Last post I highlighted the ISM Top Ten but didn't actually put any context behind the topics. That's rectified below. Next up will be my first try at the "Use, Adopt and align to Industry Standards" topic. Well, it's kind of my second try but that's not important. Look forward to some assistance!
Executive Sponsorship and Commitment
Security programs that are driven and publically supported by executive management are more widely adopted than those that aren't. You should ensure that your information security program has the appropriate level of executive sponsorship and the ongoing commitment to implement an appropriate information security program. That commitment should include an appropriate budget to both implement and maintain a program; a commitment to develop and maintain a company culture that includes information security as an integral (and transparent) part of it and a commitment to publically sponsoring the program
Company Wide Support and Participation
Security programs that are aligned to support the goals of the business and which have active participation from business units are more successful than those that don't. By understanding the needs of each business unit and aligning your program to support the specific goals and unique challenges of the business, allows corporate information security to "add value" and not be seen as a cost. This in turns promotes an upwards spiral or participation and self-improvement. This is often referred to as community policing.
Use, Adopt and align to Industry Standards
Security programs should adopt established information security management standards like ISO 17799 and embrace IT standards such as COBIT and ITIL. These of course should be tailored to meet the exact needs of the business. While not perfect or indeed a panacea, ISO17799/ISO27001 is a widely adopted and well respected standard that defines components of an information security management program and process. Adopting it enables an organization to leverage existing public domain work, as well as interoperate with other business easier
Make it easy for people to do the right thing (Policies and Procedures matter)
In general, people want to do the right thing. Making it easy for people to do the right thing is a key mantra in gaining corporate wide support and participation for an information security program. Many information security departments are introspective; writing and publishing documents and guidance for themselves. Information security programs should get back to basics and make it easy for people to do the right thing. This includes writing and publishing accessible and useful policies, standards and guidance. The focus of all guidance should be "how to do things securely" as opposed to simply "What not to do". Ensure there is an easy process for additional support (asking clarifying questions). Security should be integrated into peoples existing environments wherever practical.
Document, Publish and Refine your Processes
In general people want to do the right thing. When they understand what they should do they can easily follow a process. Information security programs should document their processes, ideally with simple to follow flowcharts and publish them in an accessible place. Processes should define roles and responsibilities, activities and where appropriate service level agreements. By observing and measuring business activity against these processes organizations can optimize and refine them to improve performance and reduce cost.
Training and Education is Key
Tailored training and awareness for all users will pay ongoing dividends. Training should range from small digestible "sounds bites" for business orientated people to deeper technical training for IT and development.
Manage Risk, not Security
Few companies in the world are in business to be secure. Almost all companies in the word need to have an environment that is secure enough to do business. Information security programs should focus on managing risk and working with the business to determine a level of appropriate risk for their business. Risk levels are usually best determined by a combination of security advice and business acumen. Partnering with the business to determine and manage risk usually works best.
Manage with Facts and Numbers
Information security decisions should be made with facts wherever possible. While it is not a science, it is also clearly not an art and making business decisions based on fact makes sense. Ensuring you collect, capture and analyze appropriate metrics and facts will allow you to make smart business decisions and recommendations. Metrics and facts avoid security religion.
Don't Fall in the Compliance Trap
After the cash cow of SOX, many information security consultants and product vendors would have you believe the world is falling (Chicken Little Syndrome) and that new regulations like the PCI are key to information security. Companies should understand which regulations actually apply to them and what the implications of those regulations are in reality. Managing a good information security program will mean you will likely meet all the requirements of most regulations; managing to a regulation will mean you will likely not have a good information security program and will be constantly fighting fires.
Leverage Corporate Business Initiatives
Information security should be an integral part of company culture and leveraging existing corporate wide business initiatives will help instill that culture.
TS.