Archive for category Information Risk Management

Within our earlier posts we have discussed how we need to focus on information security from the information risk management approach; but, now you are probably wondering how can Information Risk Management (IRM) work with my job requirements to ensure the organization’s security of information is appropriate and complete. An Information Risk Management approach gives you a strong foundation to build upon.

Maybe you are an organization that is dealing with a risk which potentially could cause the organization irreparable harm or even organizational failure. Maybe your organization has to comply with a variety of regulations from SOX to PCI DSS v2 and you are worried about the ever increasing costs of completing all of the audits. This is where Information Risk Management can not only increase the value of information security but also assist the organization in reducing the cost impact of meeting these regulations.

Let’s use the current discussion regarding mobile systems’ tracking of location information as one which could potentially cause irreparable harm to the organization. Through IRM we can determine the level of concern we have with respect to the real issue at play within our overall information security control structure. In effect we are using an information focused approach to determine where the organization needs to focus our controls and testing efforts. If we deem the mobile data a critical component of the business processes then we can implement appropriate security over our systems based on the information criticality. Our risk analysis should be ready to define the impact, the potential control failure/requirements and then finally the level of controls which should be implemented as an organization.

During the controls review there are several areas of concern which may be critical to demonstrating effective controls. Some control dynamics that come to mind are: the concept of corporate liable vs. individual liable ownership of the services and the hardware. Have you looked at the solution from the perspective of hardware independence? Have you investigated the solution from a perspective of software independence, ownership of device and what level of controls would be required with respect to the possible approaches to reducing the potential risks related to these various approaches. This is where the information security, internal auditing teams and business teams can integrate to provide real consulting approaches to reduce the risk impacts.

Does this risk management and the resulting development of appropriate controls process state that an organization should not allow these devices within their organization – no; but what it does provide is a foundation on which a management decision can be made with respect to the level of appropriate or inappropriate use of the technology within the enterprise.

Information Risk Management (IRM) can be the foundation for not only point in time management decisions; but, it can also be used to assist in the determination of what overall information controls are required to meet global control standards such as PCI, Sarbanes Oxley, ITIL, SSAE 16, etc.. Many of these standards while specific in their own right are also based on or derived from similar standards and through using the Risk Identification and Analysis approach. Management can define what controls are important to the various standards and further the level of import each of the controls. Using a control centered on the requirement to complete a Business Impact Analysis (BIA) and then the related Business Continuity Plan (BCP), we can see certain standards dictate this as a critical requirement as it drives to the ability of the organization to meet customer requirements and recover their systems within an effective timeframe. Other standards may look at the ability of the organization as a whole to recover and be a functioning entity in the event there is a situation requiring the enacting of the BCP plan. Here again we are using IRM to build the foundation necessary to allow a management decision around the level of control focus and impact of the control with respect to the intent of the standard(s) which the organization is measuring against.

Note that the ultimate goal of both scenarios discussed above is the development of support for a management decision and not an information security decision. In effect we are using Risk Management to drive our information security control solutions and through using a risk based approach we have minimized management’s typical negative approach toward Information Security. In effect we are providing a consultative approach to focus management support for the application of information security controls from the beginning of the solution to the end of the solution.

While I am certain many information security experts might look at these scenarios and say the issues are not decisions of management; but, decisions which are typically focused strictly under the purview of the information security umbrella and the organization must follow their guidance. Taking the information security only approach is a very short sighted approach and further provides additional justification for the development of a role focused upon Information Risk Management – the Chief Information Risk Officer (CIRO).

Today’s world is full of risks and we all recognize that management of risks is a key component of everyday life.  But in my experience I have found many of us in the technology field who do things just because someone has told them they should do it.  Let’s take an example – how many of us in technology have applied an application patch because the vendor stated we should do it?  Now many of you reading this article are probably saying, of course, I am applying the patch – the vendor says I should apply the patch.

So in thinking about your response, I would suggest to those of you who have this approach to step back and think about the situation from another perspective.

Let’s review the situation a little more in depth, the application you have applied the patch is a critical enterprise application which is critical to the organization’s daily business.   Because the “vendor” says you should apply the patch you have applied
the patch to the organization’s production environment per the vendor’s recommendation without testing the patch in the test environment.  And of course the patch has “broken” something else within the application which is critical to the use of the
application.

How many of us have done just this?  You can count me in your answer – I have done this and now I know it is
not the best approach.

Why did I paint this picture? I painted this picture to get us all into the same frame of mind and to get each of you to think about this situation from the following perspective:

“What really is Information Risk Management and why we in technology need to continue to expand our approach and thoughts with respect to Information Risk Management.”

Many in the technology industry say the continual evolution of technology is creating a society which is devoid of anyone who does not have a technological perspective from birth and they will just understand the risks associated with technology and further our online society.  I would counter that perspective to point out that as technology continues its evolution we as IT security experts should be ever more focused on the information risk management side of the coin and limit our focus on the technology side of the coin.  Information risk management should be the foundation of all of our information security efforts.  I purport that information risk management is the driver of all of our ultimate decisions.

Think about the scenario above and apply the foundation of information risk management – how would your approach change using information risk management to look at this scenario?

What’s your next move?

I look forward to our next discussion!