Information Security Governance Guide

It is not enough to have some security policies and then just concentrate on securing your network. To integrate security within business processes, an organization needs to have a robust information security program that maps to its business drivers, legal and regulatory requirements, and threat profile. The following series provides an introduction to what information security governance and a security program are and how to get them deployed within any environment.

What is information security governance?
Information security governance is similar in nature to corporate and IT governance because there is overlapping functionality and goals between the three. All three work within an organizational structure of a company and have the same goals of helping to ensure that the company will survive and thrive – they just each have different focuses.

Corporate governance has to do with how the board of directors and executive management run and control a company. IT governance is how technology is used and managed so that it supports business needs. There are many professional and official sounding definitions of information security governance such as the following by the IT Governance Institute in its Board Briefing on IT Governance, 2nd Edition:

"Security governance is the set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately and verifying that the enterprise's resources are used responsibly."

This definition is correct, but remains at a high level that is difficult to understand and implement. This definition is more like a strategic policy statement, and the real skill is to properly interpret and transform it into meaningful tactical and operational functions and practices.

Information security governance is all of the tools, personnel and business processes that ensure that security is carried out to meet an organization's specific needs. It requires organizational structure, roles and responsibilities, performance measurement, defined tasks and oversight mechanisms. This definition isn't much better, is it?

Let's compare two companies. Company A has an effective information security governance program in place and Company B does not. Now, to the untrained eye it would seem as though Company A and B are equal in their security practices because they both have security policies, procedures, standards, the same security technology controls (firewalls, IDS, identity management, etc.), and they both have security team runs by their security officers. You may think, "Man, these two companies are on the ball and are evolved in their security program." But if you look closer you will see the critical differences.

Many organizations today have many of the pieces and parts to a security program (policies, standards, firewalls, security team, IDS, etc.) but the management is not truly involved, and security has not permeated throughout the organization. Instead these pieces and parts are the responsibility of a small security team that is charged with making sure that security happens properly throughout the whole company – which is close to impossible. If security was just a technology issue, then this security team could properly install, configure and maintain the products, and the company would get a gold star and pass the necessary audits with flying colors. But as a security professional, you need to understand that security must be implemented throughout the organization, and having several points of responsibility and accountability is critical. Information security governance is a coherent system of integrated security components (products, personnel, training, processes, policies, etc.) that exist to ensure that the organization survives and hopefully thrives.

INFORMATION SECURITY GOVERNANCE GUIDE

  What is information security governance?
  Key elements when building an information security program
  Steps in the security program life cycle
  Developing a security program using SABSA and ISO 17799

About the author
Shon Harris, CISSP, MCSE, is the president of Logical Security, a security consultant, a former engineer in the Air Force's Information Warfare unit, an instructor and an author. She has authored two best selling CISSP books, was a contributing author to the book, Hacker's Challenge, and a co-author to the book Gray Hat Hacking. Shon was recognized as one of the top 25 women in the Information Security field by Information Security magazine. She is currently writing her third edition of her first book and developing a full security book series, which will be brought to the market this year.