The Structure of Information Security

Slide 3

Thursday, March 15, 12

Programs Goal

To have the same performance in every

level of the organization.

Thursday, March 15, 12

Security Program
Uniform in the whole enterprise. Everyone knows and abide Organization structure must be set up

Thursday, March 15, 12

Organization Structure should involve:

Information security management who
provide direction, advice, focal point.

Internal Audit who report to Audit

of business unit.

Committee, directors and other senior managers

Steering Committee composed of all head

Thursday, March 15, 12

Organization Structure should involve:

Security Coordinator in each business unit. Security Administration in each business
unit.

Security Working Team in implementing

security programs.

Thursday, March 15, 12

Business Unit Responsibility

Creation & Implementation of Policies and
Standards.

Thursday, March 15, 12

 each business unit must have the each business unit must have the

opportunity to approve the policies. opportunity to review and comment on the policies.

Thursday, March 15, 12

Business Unit Responsibilities

Policy

System Acces

System Devel

Asset Classification

Network Management

Sec. Organization

Reviewer CEO SVP, Marketing SVP, Dev. & Tech VP, Finance General Auditor GM, HR GM, Risk Mgmt Senior Consultant
Thursday, March 15, 12

Compliance

Personnel

Info. Sec

Physical

BCP

 Business units have the responsibility for

writing information security standards for their area of responsibility can review information security standards for their impact on their business unit assist in the implementation of approved policies and standards

Business units must provide someone who Business units have the responsibility to

Thursday, March 15, 12

Business Unit Responsibility

Creation & Implementation of Policies and
Standards. Standards

Standard & Compliance of Policies and

Thursday, March 15, 12

 Responsibility to ensure constant Enforcement of Compliance

compliance with policies & standard

Thursday, March 15, 12

Information Security Awareness Program

Purpose: demonstrating the Who, What,
Why of the Policies & Standards information

Perpetual program of reinforcement and

Thursday, March 15, 12

Obstacle to the Program

Budget Solution: demonstrate the effect to the Subject: access control, e-mail practice,
virus management. nancial (ROI, contribution to prot, etc)

Thursday, March 15, 12

Success Factor
Frequency Media

Thursday, March 15, 12

Frequency
Frequency of message delivered to staff Equal to ads, with educational message.

Thursday, March 15, 12

Message focus on:

Information security policies Information ownership Information classication Good information security practices
Thursday, March 15, 12

Additional Message:
Information security standards Information security monitoring Information security performance
measurement

More information security good practices

Thursday, March 15, 12

Media
Composition of the media used Mix of media (video, posters, presentations,
booklets, brochures, newsletters, and giveaway item)

Thursday, March 15, 12

Information Security Program Infrastructure

Mechanism within the organization that
supports good information security practices

Thursday, March 15, 12

Information Security Steering Committee

Comprised of Senior Managers (VP/
Director level)

Internal Audit, Legal, Human Resource,

Organized Labor.

Meets frequently
Thursday, March 15, 12

Assignment of Information Security Responsibilities

Senior Management Information Security Management Business Unit Managers First Line Supervisor Employees Third Parties
Thursday, March 15, 12

Info. Security Program Infrastructure

,m./m,.

Senior Management
Have the ultimate responsibility for deciding how the organization will handle risk Responsible for:
Making sure that audit recommendations are addressed in a timely and adequate manner Participating in the activities of the ISSC Providing adequate resources Educating organotions staff Reviewing and approving policies and strategies Providing resolution for info. Sec issues
Thursday, March 15, 12

Info. Security Program Infrastructure

Information Security Management
Responsible for the information security practices of the information security unit. For other units, providing services and advice Must be able to:
Drive the effort to create, publish, and implement info. Security policies and standards Coordinate the creation and testing of business continuity plans Manage the info.sec effort within the info.sec unit Administer info.sec software tools on behalf of the organization Provide enough education and awareness programs to the organization
Thursday, March 15, 12

Info. Security Program Infrastructure

Business Unit Managers
Support the info.security program by:
Participating in the process of reviewing policies Creating input for info. security standards Measuring info. Security within the unit Enforcing compliance with policies and standards Supporting info.security education and awareness Making sure resources are available to draft, test, and maintain BCP

Thursday, March 15, 12

Info. Security Program Infrastructure

First Line Supervisors
Carry out duties delegated by the business unit managers and a key piece of the communication chain that allows an organization to monitor its info.security program
Monitor the employess activities in light of organization info. security policies and standards Communicate security issues to Information Security, senior management, and ISSC Commnet on individual employees performance with respect to info. Security Reinforce the messages contained in the education and awareness elements of the program

Thursday, March 15, 12

Info. Security Program Infrastructure

Employees
Information security programs only work well when all employess participate, and employees participate most willingly when they feel they have a real role to play Employees participation such as:
Complying with info. Security policies and standards Reporting security breaches

Thursday, March 15, 12

Info. Security Program Infrastructure

Third Parties
Such as contractors, vendors, etc Responsible for complying with info. Security policies and standards of the organization with which they are contracted or to which they provide goods or services Where contractors operate in the organization site, ther are subject to the same rules and methods of enforcement as full-time employees Where contractors operate on their own site, the organization has right to audit the contractors info. Security programs

Thursday, March 15, 12