Principles of Information Security

Seventh Edition

Chapter 3
Planning for
Security

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website for
classroom use.
 Learning Objectives (1 of 2)
• Upon completion of this material, you should be able
to:
– Describe management’s role in the development,
maintenance, and enforcement of information security
policy, standards, practices, procedures, and
guidelines
– Explain what an information security blueprint is,
identify its major components, and explain how it
supports the information security program

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Learning Objectives (2 of 2)

– Discuss how an organization institutionalizes its

policies, standards, and practices using education,
training, and awareness programs
– Describe what contingency planning is and how it
relates to incident response planning, disaster
recovery planning, and business continuity plans

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Introduction

• Information security program begins with policies,

standards, and practices, which are the foundation
for information security architecture and blueprint.
• Coordinated planning is required to create and
maintain these elements.
• Strategic planning for the management of allocation
of resources.
• Contingency planning for the preparation of
uncertain business environment.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Introduction

InfoSec management oversees a specialized program,

and certain aspects of its managerial responsibility are
unique. These unique functions are known as “the six
Ps”:

1. Planning
2. Policy
3. Programs
4. Protection
5. People
6. Project management

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 1- Information Security Planning
• Planning levels help translate an organization’s strategic
plans into tactical objectives.
• Planning and the CISO
The business strategy is translated into the IT strategy. The
strategies of other business units and the IT strategy are then
used to develop the InfoSec strategy. Just as the CIO uses
the IT objectives gleaned from the business unit plans to
create the organization’s IT strategy, the CISO develops
InfoSec objectives from the IT and other business units to
create the organization’s InfoSec strategy.
⁃ Tactical plans, planning
⁃ Operational plans, planning

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Information Security Planning

Strategic planning and corporate responsibility is best

accomplished using an approach industry refers to as
governance, risk management, and compliance
(GRC).

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Governance
– Governance:
▪ Set of responsibilities and practices exercised by the board and executive
management
▪ Goal to provide strategic direction, establishment of objectives, and measurement of
progress toward objectives
▪ Also, verifies/validates that risk management practices are appropriate and assets are
used properly.
▪ Corporate governance: Just like governments, corporations and other
organizations have guiding documents—corporate charters or partnership
agreements—as well as appointed or elected leaders or officers, and planning
and operating procedures. These elements in combination provide corporate
governance.
▪ Information security governance: Each operating unit within an organization
also has controlling customs, processes, committees, and practices. The
information security group’s leadership monitors and manages all organizational
structures and processes that safeguard information. Information security
governance then applies these principles and management structures to the
information security function.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Governance Outcomes

• Information security governance outcomes

– Five goals:
▪ Strategic alignment
▪ Risk management
▪ Resource management
▪ Performance measurement
▪ Value delivery

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Figure 4-1 Information security
governance roles and responsibilities

Source: This information is derived from the Corporate Governance Task Force Report, “Information
Security Governance: A Call to Action,” April 2004, National Cyber Security Task Force.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 2- Policy as the Foundation for Planning

• Management from communities of interest must

make policies the basis for all information security
planning, design, and deployment.
• Policies direct how issues should be addressed and
technologies used.
• Policies should never contradict law, must be able to
stand up in court, and must be properly
administered.
• Security policies are the least expensive controls to
execute but most difficult to implement properly.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 2- Information Security Policy, Standards,
and Practices
• Policy functions as organizational law that dictates
acceptable and unacceptable behaviour within an
organization.
⁃ Policies direct how issues should be addressed and how technologies
should be used.
⁃ Policies do not specify the proper operation of equipment or software—this
information should be placed in the standards, procedures, and practices of
users’ manuals and systems documentation.

• Standards: more detailed statements of what must

be done to comply with policy.
⁃ De facto standard: A standard that has been widely adopted or accepted by
a public group rather than a formal standards organization.
⁃ De jure standard: A standard that has been formally evaluated, approved,
and ratified by a formal standards organization.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 2- Information Security Policy, Standards,
and Practices
• Practices: Examples of actions that illustrate
compliance with policies.
• Procedure: Step-by-step instructions designed to
assist employees in following policies, standards,
and guidelines.
• Guidelines: Nonmandatory recommendations the
employee may use as a reference in complying with
a policy.
• For a policy to be effective, it must be properly
disseminated, read, understood, and agreed to by all
members of the organization, and uniformly enforced.
Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Figure 4-2 Policies, standards,
guidelines, and procedures

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Management must define three types of security
policy, according to SP 800-14 of the National
Institute of Standards and Technology (NIST):
• Enterprise Information Security Policy (EISP)
• Issue-specific Security Policies (ISSPs)
• Systems-specific Policies (SysSPs)

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Enterprise Information Security Policy (EISP) (1
of 2)
• Sets strategic direction, scope, and tone for all
security efforts within the organization
• Executive-level document, usually drafted by or with
chief information officer (CIO) of the organization
• Typically addresses compliance in two areas:
– General compliance to ensure meeting of
requirements to establish program and assigning
responsibilities therein to various organizational
components.
– Use of specified penalties and disciplinary action.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Enterprise Information Security Policy (EISP) (2
of 2)
• EISP Elements should include:
– Overview of the corporate security philosophy
– Information on the structure of the organization and
people in information security roles
– Articulated responsibilities for security shared by all
members of the organization
– Articulated responsibilities for security unique to each
role in the organization

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Table 4-1 Components of the EISP (1 of 3)

Component Description
Answers the question 'What is this policy for?" Provides a framework that
helps the reader understand the intent of the document. Can include text
such as the following: This document will:
• Identify the elements of a good security policy
• Explain the need for information security
• Specify the various categories of information security
• Identify the information security responsibilities and roles
Statement of • Identify appropriate levels of security through standards and
Purpose guidelines
This document establishes an overarching security policy and direction
for our company. Individual departments are expected to establish
standards, guidelines, and operating procedures that adhere to and
reference this policy while addressing their specific and individual
needs."

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Table 4-1 Components of the EISP (2 of 3)

Component Description
Defines information security. For example:
"Protecting the confidentiality, integrity, and availability of
Information Security information while in processing, transmission, and storage,
Elements through the use of policy, education and training, and
technology ..."
This section can also lay out security definitions or philosophies
to clarify the policy.
Provides information on the importance of information
Need for Information security in the organization and the legal and ethical
Security obligation to protect critical information about customers,
employees, and markets.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Table 4-1 Components of the EISP (3 of 3)

Component Description

Defines the organizational structure designed to support

Information information security within the organization. Identifies
Security categories of people with responsibility for information
Responsibilities security (IT department, management, users) and those
and Roles responsibilities, including maintenance of this document.

Lists other standards that influence this policy document and are
Reference influenced by it, perhaps including relevant federal laws, state
Standards laws, and other policies.
to Other Information
and Guidelines

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Issue-Specific Security Policy (ISSP)
(1 of 3)
• The ISSP: These are sets of rules that define acceptable
behavior within a specific organizational resource, such
as e-mail or Internet usage. As an organization supports
routine operations by executing various technologies
and processes, it must instruct employees on their
proper use.
– Addresses specific areas of technology
– Requires frequent updates
– Contains a statement on the organization’s position on
a specific issue.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Issue-Specific Security Policy (ISSP)
(2 of 3)
An ISSP may cover the following topics, among others:
• E-mail
• Use of the Internet and World Wide Web
• Specific minimum configurations of computers to defend against worms and
viruses
• Prohibitions against hacking or testing organization security controls
• Home use of company-owned computer equipment
• Use of personal equipment on company networks (BYOD: bring your own
device)
• Use of telecommunications technologies, such as fax and phone
• Use of photocopy equipment

• Three common approaches when creating and managing ISSPs:

– Create a number of independent ISSP documents
– Create a single comprehensive ISSP document
– Create a modular ISSP document
Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Issue-Specific Security Policy (ISSP)
(3 of 3)
• Components of the policy:
– Statement of policy
– Authorized access and usage of equipment
– Prohibited use of equipment
– Systems management
– Violations of policy
– Policy review and modification
– Limitations of liability

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Table 4-2 Components of the ISSP (1 of 4)

• Statement of policy
― Scope and applicability
― Definition of technology addressed
― Responsibilities
• Authorized access and usage of equipment
― User access
― Fair and responsible use
― Protection of privacy

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Table 4-2 Components of the ISSP (2 of 4)

• Prohibited use of equipment

― Disruptive use or misuse
― Criminal use
― Offensive or harassing materials
― Copyrighted, licensed, or other intellectual property
― Other restrictions
• Systems management
― Management of stored materials
― Employee monitoring
― Virus protection

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Table 4-2 Components of the ISSP (3 of 4)

― Physical security
― Encryption
• Violations of policy
― Procedures for reporting violations
― Penalties for violations
• Policy review and modification
― Scheduled review of policy procedures for
modification
― Legal disclaimers

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Table 4-2 Components of the ISSP (4 of 4)

• Limitations of liability
― Statements of liability
― Other disclaimers as needed

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Systems-Specific Security Policy (SysSP) (1 of 3)

• SysSPs often function as standards or procedures

used when configuring or maintaining systems.
• SysSPs fall into two groups:
– Managerial guidance
– Technical specifications
• Access control lists (ACLs) can restrict access for a
particular user, computer, time, duration—even a
particular file.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Systems-Specific Security Policy (SysSP) (2 of 3)

1- Managerial guidance SysSPs

is created by management to guide the implementation and configuration of technology
and to address the behaviour of employees in ways that support information security.
For example, while the method for configuring a firewall belongs to the technical specifications
of SysSP, the firewall’s configuration must follow guidelines established by management. An
organization might not want its employees to access the Internet via the organization’s
network, for instance; in that case, the firewall should be configured accordingly.

2- Technical specifications SysSPs

to create a policy to implement the managerial policy. Each type of equipment requires
its own set of policies, which are used to translate management’s intent for technical
control into an enforceable technical approach.
For example, an ISSP may require that user passwords be changed quarterly; a systems
administrator can implement technical control within a specific application to enforce this
policy. There are two general methods of implementing such technical controls: access
control lists and configuration rules.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Systems-Specific Security Policy(SysSP) (3 of 3)

• Configuration rule policies govern how a security

system reacts to received data.
• Many organizations create a single document that
combines the managerial guidance SysSP and the
technical specifications SysSP.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Defensible Policy
For policies to be effective and legally defensible, the following must
be done properly:
1. Development—Policies must be written using industry-accepted
practices and formally approved by management.
2. Dissemination—Policies must be distributed using all appropriate
methods.
3. Review—Policies must be readable and read by all employees.
4. Comprehension—Policies must be understood by all employees.
5. Compliance—Policies must be formally agreed to by act or
affirmation.
6. Enforcement—Policies must be uniformly applied to all
employees.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Policy

- Like any major project, a policy development or

redevelopment project should be well-planned, properly
funded, and aggressively managed to ensure that it is
completed on time and within budget.

- One way to accomplish this goal is to use a systems

development life cycle (SDLC).
⁃ Investigation Phase
⁃ Analysis Phase
⁃ Design Phase
⁃ Implementation Phase
⁃ Maintenance Phase
Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Policy Management

• Policies must be managed as they constantly

change.
• To remain viable, security policies must have:
– A responsible manager
– A schedule of reviews
– A method for making recommendations for reviews
– A policy issuance and revision date
– Automated policy management

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 3- Information Security Programs

• InfoSec operations that are specifically managed as

separate entities are called “programs.”
• An example would be a security education, training, and
awareness (SETA) program or a risk management
program.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Security education, training, and awareness
(SETA) program
Once your organization has defined the policies that will guide
its security program, it is time to implement a security
education, training, and awareness (SETA) program.

• Everyone in an organization needs to be trained and made

aware of information security, but not everyone needs a
formal degree or certificate in information security.

• Security training provides employees with detailed

information and hands-on instruction to prepare them to
perform their duties securely.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Security Education, Training, and Awareness
Program
• Once a general security policy exists, implement a security
education, training, and awareness (SETA) program.
• SETA is a control measure designed to reduce accidental
security breaches.
• The SETA program consists of security education, security
training, and security awareness.
• It enhances security by improving awareness, developing skills
and knowledge, and building in-depth knowledge.
• A security awareness program is one of the least frequently
implemented but most beneficial programs in an organization.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Security Education

• Everyone in an organization needs to be trained and

aware of information security; not every member
needs a formal degree or certificate in information
security.

• When formal education is deemed appropriate, an

employee can investigate courses in continuing
education from local institutions of higher learning.

• A number of universities have formal coursework in

information security.
Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Security Training

• Provides members of the organization with detailed

information and hands-on instruction to prepare
them to perform their duties securely.

• Management of information security can develop

customized in-house training or outsource the
training program.

• Alternatives to formal training include conferences

and programs offered through professional
organizations.
Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Security Awareness

• One of the least frequently implemented but most

beneficial programs is the security awareness program.

• It is designed to keep information security at the

forefront of users’ minds.

• It need not be complicated or expensive.

• If the program is not actively implemented, employees

may begin to neglect security matters, and risk of
employee accidents and failures is likely to increase.
Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Table 4-6 Comparative Framework of SETA
Education Training Awareness
Attribute Why How What
Objective Understanding Skill Exposure
Teaching method Theoretical instruction Practical instruction Media
• Discussion seminar • Lecture • Videos
• Background reading • Case study workshop • Newsletters
• Hands-on practice • Posters
Test measure Essay (interpret Problem solving (apply • True or False
learning) learning) • Multiple
choice
(identify
learning)
Impact timeframe Long term Intermediate Short term

Source: NIST SP 800-12

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Security education, training, and awareness
(SETA) program

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Figure 4-12 Components of contingency
planning

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Continuity Strategies (1 of 2)

• Incident response plans (IRPs), disaster recovery plans

(DRPs), and business continuity plans (BCPs)
• Primary functions of the above plans:
– IRP focuses on immediate response; if the attack escalates
or is disastrous, process changes to DRP and BCP.
– DRP typically focuses on restoring systems after disasters
occur; as such, it is closely associated with BCP.
– BCP occurs concurrently with DRP when damage is major or
ongoing, requiring more than simple restoration of
information and information resources.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Continuity Strategies (2 of 2)

• Before planning can actually begin, a team has to

start the process
– Champion: high-level manager to support, promote,
and endorse findings of the project
– Project manager: leads project and ensures sound
project planning process is used, a complete and
useful project plan is developed, and project
resources are prudently managed
– Team members: should be managers, or their
representatives, from various communities of interest:
business, IT, and information security
Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Figure 4-13 Contingency planning timeline

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Contingency Planning (CP) Process

• Includes the following steps:

– Develop CP policy statement
– Conduct business impact analysis
– Identify preventive controls
– Create contingency strategies
– Develop contingency plan
– Ensure plan testing, training, and exercises
– Ensure plan maintenance

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Figure 4-14 Major steps in
contingency planning

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 The CP Policy

• Should contain the following sections:

– Introductory statement of philosophical perspective
– Statement of scope/purpose
– Call for periodic risk assessment/BIA
– Specification of CP’s major components
– Call for/guidance in the selection of recovery options
– Requirement to test the various plans regularly
– Identification of key regulations and standards
– Identification of key people responsible for CP operations
– Challenge to the organization members for support
– Administrative information

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Business Impact Analysis (BIA)
• Investigation and assessment of various adverse events that
can affect organization
• Assumes security controls have been bypassed, have failed, or
have proven ineffective, and the attack has succeeded
• Organization should consider scope, plan, balance, knowledge
of objectives, and follow-ups
• Three stages:
– Determine mission/business processes and recovery
criticality
– Identify recovery priorities for system resources
– Identify resource requirements

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 RPO, RTO, WRT, and MTD
Recovery Point Objective (RPO) Work Recovery Time (WRT)
Recovery Time Objective (RTO) Maximum Tolerable Downtime (MTD)

https://defaultreasoning.com/2013/12/10/rpo-rto-wrt-mtd/

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Incident Response Planning (1 of 8)

• Incident response planning includes identification of,

classification of, and response to an incident.
• Attacks are classified as incidents if they:
– Are directed against information assets
– Have a realistic chance of success
– Could threaten confidentiality, integrity, or availability
of information resources
• Incident response is more reactive than proactive,
with the exception of planning that must occur to
prepare IR teams to be ready to react to an incident.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Incident Response Planning (2 of 8)

• Incident response policy identifies the following key

components:
– Statement of management commitment
– Purpose/objectives of policy
– Scope of policy
– Definition of InfoSec incidents and related terms
– Organizational structure
– Prioritization or severity ratings of incidents
– Performance measures
– Reporting and contact forms
Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Incident Response Planning (3 of 8)

• Incident Planning
– Predefined responses enable the organization to react
quickly and effectively to the detected incident if:
▪ The organization has an IR team
▪ The organization can detect the incident
– IR team consists of individuals needed to handle systems
as incident takes place
• Incident response plan
– Format and content
– Storage
– Testing

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Incident Response Planning (4 of 8)

• Incident detection
– Most common occurrence is complaint about
technology support, often delivered to help desk.
– Careful training is needed to quickly identify and
classify an incident.
– Once incident is properly identified, the organization
can respond.
– Incident indicators vary.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Incident Response Planning (5 of 8)

• Incident reaction
– Consists of actions that guide the organization to stop
incidents, mitigate their impact, and provide information for
recovery
– Actions that must occur quickly:
▪ Notification of key personnel
▪ Documentation of the incident
• Incident containment strategies
– Containment of the incident’s scope or impact is first priority;
must then determine which information systems are affected.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Incident Response Planning (6 of 8)

―Organization can stop incident and attempt to recover

control through a number or strategies
• Incident recovery
– Once incident has been contained and control of
systems regained, the next stage is recovery.
– The first task is to identify human resources needed
and launch them into action.
– Full extent of the damage must be assessed.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Incident Response Planning (7 of 8)
– Organization repairs vulnerabilities, addresses any
shortcomings in safeguards, and restores data and
services of the systems.
• Damage assessment
– Several sources of information on damage can be used,
including system logs, intrusion detection logs,
configuration logs and documents, documentation from
incident response, and results of detailed assessment of
systems and data storage.
– Computer evidence must be carefully collected,
documented, and maintained to be usable in formal or
informal proceedings.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Incident Response Planning (8 of 8)

– Individuals who assess damage need special training.

• Automated response
– New systems can respond to incident threats
autonomously.
– The downsides of current automated response
systems may outweigh the benefits.
▪ Legal liabilities of a counterattack
▪ Ethical issues

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Disaster Recovery Planning

• Disaster recovery planning (DRP) is preparation for and

recovery from a disaster.
• The contingency planning team must decide which
actions constitute disasters and which constitute
incidents.
• When situations are classified as disasters, plans
change as to how to respond; take action to secure most
valuable assets to preserve value for the longer term.
• DRP strives to reestablish operations at the primary site.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Business Continuity Planning (1 of 3)

• BCP prepares the organization to reestablish or relocate

critical business operations during a disaster that affects
operations at the primary site.
• If disaster has rendered the current location unusable,
there must be a plan to allow business to continue
functioning.
• Development of BCP is somewhat simpler than IRP or
DRP.
– It consists primarily of selecting a continuity strategy and
integrating off-site data storage and recovery functions into
this strategy.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Business Continuity Planning (2 of 3)
• Continuity strategies
– There are a number of strategies for planning for business continuity.
– The determining factor in selecting between options is usually cost.
– In general, there are three exclusive options: hot sites, warm sites, and
cold sites.
– "cold" (facility is prepared), "warm" (equipment is in place), "hot" (operational data is loaded)
– There are three shared functions: time-share, service bureaus, and mutual
agreements.
– Time-sharing in BCP refers to an arrangement where multiple
organizations share the use of a disaster recovery facility or data
center.
– Service bureaus in BCP are external providers that offer specific
disaster recovery and business continuity services
– Mutual agreements in BCP are reciprocal arrangements between two
or more organizations to support each other during a disruption.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Business Continuity Planning (3 of 3)

• Off-site disaster data storage

– To get sites up and running quickly, an organization must
have the ability to move data into new site’s systems.
– Options for getting operations up and running include:
▪ Electronic vaulting: involves the transfer of backup data to
a remote location, typically over a network, at regular
intervals.
▪ Remote journaling: involves the real-time or near-real-time
transfer of transaction logs or journal entries to a remote
location.
▪ Database shadowing: maintaining an exact, real-time copy
(or shadow) of a database at a remote location.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Crisis Management (1 of 3)

• Actions taken in response to an emergency should

minimize injury/loss of life, preserve organization’s
image/market share, and complement disaster
recovery/business continuity processes.
• What may truly distinguish an incident from a disaster
are the actions of the response teams.
• Disaster recovery personnel must know their roles
without any supporting documentation.
– Preparation
– Training
– Rehearsal

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Crisis Management (2 of 3)

• Crisis management team is responsible for

managing the event from an enterprise perspective
and covers:
– Supporting personnel and families during crisis
– Determining impact on normal business operations
and, if necessary, making disaster declaration
– Keeping the public informed
– Communicating with major customers, suppliers,
partners, regulatory agencies, industry organizations,
the media, and other interested parties

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Crisis Management (3 of 3)

• Key areas of crisis management also include:

– Verifying personnel head count
– Checking alert roster
– Checking emergency information cards

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 The Consolidated Contingency Plan

• Single document set approach combines all aspects

of contingency policy and plan, incorporating IR, DR,
and BC plans.
• Often created and stored electronically, it should be
easily accessible by employees in time of need.
– Small- and medium-sized organizations may also
store hard copies of the document.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Law Enforcement Involvement

• When incident at hand constitutes a violation of law, the

organization may determine involving law enforcement is
necessary.
• Questions:
– When should law enforcement get involved?
– What level of law enforcement agency should be involved
(local, state, federal)?
– What happens when a law enforcement agency is
involved?
• Some questions are best answered by the legal
department.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Benefits and Drawbacks of Law Enforcement
Involvement (1 of 2)
• Advantages of involving law enforcement agencies:
– Agencies may be better equipped at processing
evidence.
– Organization may be less effective in extracting the
necessary information to legally convict a suspected
criminal.
– Law enforcement agencies are prepared to handle
any necessary warrants and subpoenas.
– Law enforcement is skilled at obtaining witness
statements and other information collection.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Benefits and Drawbacks of Law Enforcement
Involvement (2 of 2)
• Disadvantages of involving law enforcement
agencies:
– Once a law enforcement agency takes over the case,
the organization cannot control the chain of events.
– The organization may not hear about the case for
weeks or months.
– Equipment vital to the organization’s business may be
tagged as evidence.
– If the organization detects a criminal act, it is legally
obligated to involve appropriate law enforcement
officials.
Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 The next 3 P’s
4- Protection
The protection function is executed via a set of risk management activities, as well as
protection mechanisms, technologies, and tools. Each of these mechanisms or
safeguards represents some aspect of the management of specific controls in the
overall InfoSec plan.

5- People
People are the most critical link in the InfoSec program. This area encompasses
security personnel (the professional information security employees), the security of
personnel (the protection of employees and their information), and aspects of the
SETA program mentioned earlier.

6- Project management
Whether an InfoSec manager is asked to roll out a new security training program or
select and implement a new firewall, it is important that the process be managed as a
project. The final element for thoroughgoing InfoSec management is the application
of a project management discipline to all elements of the InfoSec program.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 The Information Security Blueprint
• Basis for design, selection, and implementation of all security
policies, education and training programs, and technological
controls.
• Detailed version of security framework (outline of overall
information security strategy for organization)
• Specifies tasks and the order in which they are to be
accomplished.
• Should also serve as a scalable, upgradeable, and comprehensive
plan for the current and future information security needs.

In choosing the framework to use for an information security blueprint,

the organization should consider adapting or adopting a recognized or
widely accepted information security model backed or promoted by
an established security organization or agency.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 The ISO 27000 Series (1 of 8)
• One of the most widely referenced security models
• Standard framework for information security that states
organizational security policy is needed to provide
management direction and support
• Purpose is to give recommendations for information security
management
• Provides a starting point for developing organizational security.
• While the details of the ISO/IEC 27000 series are available
only to those who purchase the standard, its structure and
general organization are well known and are becoming
increasingly significant for all who work in information security.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 The ISO 27000 Series (2 of 8)

• ISO/IEC 27000—Information security management

systems; overview and vocabulary
• ISO/IEC 27001—Information technology; security
techniques; information security management
systems
• ISO/IEC 27002—Code of practice for information
security management
• ISO/IEC 27003—Information security management
system implementation guidance

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 The ISO 27000 Series (3 of 8)

• ISO/IEC 27004—Information security management;

measurement
• ISO/IEC 27005—Information security risk
management
• ISO/IEC 27006—Requirements for bodies providing
audit and certification of information security
management systems
• ISO/IEC 27007—Guidelines for information security
management systems auditing (focused on the
management system)

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 The ISO 27000 Series (4 of 8)

• ISO/IEC TR 27008—Guidance for auditors on ISMS

controls (focused on the information security
controls)
• ISO/IEC 27010—Information security management
for inter-sector and inter-organizational
communications
• ISO/IEC 27011—Information security management
guidelines for telecommunications organizations
based on ISO/IEC 27002

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 The ISO 27000 Series (5 of 8)

• ISO/IEC 27013—Guidance on the integrated

implementation of ISO/IEC 27001 and ISO/IEC
20000-1
• ISO/IEC 27014—Information security governance.
• ISO/IEC TR 27015—Information security
management guidelines for financial services
• ISO/IEC 27017—Code of practice for
information security controls based on ISO/
IEC 27002 for cloud services

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 The ISO 27000 Series (6 of 8)

• ISO/IEC 27018—Code of practice for protection of

personally identifiable information (PII) in public
clouds acting as PII processors
• ISO/IEC 27031—Guidelines for information and
communication technology readiness for business
continuity
• ISO/IEC 27032—Guideline for cybersecurity
• ISO/IEC 27033-1—Network security—Part 1:
Overview and concepts

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 The ISO 27000 Series (7 of 8)

• ISO/IEC 27033-2—Network security—Part 2:

Guidelines for the design and implementation of
network security
• ISO/IEC 27033-3—Network security—Part 3:
Reference networking scenarios; threats, design
techniques and control issues
• ISO/IEC 27033-5—Network security—Part 5:
Securing communications across networks using
Virtual Private Networks (VPNs)

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 The ISO 27000 Series (8 of 8)

• ISO/IEC 27034-1—Application security—Part 1:

Guideline for application security
• ISO/IEC 27035—Information security incident
management
• ISO/IEC 27036-3—Information security for supplier
relationships—Part 3: Guidelines for information and
communication technology supply chain security
• ISO/IEC 27037—Guidelines for identification, collection,
acquisition and preservation of digital evidence
• ISO 27799—Information security management in health
using ISO/IEC 27002
Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Figure 4-7 ISO/IEC 27001:2013 major
process steps

Source: 27001 Academy: ISO 27001 and ISO 22301 Online Consultation
Center
Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 NIST Security Models

• Another possible approach described in the documents

available from the Computer Security Resource Center of
NIST:
– SP 800-12
– SP 800-14
– SP 800-18 Rev. 1
– SP 800-26
– SP 800-30
– Because the NIST documents are publicly available at no charge and have
been for some time, they have been broadly reviewed by government and
industry professionals and were among the references cited by the U.S.
government when it decided not to select the ISO/IEC 17799 (now 27000
series) standards.
Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 NIST Special Publication 800-14 (1 of 2)

• Security supports the mission of the organization

and is an integral element of sound management.
• Security should be cost effective; owners have
security responsibilities outside their own
organizations.
• Security responsibilities and accountability should be
made explicit; security requires a comprehensive
and integrated approach.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 NIST Special Publication 800-14 (2 of 2)

• Security should be periodically reassessed; security

is constrained by societal factors.
• Thirty-three principles for securing systems (see
Table 4-5).

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 NIST Cybersecurity Framework (1 of 2)

• Consists of three fundamental components:

– Framework core: set of information security activities
an organization is expected to perform and their
desired results
– Framework tiers: help relate the maturity of security
programs and implement corresponding measures
and functions
– Framework profile: used to perform a gap analysis
between the current and a desired state of information
security/risk management

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 NIST Cybersecurity Framework (2 of 2)

• Seven-step approach to implementing/improving

programs:
– Prioritize and scope
– Orient
– Create current profile
– Conduct risk assessment
– Create target profile
– Determine, analyze, and prioritize gaps
– Implement action plan

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Other Sources of Security Frameworks

• Computer Emergency Response Team Coordination

Center (CERT/CC)
• International Association of Professional Security
Consultants

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Design of Security Architecture (1 of 2)

• Spheres of security: foundation of the security framework

• Levels of controls:
– Management controls set the direction and scope of the
security processes and provide detailed instructions for its
conduct.
– Operational controls address personnel and physical
security and the protection of production inputs/outputs.
– Technical controls are the tactical and technical
implementations related to designing and integrating
security in the organization.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Design of Security Architecture (2 of 2)

• Defense in depth
– Implementation of security in layers
– Requires that organization establish multiple layers of
security controls and safeguards
• Security perimeter
– Border of security protecting internal systems from
outside threats
– Does not protect against internal attacks from
employee threats or onsite physical threats

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Spheres of security

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Defense in depth

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
Security perimeters and domains

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Summary (1 of 2)

• Management has an essential role in the development,

maintenance, and enforcement of information security
policy, standards, practices, procedures, and guidelines.
• Information security blueprint is planning the document
that is the basis for design, selection, and
implementation of all security policies, education and
training programs; and technological controls.

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.
 Summary (2 of 2)

• Information security education, training, and awareness

(SETA) is a control measure that reduces accidental
security breaches and increases organizational
resistance to many other forms of attack.
• Contingency planning (CP) is made up of three
components: incident response planning (IRP), disaster
recovery planning (DRP), and business continuity
planning (BCP).

Copyright © 2018 Cengage. May not be copied, scanned, or duplicated, in whole or in part, except for use as
permitted in a license distributed with a certain product or service or otherwise on a password-protected website
for classroom use.