Security Program: How To Thrive?

From struggling or hardly surviving, to a fully supervised and manageable security program…

Most companies are struggling with running an smooth security program. No matter how much they are spending on that, the difference is really not that much. From zero budget to million dollars security budgets, they still do not have enough trust in their security program. Regardless of how much they are spending on security initiatives, they never really have confidence and are not expected to see positive and reliable result of their investment.

Adversaries are finding new ways to hurt online businesses every single minutes while tech gurus are creating “solutions” to address today’s challenges within months, years and sometimes decades after the fact!

We simply are only trying to survive in cyberspace, but what could we do better to thrive, in a stronger position, where the security is not a hassle anymore, and it should not be the heart of the matter too. Let’s look at some practical countermeasures:

* stick to a management system

For a moment forget about technology and tools and get back to basics. A management system could totally fulfill whatever you need in terms of handling processes and not being worried about base of your operation. You can invent the wheel again or you can choose from thousands of management systems, but first ask experts which system fits your needs or bring professional on-board to implement a system fully customized to your work flow from scratch, also believe me, without a management system of any kind and approach, you will be still at the first step after years spending your precious time, which is that “surviving” approach.

* set objectives

any project has a set of goals which are measurable and achievable. Objectives are neither like: having a more secure network…or, setup RDP filtering on firewalls…there are more like reducing current number of entry points to network…or, assessing current remote protocol insecurities…

objectives help you better understand what are trying to get from your management system, and where resources have to be focused. This topic is also related to Risk approach which I think is the fundamental and background of the management system.

* constantly measure

These are checkpoints where you can tell precisely and by evidence if you are on the track, and the more you measure and automate the process, the more you get close to a proactive system and faster accomplishing each of objectives. Through measurement you can tell of direction is write or wrong, or what is wrong or right.

* plan for corrective and preventive actions

with each measurement you need to define corrective actions if the result is not expected or the pace is slow, and the plan to enforce these corrective actions is the key to a smooth security program, otherwise you will be struggling with past actions while new ones arrive.

* be responsive to facts not fictions

computer security industry is full of fictions, and we mostly spend time and money on things which are either not important or can be tackled from root, so let me give you an example:

taking Advil when
you catch flu is just a pain killer, only for passing time without
suffering from flu symptoms, just to survive, because we do not know
how to handle flu virus in 21st century (or maybe we know
but we don’t want to disclose?!), and that is similar to running a
virus scan on your network when you get a virus infection!

Cyber security facts have not been changed since the beginning of this subject in human history, so once you know about the facts you see how it is easy to address them without Advil!

ISO 27001 Audit Tips and Tricks

the easy way to maintain an effective, low cost and smart ISO 27001 security management system

ISO27001/ISO27002: A Pocket Guide
Information is one of your organisation’s most important resources…

Even though there is no magic behind auditing a system based on ISO 27001, there are simple tricks which help you handle ISO 27001 or many other similar standards and frameworks, both as and auditor and auditee.

I would point only at one single tip if I wanted to direct you to just one important aspect of ISO 27001, and that is “Links”. The connection between different parts of standard is the key to kingdom! Understanding this key makes you super strong either as an auditor or as an auditee.

There are certain connections between different Clauses or even different Controls. Majority of ISO 27001 standard element are linked together and this simple means, as long as you follow links, you will reach a final destination for sure which is the flawless system with no broken links.

Main links are from relationship between SoA, Risk, Asset and Access

Links are important because if Clauses, Documents, Policies, Controls…are not connected and consistent, you will be noncompliance ultimately. No matter how hard you try to have a comprehensive, beautiful, technical…set of policies, ignoring links is a reg flag for any experienced auditor, they simply see the effect right away and after that all system looks synthetic!

Main links are between SoA, Risk, Asset and Access. These are foundations and without proper linkage, there is no way to maintain a healthy, consistent, auditable ISO 27001 security management system. Start with SoA, that document is not an index or table of contents! Flow from SoA to Risk Assessment, vice versa and multiple times until all controls has justification. Never compile Asset policies without conducting demonstrating and understanding the links with higher SoA and Risk, and then jump into Access as the baby and outcome of first 3 document.

As an auditor you should always look for broken links because also analysing and accepting a subject without finding conceptual link with other topic is nothing more than ignoring the main purpose of standard, which is a solid management system, not a set of individual files and unclear processes.

As an auditee try to find your broken links prior to audit. This does not require internal audit at all. This is more and more reviewing your key documents by someone who understand the links and concepts, not just memorizing Clauses.

Remember after having a system flawless of broken links, you have already started the easy way to maintain an effective, low cost and smart ISO 27001 security management system, something which has the potential to make money for your business rather than a hassle and expense.