Creating An Information Security Program

0:00Let's talk about organizational culture. When it comes to information security, the question is, "Is organizational culture important?" And the answer to that is an astounding "yes." Not just a little "yes" but a big "yes" because organizational culture is absolutely crucial to having a successful information security program. It significantly influences the effectiveness of any security initiatives and the overall security posture of an organization. So that's why this is an astounding "yes." So let's go through a little exercise here. Think of your favorite restaurant. Where do you like to go and you really enjoy it? You just show up there, the people are so friendly, and they know your name, they know what you like to order, the food's consistently good. So every time you go in you have a great experience. The atmosphere is nice. Well this is all because of the culture of that business.

1:03The culture of the business might be that they want their guests, their customers, to feel like they're eating at a friend's house. And again, back to the big smile. Culture, it really influences everything in a business. And that's why it's so important. So the reason you like to go to these places that you enjoy and there have friendly employees working there and the atmosphere is great and the food is great. You just have a good time. It's because of the culture. So think about taking that culture and the influence it has and putting it in your standard business environment where you're dealing with information security.

1:43So culture is a driving force behind getting everyone in the same mindset. Getting everyone on the same bus so that they can take this trip together in the business to arrive at whatever their goal is right down here as the number one team. So that culture is the driving force that brings everybody together and gets them in alignment with the organizational goals. And CBT Nuggets has a great culture. It's an amazing culture and it's what drives us to deliver the best content that we can and to relate with our learners and to interact with them and feel the struggle so that we can share in this together. So let's talk about how does this tie into information security when we're talking about culture. Because down here there's a label I don't know if you can read it or not but it says one size fits all. And guess what? There is no such thing as a one size fits all when it comes to information security. And that's because in information security our policies pretty much define everything that we do within an organization. They outline what the business's stances are on

2:58various topics. And under the policies we'll end up creating procedures later on. And these procedures outline the how to of following our policies. These policies are how we feel about X. Okay and Y and Z and ABC as an organization. So it could be about data privacy. You know we're very strong about data privacy and we want to follow these standards or frameworks about data privacy. And then we get down to the procedures and these are the technical how to's to be in alignment with our policy. So when it comes to our policies a one size fits all just doesn't really work. So oftentimes we need to tailor policies to work with our organizational culture. That's very important here. When we're talking about these policies they need to fit in to our culture. Because if we do it this way and we fit in these policies are much more likely to be adopted and followed by the organization. We don't want to fight an uphill battle on telling you folks. So let's talk about how this ties into communications. So let's talk about communications just kind of in general here. So as security

4:16managers we communicate both up and down the org chart or our chain of command right. And we need to understand the culture again we're going back to culture. The culture within the organization and how the communications works within the organization within the culture. What's normal? Is this a communications culture that uses Microsoft Teams channels and SharePoint sites for making documentation and training available? Well if so then when we come up with our information security program and within it we have our documentation or docs and we're gonna have training. Well in that we need to make sure that this aligns with the culture. And as I had mentioned when we're talking about communications they were using like Microsoft Teams and Share Point as part of their communications. Well we would want to incorporate our documentation and training into these platforms because our users are really familiar with them. We do not want to go in and deploy a whole new set of applications and cloud services and such for security because our users they just like to do their job. They don't want to have to go outside the norm. And

5:31again that goes back to culture something outside the normal culture. So if we follow the culture and we're here we're talking about communications then it's much more likely to be adopted and accepted by everyone in the organization. So again we need to be in alignment with culture. We really need to understand the organizational culture. And we're gonna talk about this as we go throughout the skill and really it's gonna come up throughout the entire course because it is so important. So in review a security program that clashes with the organization culture is likely to face resistance. It's not gonna be understood very well and ultimately it's gonna be less effective at protecting the organization. So again culture is so very important. All right well that wraps up our Nugget on Culture!

0:00Alright, let's talk about security governance. And let's start off with the word governance. Okay, that's what we're going to start with because security we're pretty much in tune with as far as everybody has already experienced security throughout their life . I mean, we talk about things like locking your doors at home. That's part of security, buckling your seat belt. That's kind of part of security. And we deal with this all the time. So what I really want to focus on here is governance and what that means. So governance is overseeing the control and direction of something.

0:31So I'm going to put that up here. So really it's overseeing the control and direction. And in this instance, it's of security and really our security program. So that being said, this happens in two key ways. Number one is strategy because we're overseeing the control and direction. And when it comes to strategy that's generally associated with direction, we're going to talk about strategy more in depth here shortly. But you need strategy and that strategy needs to align with whatever the organizational goals are.

1:06Okay. And then number two is oversight because if you think about it, we don't just create something and send it out on its own and let it just be without any oversight. That would be well, negligent. We don't send rockets off into space without oversight with folks at Mission Control watching the rockets and controlling computers and such. We just don't do that. So it really does take the two of these. We need a strategy so we can stay in the fight and we need oversight to make sure that our strategy is in the correct direction, meaning it's in alignment with organizational goals.

1:46And you'll see this over and over and over again throughout this course and pretty much anything in information security. So let's take a look at some key activities that take place as part of information security governance. The first one is going to be defining objectives and objectives. Another word for that would just be goals. So we need to define our goals. What are these going to be? Because if we don't define a goal or an objective that we don't have something to aim for and to measure up against, we got to have a roadmap.

2:18But we can't have a roadmap if we don't have a destination. So that's what we're setting here with our objectives and our goals. Then we need to create policies because these policies are how the organization feels about certain things. What are their stance on this? And again, I'm going to go back to data privacy because that's so big these days. When it comes to data privacy, how do they feel about it? Is it of not of concern, which of course it is of concern, but we need to define what is that we're concerned about and why do we feel this way as an organization?

2:53So these policies are going to define the stance on key topics. Because these are going to give us some guidance because again, our strategies and oversight need to be in alignment with the organizational goals. Well, these policies are going to be guidance about our goals. Then we need delegating authority. Delegating authority. How does that play into this, Bob? Well, let me tell you, as a manager, we must delegate responsibility.

3:24We can't do everything ourselves. So think about this. We have here our org chart and we've got folks all the way at the top and here and here as we go down the pyramid here and the folks down here in the trenches working in the fields. Well, think about this. If we didn't delegate authority, every single decision that needs to take place down here by the folks who are working with triaging security incidents and such, they would have to send all requests for approval all the way up to the sea level executives and that's going to take time.

4:02We don't have enough time for that to happen. There's not enough bandwidth in the sea level executives day to day routine to handle that. That's why we need to delegate authority so that when there is an infected machine as malicious software on it, the folks who are trained to handle that can make decisions and do that and then report the findings back up the chain. Okay, so that is very important. And lastly, here we're going to talk about monitoring through metrics. So you may be familiar with KPIs or key performance indicators or object and key results, OKRs.

4:39Either way, these are data points. And what we're doing is collecting these data points so that we can see how we 're doing. We don't know if we're doing things right, if we can't measure it. So that's why we need to measure these things through our KPIs and OKRs or whatever you want to call them, these data points. So we need to collect that data so we can analyze it and see, hey, are we doing well? Are we meeting our goals? Because if we're not measuring it, we can't analyze it and identify how we're doing.

5:09That's why we need to measure these and monitor these metrics. So those are four key activities that take place as part of information security governance. So now, let's talk about the purpose of information security governance. So we have activities like information security efforts, part of our programs. We have our business objectives. And you'll notice that these two arrows are pointing in the same direction. That's right. That's on purpose. Because we need to ensure that all of our security efforts align keyword here, align with business objectives.

5:46And I'm going to put slash organizational goals because these are used interchangeably. And you'll hear me reference both of them throughout the course. But the idea is when we have our information security in place and we're creating policies and procedures and we're implementing solutions, we need to make sure that they 're in alignment with our business objectives. If they are not, then we have a problem. Maybe we decide that we're going to do something new. We're going to start performing some new test or something.

6:16Well, if it starts to veer off from our organizational goals, well, then we need to stop because it's not in alignment at that point. We are wasting resources because we need to be in alignment with the organizational goals or business objectives. Very important there. So the primary objective of information and security governance. What is it? What is the primary objective? Just boil it down for me. Bob. All right. Here you go. That right there. CIA.

6:47And it stands for confidentiality, integrity, and availability. That is the primary objective of information security governance is to protect. I'll put that up here. Protect the CIA. And this is not the government agency. We're talking about our confidentiality of our data, the integrity of our data and the availability of our data. Here's why. Confidentiality, it means that our data is kept secret.

7:19Simply means that other folks who shouldn't have access don't have access. We're keeping and maintaining confidentiality of our data. The integrity of our data is the trustworthiness of our data. Can we trust that data? If the answer is no, then we don't need it. And what do I mean by trust? Well, has this data here been manipulated by outside forces? Being bad guys out there, malicious actors, has it been manipulated? Has the data been changed at some point?

7:50Because we must be able to trust our data. Otherwise, it's useless because if our data is not trustworthy and we use it in a process, then the result is going to be untrustworthy results. Garbage in, garbage out. That's how it works. So integrity is very important. And then lastly, availability, our data must be available to use. If our data is not available due to something like maybe a ransomware attack or outages or something, well, then we're kind of at a standstill. We can't access that data.

8:21We can't use it. So it must be available as often as it can be. So this is the CIA triad. Confidentiality, integrity, availability. The primary objective of IS governance is to protect the CIA triad of our organizational assets.

0:00Moving on, information security governance requires several activities. Okay, we're going to talk about some of them briefly. So, for example, we've already mentioned this, defining objectives or goals. We've already talked about it and discussed it, but I'm bringing it up again because it is very important. Then we need to create a strategy, which is going to be a plan to achieve our objectives. Then we need to define security policies.

0:30Because again, our security policy are going to define the organization's stance on various things, such as security. And again, it could be data privacy policy or device use policy or lots of different things. And we're going to go through various different standards. When we talk about that, this is just the beginning. Then we need to adopt standards. And this helps the organization towards consistency. For example, we follow a set of standards so that we have something to measure against and keep us in alignment with those standards.

1:03So the standards are generally a set of best practices that we want to follow. Then we're going to create processes. And these define how activity should be performed. And we're looking for repeatable processes. They're going to be the most advantageous. And then we're going to define controls. And these controls are safeguards. And they're safeguards that are used to detect, avoid, or counteract security risks to an organization.

1:35Think of things like firewalls and antivirus and fences and a barbed wire, maybe at data centers and guards and cameras and all these different things. These are all controls that we can put in place to address certain types of risks. And then lastly, define and analyze metrics. So again, we're back to our KPIs and OKRs. And we need to define what do we want to collect. And then of course we need to analyze the output. We need to do this to make sure that we are succeeding at our efforts.

2:09Because again, if we can't measure it, then we can't analyze it. And we don't know how we're doing. And that's why those are so important. Now, some additional information security governance activities that are specifically aimed at protecting the organization. And these are things we're going to see over and over again as well. And the first one is risk management. And when it comes to risk management, this is a huge part of information security and business in general. And to be honest, we're going to have a whole section on risk management later on.

2:42And in my opinion, information security boils down to one thing. And that's risk management. We do all these other things. We put controls in place. We follow compliances and standards and frameworks. We perform business continuity and disaster recovery. We manage all the things. We collect KPIs, no cars, and we do the analysis. And why? Because we need to control risk. So there's risk management. That was my little spill on risk management. I'm a huge believer in risk management when it comes to information security.

3:14Okay, so next up compliance. So this could be regulatory compliance. It could be legal compliance or contractual compliance. But the idea is we have something we need to be in compliance with. And that being said, we need to be aware that we need to be compliant with something, right? Absolutely. And then we need to monitor this so that we can ensure that we are maintaining our compliance. Then next up, number three here, business continuity and disaster recovery planning.

3:45BCDR. And business continuity and disaster recovery go hand in hand. And here's what it comes down to. Things break. And bad things happen. No matter how much we invest in information security, something at some point will happen. Just the law of numbers. It's just how it works. So this is why business continuity and disaster recovery planning are so important so that when something does happen, we can immediately respond and we can minimize the impact of whatever event happened has on our organization.

4:21We can survive that with minimal impact. That's the goal. All right. And then lastly is resource management. And when we're talking about resources, we're talking primarily about two different things. Number one is budgetary or financial resources. Number two is personnel. Because we only have so many folks working with this, right? There is a limited or a finite resource both monetarily and when it comes to personnel. So we need to manage these things properly.

4:53We need to be good stewards of the resources that we have at our disposal. And we need to ensure that whatever we're doing is in alignment with, that's right, our business objectives or our organizational goals, whichever way you want to look at it. But it needs to be in alignment with that. All right. Let's wrap this up here. Effective information security governance outcomes. There's two of them right here that we're going to talk about. Number one is increased trust. Okay.

5:23And this actually has two subcategories internal and external. So here we're talking about the employees, the folks that we work with, as well as the seed level suite, right? And our board, the board of directors or other boards that we might have working with this. But the idea is if we are practicing information security properly, we're monitoring, we're maintaining, we're planning, we're strategizing, we're doing all the things that we need to do.

5:54Then we're going to gain an increased level of trust from our internal folks here. But also external. Think about business partners and customers. So if a customer comes to you and asks for your most recent audit, well, you're going to be able to provide it to them because you're doing auditing and you're ensuring that you can provide that audit to your customers upon request so they can see for themselves that you are doing security the right way. And again, it's going to increase trust. So that is the first one, increased trust.

6:24The second one down here is improved reputation. And this is as a business or as an organization. So the idea is all these folks out here are going to see that information security is being done right at your organization. And that word will spread and that will provide you with improved reputation. It lets the world know that you've taken a stance on information security. body into it and you're there for the long haul.

0:00Let's talk about information security strategy and let's focus on starting with what is a strategy? Well, it's simply a plan to get where you want to be That's what a strategy is so when it comes down to this and we've already talked about some of the things that come in to Play when defining a strategy. Well, you need to first Define your objective so when put over here and one Define objective or goal and if you think back in the last night We talked about this exact thing a couple of times and then number two you need to identify Where you are today and this is in relation to your goal where you want to end up and then number three You're going to define how to get there and It's the how to get there or how to get to your goal that is going to be your strategy So let's talk about an example here. Let's say you want to become a professional pickleball player And truth be told I've never played it. So I don't know But your goal is to become a professional pickleball player

1:18So you down here you play pickleball let's say a couple times a week you'll go out and you'll play pickleball With some friends and you've actually played in a couple of tournaments and you 've done okay But you've decided you want to be a professional pickleball player. All right. So now we have a goal The goal is to become a professional pickleball player number two. We need to identify where we're at today Well, we know we play periodically. Okay, so we know where we are and We know that we play in some tournaments. Okay, so then number three down here.

1:53We're going to define how to get to the goal So how are we going to do that? Let's talk about it. Well, maybe I'm going to Increase my practice to five times a week and I'm going to start focusing on Doing some exercises for key muscles that are used to get them stronger for my pickleball ventures And then maybe I'm going to play in more tournaments to get exposure to better players. So those three things That's my strategy for becoming a professional pickleball player think about that It's pretty simplified but from this you can kind of see into what you would do When defining a strategy for an information security goal So let's talk about some different tools that you could use to help achieve that goal So some of these tools that are going to be part of your strategy are going to be policies and procedures Better known as P and P So these policies and procedures are going to create the foundation from which our information security program will be built And if you're not familiar with policies and procedures, I did talk about policies before but policies Are basically the organization's stance Well, what they believe in as far as a particular topic and it could it could it could be data privacy

3:08It could be password protection or it could be Asset management it could be the lots of different things, but it's going to be a Non-technical approach to this stance. So I do want to put that. They're generally non-technical So for example, if we had a policy that was a password policy And this policy just basically meant that We as an organization believe you should use secure passwords and we'll follow industry best practices As far as what a secure password means. So right there We kept it pretty generic and non-technical. It just means that we want to use secure passwords in our organization Perfect. Hey, that's a great policy. Now Procedures This is the technical How to when it comes to carrying out our policies. So here It would say on systems We need to configure them to require a password of so many characters in length And maybe it expires every six months or maybe it doesn't expire. It just depends on what industry best practice is So here we have in our policy our kind of generic non-technical stance on something And then in our procedures, that's our how to carry this out

4:24How to take this and put it into production so that we are following policies And that is again is going to lay a foundation From which our information security program is going to be built All right, so that's one. Next is risk assessment program And now i'm going to get back on my soapbox about risk And risk management. So risk management We're going to see this over and over again. It is a key part of any information security program So we really need a dedicated program to risk assessment That's assessing the risk in our organization and that's going to feed into other things that we'll talk about later like risk mitigation and Implementing security controls and things like something called a risk appetite even so again There it's going to be risk assessment baked into our strategy then number three down here We're going to look at implementing security and risk frameworks So when you think of frameworks, I want you to think of a pattern and by a pattern I'm referencing maybe you're creating something you're going to Maybe you're a seamstress or something and you're creating a dress or a shirt

5:40and you follow a pattern Or you're cooking something you follow recipe, which is a pattern You're building something you might follow directions, which is really a pattern But the idea is If we can find a security framework and or risk framework that falls into our organization and how we do business We can use it as a pattern and what do we do with pattern? We end up with repeatability Which is key To business in general we want processes that are repeatable and using frameworks helps us to do that All right, then number four we've got asset management program And this is very important because we have lots of assets in our organizations Maybe thousands and tens of thousands of them or it might be like a hundred or two But the idea is we need to be able to from an information security standpoint Properly manage our assets and think of the assets this way servers Computers workstations laptops Wireless devices iPads, you know tablets all these things phones all of these pieces of technology fall under asset management And it's important that we manage our assets because we need to know

6:56What we have if we don't know what we have we can't protect it Because we need to ensure these devices are securely configured We don't want devices coming in our environment on our networks that are not properly protected So again asset management program And then finally we're going to see this several times our disaster recovery and our business continuity plans and practices Because we know that someday something's going to happen So having a disaster recovery and a business continuity plan that are up to date Is going to help minimize the impact that those events have on our organization

0:00So, as we focus on strategy, we first need to define where we want to be. So, let's answer that question. Where do we want to be? And one of the good ways to do this is to consider choosing a framework of some sort to help us along the way because these frameworks are generally industry standards and they're proven. Okay? And again, think of the framework as a pattern that we can follow. So if I want to go out and take a look at various frameworks, where can I go?

0:32Well, you can just go out and Google frameworks for and then put in your specific industry. Okay? Maybe it's banking or healthcare or financial or whatever it might be. So, let's talk about some common frameworks pretty briefly. So, the first one I want to talk about is from Isaka. And it is the COVID framework. Okay? So, that's one from Isaka. You have ITIL. ITIL has various frameworks such as the IT service management best practices, all right, which is great.

1:06We also have the ISO 27001 right down here that we see the image for and this is focusing on information security management. What about HIPAA? If you're not familiar with HIPAA, it is a framework for protecting healthcare information. And here we're talking about patient data. There's also, put down here NIST 800-53. And NIST is the National Institute for Standards and Technology. And they create hundreds of different standards.

1:38And this is just one of them. And this is focusing on security and privacy controls for information security. And the DOD here in the US, the government and government contractors have to follow this. This is a very popular one. There's the CIS top 20, also known as the SANS top 20. And it outlines the top 20 security controls that you should have in your environment. Another one is PCI DSS. And this focuses on credit card data. So if you handle credit card data, you may have to follow some PCI DSS standards.

2:11And it just depends on the amount of transactions you're dealing with. If you're actually working with credit card data or if it's on your network or maybe it's not even on your network, so you don't have to deal with it. So that's just another one, but that focuses on credit cards. And we're going to discuss these more in depth later on. So don't get too enamored with this right now. It's just the idea that when you're deciding where do you want to be, choosing a framework is a great place to start. Okay?

2:42So moving on. So how do we figure out where we're at? So we know where we want to be. We've chosen something. Let's say we went with the ISO 27001. And that's where we want to be. So how do we figure out where we're at? Because I can't come up with a strategy until I know where I'm at. So how to figure out where we're at? Well we can perform some assessments. You might call them self audits. So assessments are how we're going to figure out where we are at. Okay?

3:12And there's different types of assessments. So there could be risk assessments. Have threat assessments. Compliance assessments. And within a security assessment, in particular, we're talking about things like policies and procedures, standards, guidelines, controls, metrics, insurance, business impact analysis, audit results, all kinds of things. And we're going to get into that. If I don't write it down here, then you don't need to really remember it at this point. We're going to get into that. All right. So we need to know where we're at because then comes the next part, creating a strategy.

3:46But how do we do that? Well, here we go. How do we get to where we want to be? That is going to define our strategy. I love it. So we know where we're at because we just performed some assessments. We know our desired state, which in this instance is ISO 27001. And we performed our assessments over here. That's how we know where we're at. So what we need to do is perform a gap analysis. And a gap analysis simply means, what do I have to do to get from my current state to my desired state?

4:16Do I need to practice pickleball more than two times a week? Do I need to work out more and gain a better strength for pickleballs? Do I need to play more tournaments and against better players? You see where I'm going with this. But as far as information security, what do I have to do to get from my current state to my desired state? And that's performing a gap analysis. And that gap analysis output is going to be our strategy because it's going to give us what we need to do to get from our current state to our desired state.

4:49So let's wrap this up with some key points that we need to adhere to. All right. And there are four of them. Number one is strategic alignment. And when I say strategic alignment, this is all the efforts that you're putting into this. They have to be in alignment with the organizational goals. So in alignment, next up is manage risk. So we've talked about risk several times and risk management is a must for any decision making that happens. You need to identify risk and decide how you're going to deal with it.

5:21So when it comes to identifying our strategy, we need to make sure it's in alignment with our organizational goals. We need to manage risk that could be associated with the steps that we're taking. We also need to manage resources. For example, if ISO 27001 said I need to do XYZ, well, I can't take all the folks working in information security in our company here and put them into creating policies and procedures for XYZ because then they would ignore the regular job.

5:51So again, we have to balance. And when it comes to resources, balance is a key point because you still have to maintain your current status quo, but you're also looking to improve and strategize and grow. So you need to balance your resources. And then lastly, we've got to measure performance because if you're not measuring it, then we cannot see how we're actually doing it. We've got to collect that performance data. Then we have to analyze that performance data so that we can make sure that we are actually making progress.

6:23So there you go. These are some key points to adhere to when it comes to your information security strategy.

0:00In the last nugget, we talked about strategy. And the first thing you need to do is go ahead and set your objectives. What's your goal? Where do you want to be? And one of the ways to do that was choosing a security framework. And I had mentioned some in the last nugget and I said, we were going to go into detail on them. And that's what we're doing today. All right. Let's get started. The first one we're talking about is COVID. And COVID is from Isaka, which you should definitely know. And it's an IT management framework. And it focuses on IT processes, not only security processes.

0:34So it's not just security. It's also IT. So that's the first one. The second one is our ISO, IEC 27001 for information security management. And this focuses on the continual improvement of your information security program. And it focuses a lot on risk management, which is a huge part of information security as you already know. And its requirements are pretty generic actually. So it can be used in a lot of different environments.

1:06And that's why it's so popular. It's because it's not super focused on one industry. All right. Moving on, here we have ITIL, not ISO, IEC 20,000. And ITIL was who created it. And now ISO, IEC manages it. And this is a framework that focuses on the IT management processes. And this is actually a process framework, not security specific. So it's really focusing on IT and not necessarily IT security.

1:41But it does help us to create a solid foundation within IT and its processes from which your security program can grow. So it's really focused on IT and not so much on security. Next up is HIPAA. And this is our Health Insurance Portability and Accountability Act. And this is within the US and it covers the protection of EPHI. So put that down, EPHI. And that is electronic protected health information. And so what does that mean?

2:13Well, we're talking about patient data. So when you're dealing with medical systems like electronic medical records and electronic health information systems, EMRs and EHIs, what those are doing is they're basically using patient data within them. And the doctors use these systems to track into input data and to create reports and such, but they're in electronic format. So we're moving away from the paper. Now HIPAA still protects the idea of all protected health information.

2:47It's just that EHI is just a newer form of that. So HIPAA still does protect your paper records no matter what format your health information is in HIPAA protects that. That's what it's there for. So that means all the health care providers out there, hospitals, clinics, physical therapy offices, dentists, eye doctors, health insurance providers, anybody that deals with patient information, they must abide by HIPAA within the US. And that includes other companies too, like there's document management companies where let's say a hospital will take their paper records and they will send them to an imaging facility where a company will digitize those images and then send them back.

3:33Well, guess what? This company down here, this imaging facility, they must follow HIPAA because they're managing patient information. So that is HIPAA moving on. We've got the NIST 853 and this is the security and privacy controls for federal information systems and organizations. So I'm going to put it over here, federal and US. Okay. So here in the US, our federal, meaning all government agencies have to follow in NIST 853 and it's security and privacy controls.

4:09So all the US government agencies have to follow this. All the US Department of Defense or DOD contractors, they have to follow this. And it contains 18 different categories of controls. So it could be things like standard configuration, asset management, disaster recovery, all these different things fall under these categories. So if you're dealing with the federal space, then you're going to want to look at it. NIST 853. Next up is our NIST Cybersecurity Framework and this being the National Institute for Standards and Technology created a cyber security framework.

4:47And this is a risk based framework. And it's used to identify, assess and manage cyber risks. So again, it's really looking at risks. It focuses on using business drivers to guide cybersecurity activities, including risk management and it focuses on identifying, protecting, detecting, responding and recovering, all that falls within that NIST Cybersecurity Framework.

5:17Next up, we have right here, CIS Top 20, AKA, I'll put up here, AKA, SANS Top 20. That's just kind of a nickname and you'll see it. So if you see Top 20, that's probably going to be this information. And this is the Top 20 Security Controls and Organizations Should Use. So this includes things like your inventory control. So you got inventory of your hardware and your software, vulnerability, management, controlling administrator privileges, secure configurations, data recovery and data protection, malware defenses.

5:52I mean, the list goes on and on. You can just Google the SANS Top 20 or the CIS Top 20. All right. And we're going to wrap this up with the PCIDSS. That's our payment card, industry data security standard. And this is dealing with credit cards and their data. This standard is aimed at the protection of that credit card data and compliance with PCIDSS is mandatory for all organizations that store, process or transmit credit card data. So that is store, process or transmit.

6:25That's our credit card data there. And compliance requirements change based on the number of transactions or the amount of credit card data that is stored. So it's going to be different from company to company. So those are some of the more common security frameworks that you should be familiar with.

0:00So we talked about an information security strategy and how to come up with that strategy because you identify what our goal is or objective We're right now. We perform the gap analysis and we have our strategy. All right, so let's talk about managing our strategic objectives Because we can't just say we have these objectives and we come out and we say we're doing number one and two and three and four And you know the list goes on on We can't just go out and blindly do that because we need to make sure that each step along the way is the right step And we're doing it the right way Because we know that we have risks involved with all kinds of things So we need to be mindful one of the tools that we can use is called SWAT Analysis and SWAT stands for strengths weaknesses opportunities and threats So let's talk about how we go about doing this. So a SWAT analysis is a tool that we use for strategy planning and It's used to study a specific area of an organization or a step that you're going to take and determine it's well It's SWAT So we do SWAT to analyze individual processes or steps that we're taking so let 's kind of go through this process here

1:15So let's say we want to perform a SWAT analysis for I'm gonna put over your cloud security Okay, because in the last year we have moved a few of our services from on premise up into the cloud So let's go ahead and take a look at performing a SWAT analysis of cloud security for our organization Excuse me a simple little walkthrough. So we're starting with strengths So there we go Strengths our strengths is that we have cloud engineers on staff. So we have Engineers that is a strength. So we have the technical ability and know-how to properly manage our cloud environment Okay, and we have off cloud backups and this simply means that our backups are not stored in the same cloud vendor as our data So they're being secured somewhere else, which is good. It's definitely a strength now Let's talk about weaknesses. Well, our weaknesses is that we don't have a security program specific to the cloud So we say no cloud Security program, okay, that is definitely a weakness Because we simply don't have any security policies about the cloud either. So

2:33that's something we need to consider Let's talk about opportunities So when it comes to opportunities, these are here to help us strengthen whatever we're analyzing with SWAT And so in this instance, what can I use to help me strengthen? My cloud security stands. Well, I could adopt the framework. So what I'm gonna put down here is ISO 27 17, okay, and this is a framework about security controls in the cloud. So I'll put down here cloud Sick framework. This is definitely an opportunity that I can use to help me get to where I need to be as far as cloud Security and lastly threats. Let's put some threats in here that we need to be concerned with now The first one I'm gonna put is misconfigurations and that's due to human error.

3:25Okay, that's definitely one and Because we don't have a security program aimed at the cloud We're not gonna be able to identify and fix these errors that are here and they could lead to a security incident or even a security breach So this is how we go about performing a SWAT So here we see that if we take advantage of our opportunity here and we were to implement that ISO 27,017 and become compliant with that it would really change the way that our cloud security looks compared to what it looks like today So this would become part of our strategy then because as part of our strategy for obtaining cloud security We're going to implement ISO 27,017 and become compliant with it and it's at that point that we can then go and perform another SWAT analysis on the same situation where our strength would have appear ISO 27,017 compliant so then we could see that our weaknesses would change because we would have a secure cloud program We would be able to identify misconfigurations and you'll see how this goes. We 're continually looking to improve upon our cloud security in this instance

4:42All right, so that is one tool that we can use that is called the SWAT analysis another tool is our CMM capability maturity model and what this is it is right here a scale of maturity So let's take a look at this and we'll stick with the idea of our cloud security that we don't have at this point in time in our Organization so this right here our CMM helps us understand the maturity of a process on a scale of one to five So you see here we have the one is initial two is repeatable three is defined Four is managed and five is optimized so each one of these mean something different obviously So level one is initial and that means that the process is in consistent It's not being measured and it's not repeatable. So it's basically our cloud security at this point So we could put cloud security and if we had set processes up around it it would be at initial It would simply mean that we are in the infancy of this process and as we grow We want to get up to number two which is repeatable so that we can repeat the process we can consistently perform Our process with the same outcome and then if we get to two then we look to

6:01jump up to number three And this is where it is defined. It's well defined and well documented So that means we are not only able to reproduce it so it is repeatable But we also have documentation we have processes and procedures defined and then as we grow at this point with managed We add in metrics Okay, and that helps us to then we can monitor and we can analyze those metrics and make sure that we are doing things right And then lastly five is optimized and this is the idea of continuous improvements being made All right, and so down here I'm gonna put documentation for number three all right super so one thing you should understand is that not all Processes will make it appear to optimize and that's okay The idea is we want to continuously improve and if we can get to where we're having metrics and we're managing it Then that's pretty good But sure we shoot for five but we won't always make it there and it's just how it is So this model helps us to see where we're at and what we need to work on so let 's talk about next up our road map development This is another tool and if you've seen this if you've done anything with project management You know, this is a Gantt chart GAN double T and the idea is as part of our

7:20roadmap development with our strategy We can outline our steps with our strategy So we've got our steps here and this is where we're listing them out on our road map so that we can visualize and track our Progress and usually it is based on a timeline like we see here We have days of the month here and we see each step is associated with a specific time Okay, and this here that you see again is a Gantt chart And that's one way to use this again It just helps us to visualize and track progress towards whatever our objective is so road map development is another tool that we can use as far as Making sure that we're making progress with our strategy and we're able to track it and visualize it as well So these are some different tools that can help us along with our strategic objectives

0:00Welcome to the business model for information security, aka BMIS, and it is created by Iseca. And this is a guide for, I'm going to put up here in quotes, business-oriented approach. As far as an information security program goes, and it really focuses on the culture of the organization. So again, culture comes back into play in the first nugget in this skill we talked about the importance of culture. Now we're coming full circle back to the BMIS, which is really focused on culture. So let's talk about what we have here. So this is a diagram of the BMIS, and it uses a three-sided model like a pyramid defining four key elements. So up here at the top, we have organization, then over here in the bottom left, we have people, bottom right, we have technology, and then in the middle, we have process. So let's talk about these four things here. Now organization, this focuses on the organization as a whole, and how all the roles work toward a common goal.

1:09So all the roles here work toward again a common goal. Then when it comes to the people, well, these are the employees, the contractors, the consultants, all the people involved in reaching, that's right, the goal. And again, the culture here, we're focused on achieving the organization's goals. We have our technology in the bottom right here, and technology is simply a tool. It's the people and the processes using these tools that make them valuable in reaching our goals. And then finally, in the middle, we've got our process, and this is all the activities within the organization that help us to achieve. That's right, our goal. And our processes in here should be reliable and repeatable. And if you think back, we talked previously about the capability maturity model. And one of the things was in there, as you go through the levels from level one to level five is the repeatability of processes. And that's where we see this in the BMIS as well.

2:19So now we see each of the four key elements we notice here, that we have them all interconnected, and this is through DIs or dynamic interconnections. And each of these connections are how interaction between the four key elements works. So for example, between organization and the people, we have culture. Here's that word again. And then between organization and down here to technology, we have architecture, because we have to ensure that that technology there fits in with our architecture of our organization. Then between organization and our process, we have governing or governance, because we need somebody to watch over the processes to make sure that they're meeting our needs. Between people and technology, we have human factors that we need to take into account between people and process, we have emergence, and then between process and our technology, we need to make sure that they're enabled and we have support. So moving on, BM IS, it focuses on organizational culture. I'm really trying to drive this home. I want you to

3:38think, whenever you see BMIS, I want you to think culture, because that's really what it's focused on. The culture is the spirit of the organization. It's what drives the organization. And when it comes to BMIS, the primary objective of it, that's the number one objective over here, is to find out how to influence culture. Because if we can find out how to influence the culture, we can then steer it towards a security-based culture. And that would be beneficial for everyone.

4:14All right, now there are three key aspects of the BMIS. And the first one is alignment of information security with business objectives. And we've been saying this since the very beginning of this course that everything we need to do needs to be in alignment with the business objectives. Number two, it uses a risk-based approach. So risk is being taken into account as you go through and use the BMIS. And then lastly, it's a balance across the organization. And that means across the four key elements of the BMIS. So remember, we had appeared organization, we had people, we had technology and process in the middle. And we need to balance so that we can all work together to reach our goals. So finally, the $10 million question, why use BMIS? Well, it used to help better understand people, processes and technology. And what factors influence them so that you can influence culture. And again, it goes back to influencing culture. And knowing

5:34this, the business can drive the response they're needing to achieve their goals. And so well, that's BMIS in a nutshell.