers. One common practice is to appoint an owner for each asset who then becomes responsible for its day-to-day protection. Depending on the size and resourcing of an organization, information security can be covered by dedicated roles or duties carried out in addition to existing roles.

All information security responsibilities need to be defined and allocated. Information security responsibilities can be general (e.g. protecting information) and/or specific (e.g. the responsibility for granting a particular permission). Information security is the responsibility of everyone at the organization. It is important to establish roles and responsibilities for staff, managers, and contractors/vendors so that everyone knows what is expected of them when handling information.Consideration should be given to the ownership of information assets or groups of assets when identifying responsibilities. Some examples of the business roles which are likely to have some information security relevance include; Departmental heads; Business process owners; Facilities manager; HR manager; and Internal Auditor. Leadership is also very important, and many institutions have at least one person who is primarily responsible for organizing the information security program. Typically this is a Chief Information Security Officer (CISO), Information Security Officer (ISO), Director of Information Security, although the title may vary depending on the Organization.As such, clarifying specific information security responsibilities within existing job roles is important e.g. the Operations Director or CEO might also be the equivalent of the CISO, the Chief Information Security Officer, with overarching responsibility for all of the ISMS. The CTO might own all the technology related information assets etc. No matter what title is selected, there should be someone at the organization who can provide a high level of decision-making support to leadership when considering information security issues and solutions. It is also important to establish data ownership and data handling roles (e.g., data owners, stewards, custodians, and users). Many institutions formally identify and document these roles within their information security policies and data management frameworks. The auditor will be looking to gain assurance that the organisation has made clear who is responsible for what in an adequate and proportionate manner according to the size and nature of the organisation.

Here are some of the vital IT security roles and the responsibilities associated with them. Don’t be surprised that sometimes, different roles share some responsibilities.

1) Information Security Board of Review

The Information Security Board of Review (ISBR) may an appointed administrative authority whose role is to provide oversight and direction regarding information systems security and privacy assurance campus-wide. In collaboration with the Chief Information Officer (CIO), the ISBR’s specific oversight responsibilities include the following:

• Oversee the development, implementation, and maintenance of a strategic information systems security plan.
• Oversee the development, implementation, and enforcement of information systems security policy and related recommended guidelines, operating procedures, and technical standards.
• Oversee the process of handling requested policy exceptions
• Advise the management on related risk issues and recommend appropriate actions in support of the risk management programs.

2) CISO

A CISO (Chief Information Security Officer) is the one whose task is to oversee corporate security strategy. The typical CISO’s responsibilities include:

1. Planning long-term security strategy
2. Planning and implementing data loss prevention measures
3. Managing access
4. Ensuring that the company implements proper safeguards to meet compliance requirements
5. Investigating any incidents and preventing them in the future
6. Assessing security risk
7. Arranging security awareness training

3) Security and Information Compliance Officers

The Security and Information Compliance Officers may oversee the development and implementation of the ISP. Specific responsibilities can include:

• To ensure related compliance requirements are addressed, e.g., privacy, security, and administrative regulations associated with federal and state laws.
• To ensure appropriate risk mitigation and control processes for security incidents as required.
• To document and disseminate information security policies, procedures, and guidelines
• To coordinate the development and implementation of a information security training and awareness program
• To coordinate a response to actual or suspected breaches in the confidentiality, integrity or availability of information assets.

4) Data Owner

A Data Owner is an individual or group or people who have been officially designated as accountable for specific data that is transmitted, used, and stored on a system or systems within a department, location or administrative unit .The role of the data custodians is to provide direct authority and control over the management and use of specific information. These individuals might be department heads, managers, supervisors, or designated staff. Responsibilities of a Data Owner include the following:

1. Ensure compliance with Organizational polices and all regulatory requirements. Data Owners need to understand whether or not any Organizational policies govern their information assets. Data Owners are responsible for having an understanding of legal and contractual obligations surrounding information assets within their functional areas.
2. Assign an appropriate classification to information assets. All information assets are to be classified based upon its level of sensitivity, value and criticality to the Organization.
3. Determine appropriate criteria for obtaining access to sensitive information assets. A Data Owner is accountable for who has access to information assets within their functional areas. This does not imply that a Data Owner is responsible for day-to- day provisioning of access. Provisioning access is the responsibility of a Data Custodian.
4. A Data Owner may decide to review and authorize each access request individually or may define a set of rules that determine who is eligible for access based on business function, support role, etc. Access must be granted based on the principles of least privilege as well as separation of duties. For example, a simple rule may be that all staff members are permitted access to their own health benefits information. A Data Custodian should document these rules in a manner that allows little or no room for interpretation.
5. Approve standards and procedures related to management of information assets.While it is the responsibility of the Data Custodian to develop and implement operational procedures, it is the Data Owner’s responsibility to review and approve these standards and procedures. A Data Owner should consider the classification of the data and associated risk tolerance when reviewing and approving these standards and procedures. For example, high risk and/or highly sensitive data may warrant more comprehensive documentation and, similarly, a more formal review and approval process.
6. Understand how information assets are stored, processed, and transmitted.Understanding and documenting how information assets are being stored, processed and transmitted is the first step toward safeguarding that data. Without this knowledge, it is difficult to implement or validate safeguards in an effective manner. One method of performing this assessment is to create a data flow diagram for a subset of data that illustrates the system(s) storing the data, how the data is being processed and how the data traverses the network. Data flow diagrams can also illustrate security controls as they are implemented. Regardless of approach, documentation should exist and be made available to the appropriate Data Owner.
7. Implement appropriate physical and technical safeguards to protect the confidentiality, integrity and availability of information assets. Data Custodians should work with Data Owners to gain a better understanding of these requirements. Data Custodians should also document what security controls have been implemented and where gaps exist in current controls. This documentation should be made available to the appropriate Data Owner.
8. Document and disseminate administrative and operational procedures to ensure consistent storage, processing and transmission of information assets. Documenting administrative and operational procedures goes hand in hand with understanding how data is stored, processed and transmitted. Data Custodians should document as many repeatable processes as possible. This will help ensure that information assets are handled in a consistent manner and will also help ensure that safeguards are being effectively leveraged.
9. Provision and de-provision access as authorized by the Data Owner. Data Custodians are responsible for provisioning and de-provisioning access based on criteria established by the appropriate Data Owner.
10. Understand and report security risks and how they impact the confidentiality, integrity and availability of information assets. Data Custodians need to have a thorough understanding of security risks impacting their information assets. For example, storing or transmitting sensitive data in an unencrypted form is a security risk. Protecting access to data using a weak password and/or not patching vulnerability’s in a system or application are both examples of security risks.
11. Security risks need to be documented and reviewed with the appropriate Data Owner so that he or she can determine whether greater resources need to be devoted to mitigating these risks. Information Technology dept can assist Data Custodians with gaining a better understanding of their security risks.

5) Data Users

All users have a critical role in the effort to protect and maintain information systems and data. For the purpose of information security, a Data User is any employee, contractor or third-party provider of the who is authorized to access Information Systems and/or information assets. Responsibilities of data users include the following:

1. Adhere to policies, guidelines and procedures pertaining to the protection of information assets.
2. Users are also required to follow all specific policies, guidelines, and procedures established with which they are associated and that have provided them with access privileges.
3. Report actual or suspected security and/or policy violations or breaches to IT. During the course of day-to-day operations, users may come across a situation where they feel the security of information assets might be at risk. For example, a user comes across sensitive information on a website that he or she feels shouldn’t be accessible. If this happens, it is the users responsibly to report the situation.

6) Application Security Engineer

The job of an app security engineer has two major aspects. Firstly, you will need to help developers to create more secure apps. Secondly, you’ll need to control third-party apps used by your company and ensure their safety. Some of the typical responsibilities and tasks include:

• Configuring technical security controls
• Conducting an app risk assessment
• Whitelisting/blacklisting apps
• Performing penetration testing

For app security engineers, it’s vital to control SaaS apps and the risks related to them. Risky and insecure apps should be blacklisted. To automate the job and remain time-efficient, he will probably need specialized software that helps with app security assessment and whitelisting/blacklisting.

7) Data Protection Officer(DPO)

Having a DPO may be one of the compliance requirements. A DPO must be appointed in organizations working with large-scale systematic monitoring or processing of sensitive data. Officers oversee corporate data protection measures and their effectiveness. A specialist, appointed to the DPO role, controls whether corporate security is of a sufficient level to meet compliance requirements, and recommends security upgrades if needed. That’s why an in-depth understanding of data security and compliance are essential skills. The DPO orchestrates, manages, and supervises all the activities that are aimed at protecting users’ data and communicates the status to both internal and external parties. This includes:

• Creating an effective step-by-step privacy program
• Supervising the entire implementation process of the program at all stages
• Assuring that all the data processes are being conducted
• Reporting to the management, stakeholders, and all the parties involved on how the implementation process goes
• Reporting to the management on the potential threats to data security and general integrity, and what can be done to eliminate them
• Educating employees on the matters of data privacy and data protection
• Training staff that is directly related to or involved in the data collection, processing, or storing
• Keeping track of and recording all the operations that involve users’ personal data and the reasons for these operations to take place
• Auditing the data processes to assess their performance and address possible problems proactively
• Reporting on the progress of the implementation and maintenance of the data privacy program in the company to the authorities, stakeholders, and public/customers
• Being a connective link between the organization and data subjects (users/customers). Communicating with data subjects on how their data are being handled, what rights do they have, and addressing all their requests concerning their data
• Communicating with supervisors and being a connecting link between the organization and authorities

8)Network Security Engineer

As the name suggests, a network security engineer’s job is to protect corporate networks from data breaches, human error, or cyberattacks. Engineers are responsible for:

• Configuring network security settings
• Performing penetration testing
• Developing and implementing sufficient measures to detect cyber threats
• Implementing network security policies
• Installing and maintaining security software like firewalls or backups
• Also, a deep understanding of cloud security may be required.

9)Security Administrator

An IT security admin is a role that includes a wide range of skills and responsibilities to manage the protection of the company’s data. Some of the most common admin’s responsibilities include:

• Managing access
• Ensuring that data migration is secure
• Configuring security software
• Monitoring data behavior for abnormal activities
• Implementing security policies
• Testing company’s systems to locate potential risks and vulnerabilities
• Reporting security statuses and incidents (if any)
• Using software tools to automate some of the tasks

An admin’s role is more significant than it may seem at first glance. An admin has to keep the whole organization’s security landscape in mind and ensure that even the tiniest processes are executed correctly. After all, even one careless click may be enough to initiate a cyberattack.

10) Security Analyst

What is the role of an information security analyst? This role is related to protecting corporate information against cyber attacks and insider threats. Generally, an analyst has to determine potential risks and vulnerabilities inside the system, so a deep understanding of data security threats and ways to prevent them is a must. As a security analyst, your responsibilities will include:

• Analyzing and configuring corporate systems to improve their security
• Analyzing data loss prevention measures
• Looking for system vulnerabilities and ways to fix them
• Monitoring data behavior for abnormal activities
• Verifying security, availability, and confidentiality of corporate data
• Also, the security analyst’s role requires an understanding of white hat hacking to design more advanced protection against cyber attacks. Analysts often work together with security architects.

11) Security Architect

A security architect is one of the senior-level IT security positions. An architect is focused on creating a secure-by-design environment. Unsurprisingly, this position requires a solid understanding of network, app, and hardware security, as well as experience with various systems. Generally, an architect’s responsibilities include:

• Assessing the system’s security controls and processes to find potential security gaps
• Planning changes and upgrades for corporate IT infrastructure
• Maintaining system integrity
• Implementing insider threat control measures
• Choosing new security software if needed
• Implementing disaster recovery measures
• Analyzing previous incidents and creating an incident response plan
• Analyzing the costs and benefits of security solutions

Of course, the exact scope of your tasks as an architect will vary depending on each organization’s unique infrastructure and needs. Often, an architect needs to assess corporate systems for meeting security compliance standards to decide what changes are needed to become compliant.

12) Security Specialist

An IT security specialist is a person responsible for keeping corporate data safe. Security specialists maintain and upgrade systems and procedures to prevent data loss or leakage. IT specialists have many sub-specializations. Depending on a specific environment, an information security specialist will have a stronger focus on cloud, network, app, database or device security. In some cases, especially in small businesses, an IT security specialist is an all-rounder with responsibilities combining many cyber security roles at the same time. That’s why a security specialist must have strong IT skills and a deep understanding of both software and hardware—and, of course, an ability to locate potential vulnerabilities and fix them.

1.0 Purpose:

The objective of this procedure to identify type of information , classification and labeling at XXX so that all the personnel follow a common framework and understanding of Information security.The purpose of this procedure is to establish a framework for classifying data based on its level of sensitivity, value and criticality to XXX as required by the information security policy. Classification of data will aid in determining baseline security controls for the protection of data.

2.0 Scope :

This procedure applies to all the business processes, its information and information system.

3.0 Responsibility:

• IT dept.
• Users
• Process Owners/HOD

4.0 Procedure :

The following procedures cover how to label, store, dispose of, communicate, physically transfer or copy different types of information, depending on its classification and media (e.g. paper, electronic transmission (email) or electronic
storage/transfer).

The distribution of data should be kept to a minimum. However when data is required to be distributed it is required to be validated and have appropriate marking:

• To the authorized recipient (a formal record shall be maintained and reviewed at appropriate intervals by the authorized recipients of data); and
• Commensurate to its classification. That classification of data is split in to three categories as defined in the Information Classification and Handling Policy.

All information assets must be classified into one of three categories. The information asset must be appropriately labelled to ensure that its classification is readily identifiable.

Where information is grouped together, the highest classification shall be applied to all information in the group.

The agreed classification categories are:

LABELING

Document authors will need to ensure that classification status markings are applied manually to all documents using the appropriate classifications of ‘PUBLIC’,‘INTERNAL’ or ‘CONFIDENTIAL’.

All data must be marked with the appropriate classification clearly as a minimum in the document header prior to printing. If the material is already printed or has not been word-processed, the marking ‘PUBLIC’, ‘INTERNAL’ or ‘CONFIDENTIAL’ as appropriate, must be written, at the top of every page as a minimum. Multiple page documents must be stapled together.

Any information that is not specifically marked as being ‘INTERNAL’ or ‘CONTROLLED’ will be deemed to be ‘PUBLIC’. Therefore, the person responsible for processing or handling a document, particularly if consideration is
being given as to whether a document should be disclosed, MUST consider the content of the document in determining how that document should be processed and not rely on its classification under this policy. The labeling of a document as Internal, Confidential or public does not override the XXX’s duties under the Data Protection Act or Information Act

Removable media such as CDs or DVDs, USB data sticks etc. used to store XXX information must always be classified as ‘CONFIDENTIAL’ and do not require individual labeling or marking.

STORAGE

Information should be stored in accordance with contractual or legislative requirements and in a manner commensurate to its classification, as follows:

• PUBLIC data: Does not require any access restrictions or specific safe storage.
• INTERNAL data: If information is removed from the xxx for use by home employee it must not be left unsecured in employee’s vehicles or left in public places. Information and data must be stored wherever possible, in a lockable area when at the employee’s home that cannot be accessed by any unauthorized person, including family members.
• CONFIDENTIAL data: This information is sensitive information of which access must be restricted – securely locked away at the end of each working day or when no longer needed. This applies regardless of the format which this information is held on e.g. paper, disk, files, tapes, faxes, post.

When stored in an electronic format, data must be protected by the use of both technical and physical access controls.
The following must be in place for:

CONFIDENTIAL Data stored on servers:

• Servers must be located within secure rooms at XXX premises and access must be restricted to authorized personnel only.
• Logical access controls must be used with authorized user ID and strong passwords.
• Data stored in defined areas of the network must only be available to those authorized users with a need-to-know
• Encryption must be employed wherever possible

CONFIDENTIAL Data processed on laptops:

• Laptop hard drives must have full disk encryption applied
• Only authorised users with XXX network domain credentials are authorised to use laptops.
• Authorised users viewing restricted data on a computer screen must observe the XXX guidance with particular attention to preventing the possibility of ‘Shoulder Surfing’ or casual viewing by unauthorised people
• Data must be moved from the laptop to a secure area on the XXX network as soon as possible

CONFIDENTIAL Data held in hard copy:

• Within XXX buildings must be locked away in secure storage
• Within Employees homes must be stored, wherever possible, in a lockable area that cannot be accessed by any unauthorised person, including family members
• At premises other than XXX locations if used for reference by third parties must remain within the XXX employee’s line of sight/possession and only made available to those with a need-to-know before retrieval
• In transit must not be left unsecured in employee’s vehicles or left in public places.
• Data held on portable (removable) media, such as (but not limited to) CD, DVD, USB and Tape (including backup media) must have protection and encryption measures in order to protect against loss, theft, unauthorised access and unauthorised disclosure or;
• When stored in an other form, must be stored only in a locked drawer or room or an area where access control measures exist to provide adequate protection and prevent unauthorised access by members of the public, visitors, or other persons without a need-to-know.
• When verbally discussing Confidential information in public places or on public transport (including mobile phone conversations) care should also be taken in order that the conversation is not overheard. These rules also apply to verbal messages that might be left on answering machines or voicemail and also to information which is sent or received by email, fax, text or multimedia messages sent by mobile phone or other messaging services.

DISPOSAL OF INFORMATION

Information which is no longer required must be disposed of safely and securely and in accordance with its protective marking. There are many reasons why care must be taken when sensitive information is to be disposed as follows:

• It may cause damage to the Council’s reputation if the information fell into the wrong hands;
• It would be a breach of the Data Protection Act .
• It could result in costly litigation and financial loss to the XXX
• It could cause irreparable damage to individuals and families.

The ways in which we can prevent the above scenarios from occurring include the following disposal methods:

• To ensure that all information other than PUBLIC is securely shredded
• Any media (tapes, USB memory sticks etc.) must be securely destroyed through the XXX’s disposal procedure

Records must be maintained of all media disposals and must be made readily available

COPYING

Employees should be aware that they should not copy by any means, information which is marked ‘INTERNAL’ or ‘CONFIDENTIAL’ unless they are authorized to do so, under the ‘need-to-know’ principle.

This procedure applies to all information and documents produced by the XXX which have been deemed to have a security classification applied to them. The information covered in this procedure includes, but is not limited to, information that is either stored or shared via any means. This includes electronic information, information on paper, and information shared orally or visually (e.g. telephone conversations or video conferencing).

All XXX information has a value to the organisation, however not all of the information has an equal value or required the same level of protection. Being able to identify the value of information assets is key to understanding the level of security that they require. Once the appropriate level of security is identified the appropriate control can be implemented to prevent loss, damage of compromise of the asset, disruption of business activities, and prevention of the compromise or theft of information and information processing facilities. Incorrect classification of assets might result in inadequate or incorrect controls being implemented to protect them.

Back to Home Page

If you need assistance or have any doubt and need to ask questions contact me at preteshbiswas@gmail.com. You can also contribute to this discussion and I shall be happy to publish them. Your comment and suggestion are also welcome.

Process Flow

The following diagram shows the process flow for risk assessment as part of the overall ISMS framework.

1. Risk Assessment Definitions

For a given information asset, Risk is defined is a probability of a threat materializing as a result of a vulnerability compromise resulting in the undesired impact. In other words the assessment of risk includes the following key elements:

1. An Asset (1)
2. Applicable Threat category (2)
3. Threat & Impact (3)
4. Threat & Vulnerability (4)
5. Threat & Probability (5)
6. Overall Risk (to an asset against a specific threat)

This is illustrated in Table 1.

For the process of Risk assessment the following table has been used:

1. (Information) Asset Groups

An Asset is defined as any business asset, which has information contents. Examples of asset (not exhaustive) are listed below:

• Personnel
• Paper
• Business applications hosting information
• IT infrastructure items supporting information
• Office Infrastructure supporting Operation
• Office Infrastructure supporting Security operations
• Documents – electronic and Paper
• Services
• External Service providers

Each department head creates and maintains their asset masters.

1.2          Risk Assessment Formula

Risk Assessment for each asset is carried out using the following formula.

Risk = Threat X Business Impact or loss of “Value” X Vulnerability X Probability. Each component of the risk assessment also undergoes a qualitative valuation based on the judgment of the risk analyst.

Listed below is an explanation of each of these terms.

1.1.1       Threat X (Business) Impact (valuation)

Each asset undergoes three major classifications of threat analysis – Confidentiality, integrity and availability. The risk analyst defines the appropriateness of the asset and the commensurate threat applicable to the asset. Each threat so chosen also undergoes a business impact or “valuation” on a range of 1(one) to 4(four) based on the following guideline. The risk analyst takes into consideration the worst scenario for valuation purposes:

Information Valuation/Rating

Availability Rating

Integrity Rating

The asset ‘impact’ rating is performed based on enterprise context.

1.3    Threat X Vulnerability

Vulnerability is by definition, an inherent weakness by which a treat can be exploited. Vulnerability is the base factor and covers absence (or existence) of controls or countermeasures. Vulnerability is rated on the following 4-point scale:

Typical assessment (not exhaustive) made are presence of preventive, detective, maintenance and/or monitoring controls present to prevent the threat materialization. The risk owner and the risk analyst jointly agree on the valuation of asset.

1.4          Threat X Probability

Probability is the likelihood of a threat materializing for the given asset. The asset owner and the risk analyst jointly agree on the valuation of asset. Probability is rated on the following 4-point scale:

For a given asset the risk is therefore calculated by a measure of threat, business impact, vulnerability and probability.

1.5          Justification

Each element of risk assessment i.e. Impact, vulnerability and probability is provided with justification of their valuation or reference to Very High, High, Medium and Low probabilities.

2. Risk Assessment Process

The process of risk assessment for a given asset consists of three stages as explained below:

• Asset Definition

The Asset owner (typically HOD) creates and maintains an Asset master. The Asset master contains provision to captures all forms of information asset (paper, people, documents, hardware, business applications, and external service providers)

• CIA Impact Valuation

Each asset owner conducts an Impact valuation on the loss of Confidentiality, Integrity and Availability (CIA) to a given asset. While doing he/she looks at the CIA reference table to assess whether the asset correlates to the CIA criteria.

• Risk Valuation

Assets with a value of 4 as a result of either C,I and/or A, where the impact of the security violation is Very High, has mandatory requirement to be assessed for the other values of risk, namely vulnerability and probability.

Risks that cannot be treated is considered to be ‘Residual Risks’ and subject to approval by risk owner.

2.2    Risk Assessment Worksheets

• All assets which have an impact value of 4 are rated with their vulnerability and probability in a centralized record called – XXX-ISMS-RA record.
• A risk revaluation is done for those assets where a decision has been identified as closed.

3. Risk Treatment Process

1. Risk treatment process has the following parameter – All weakness areas are reported in a centralized vulnerability dashboard. ISMS QA/MR discusses each area of the weakness and reports to the applicable departments for closure.
2. ISMS QA/MR discusses the vulnerability or the associated risk with the risk owner.
3. Decisions to close an identified vulnerability are taken by either Head of Department. When the decision for implementation cannot be made by the department, the decision is moved up the chain of command, for senior management for final decision.
4. Each decision so made are ensured implementation through allocation of responsibilities, which in turn is coordinated with Head of Departments/applicable enforcer,
5. Areas wherein senior management/head of department does not take decisions or the implementation totality takes a certain period of time, it is considered as residual risk. However reference to senior management decision either as closed, work in progress (WIP) or residual risk (RR) is referred in the Gap dashboard.
6. An annual plan of future initiatives is made available demonstrating the senior management commitment to ensure effective implementation of existing security framework.
7. Reassessment of Risk values is done for those assets wherein decisions have been taken to reduce their Risk. This is an ongoing activity and ISMS QA/MR keeps track of all such Risk areas.

4. Risk Acceptance Criteria & Residual Risk Management

All risk values are rated on the 64-point scale. All attempts are being made to reduce the value of risk to the extent possible. However the following rule applies:

Risk Acceptance criteria is vulnerability value 1. When an asset’s vulnerability value is more than 1, it means that the asset has vulnerability. A vulnerability value of 1 reflects no known vulnerability, and is therefore becomes the benchmark for risk acceptance.

• All vulnerabilities equal to 2 and above are presented to the management for reduction. Management includes department heads, and top management – depending on the areas of the risk.
• All values of risk equal to greater than 12 are presented to the management
• Upon the introduction of controls, there could be risks whose values do not come down below 12 and therefore, continue to remain on the higher side. Such values are part of the residual risk.
• Risks are classified as High – if the value of the risk is >=12, Medium – if the value is =>8 and <12, and Low <8. Except for personnel assets, the objective of all remaining assets is to bring down the vulnerability value to <=2. For personnel, a HIGH Risk is acceptable, as they may be an operational requirement.
• Residual risk are reflected against each asset group where risk assessment is performed.

4. Risk Communication

For those risks, where the vulnerability is 1, risk owners are communicated.  The risk owner is required to own and accept the residual risk.

5. Supporting Worksheets/reports

1. XXX – Department-wise ISMS Compliance sheet
2. XXX-ISMS-Risk Assessment record (Also includes revised RA values),
3. Latest Statement of Applicability – reflects references to existing controls
4. Management review records includes residual risk and future plan of action.