- Welcome to Lesson 23,
Summarize Elements of Effective Security Governance.
Now, in Lesson 23.1,
I'm gonna introduce you to governance structures.
Now, enterprise governance is the system
by which entities are directed, controlled,
and critically held to account.
Governance balances the needs of various stakeholders
in order to achieve our enterprise objectives.
And governance influences
how an organization's objectives are set and achieved,
how risk is monitored and addressed,
and how performance is optimized.
Now, governance is a system and a process.
It's not just a single activity,
and successful implementation
really does require a systematic approach
that incorporates stewardship and due care,
strategic planning, risk managing,
and performance management,
which are all topics we're gonna talk about.
As applied to information or cybersecurity,
governance is the responsibility of leadership
to determine and articulate the organization's desired,
or future, state of security.
So where do we want to be?
And sometimes,
you'll hear that referred to as a desired state,
but more often than not,
you'll hear it referred to as future state.
So subsequently, they're also responsible
for providing the strategic direction, the resources,
the funding, and the support
to ensure that that desired state of security
can be achieved, and then once achieved, can be sustained.
Now, they want to codify
the organization's commitment in policy.
They're also responsible
for risk management and for oversight.
The governance structures and principles
identify roles and responsibilities within an organization.
A role is a specific position or a job title
that an individual occupies within an organization or group.
Stewardship is the responsible oversight and protection
of something that's entrusted to one's care.
So very often in our roles,
we are expected to also be stewards,
being responsible for the oversight and protection
of something that is entrusted to our care.
Now, responsibility refers to specific duties or tasks
that an individual is expected to fill within a given role.
So, big picture of our governance ecosystem, right?
We have, all encompassing,
the Board of Directors or Board of Trustees,
or in a government agency, that might be agency leadership,
or in the military,
it would be the top of the chain of command.
Then we have Executive Management.
Then we're going to have Organizational Roles.
And then lastly, we will have Functional Roles.
We're gonna talk through the responsibilities
of each of those groups,
the Board of Directors or equivalent, Executive Management,
Organizational Roles, and Functional Roles.
So the Board of Directors, or their equivalent, duties
are strategy, due care, being a fiduciary, and oversight.
So they are responsible to determine
the desired future state of information or cybersecurity.
Now, they're not gonna do the grunt work
of figuring out what it is.
That's gonna be done by management,
but it's gonna be brought to the Board of Directors,
or equivalents, or Board of Trustees, or agency leadership.
And they will be the ones that say,
"Yes, we are putting our endorsement on it.
That is our desired future state
of information or cybersecurity."
Codify it in strategy and policy,
and to provide the funding, approve the budget.
They are also held to the standard of due care,
and due care is a legal construct
defined as executing the standard of care
that a prudent person would have exercised
under the same or similar conditions.
Now, if a situation arises that ends up going to court,
one of the criteria that will be used in a civil suit is,
was the standard of due care upheld?
Now, the directors or trustees, or equivalent,
are also known as fiduciaries.
A fiduciary is a person or organization
who holds a position of trust.
Now, being a fiduciary requires
being bound both legally and ethically
to act in the trustor's
or in the organization's best interest.
And then oversight, right?
They are responsible
for oversight and authorization of everything,
of organizational activities.
Now, they're not gonna get into the minutiae,
but ultimately, they are the ones that are responsible
and will be held responsible,
whether it's by shareholders, or in a court of law,
or from a regulatory compliance perspective.
Now, what about Executive Management?
Well, Executive Management is responsible
for strategic alignment, risk management, value delivery,
resource optimization, budgeting, performance measurement,
assurance processes, and compliance.
So decision making, all of their decision making
should be informed by organizational goals
and strategic objectives.
They're responsible for mitigating risk
to an acceptable level,
and we'll be talking more about risk in just a little bit.
Value delivery is optimizing investments
in support of business objectives.
Resource optimization is that they're responsible
for managing resources efficiently and effectively.
Budgeting,
they'll construct and then they'll implement
the organizational budget.
Generally, that budget will be approved at the higher level,
at the Board of Directors,
or Board of Trustees, or equivalent.
They will be the ones responsible
for evaluating performance measures.
They will be responsible
for implementing oversight processes,
meaning that there are assurance activities going on,
that we are doing testing, that we are doing auditing,
we are having examinations.
And lastly, they're responsible for compliance,
to comply with applicable laws,
regulations, contracts, and customs.
Now, many organizations
will have an Information Security Steering Committee,
and the Steering Committee
is senior representatives of relevant stakeholder groups.
So these will be senior representatives,
people who are part of management,
who will actually come together
to specifically oversee information security.
Their authority is generally decision making,
and the objective of having
a Information Security or Cybersecurity Steering Committee
is to achieve consensus on strategies and priorities
related to information or cybersecurity.
So what are some common topics
for the Information Security Steering Committee?
Well, the cybersecurity strategy,
'cause they need to really be sponsors of it, right?
They need to say,
"Yep, we're good on this cybersecurity strategy,"
before it goes up
perhaps to the Board of Directors for approval.
They set the cybersecurity budget.
Again, it gets approved at a higher level.
They authorize risk decisions
per the risk appetite statement.
We'll be talking about risk
and risk appetite in just a little bit.
And they monitor the organization's cyber risk position
and they report that to the Board or to a Board Committee.
So what are the benefits
of having this multidisciplinary
Information Security Steering Committee?
Again, remember, these are senior representatives
of relevant stakeholder groups, so different business units.
Well, that allows us to have appropriate prioritization
of information security objectives,
because as cybersecurity folks,
we might get a little bit myopic in our area,
but this allows us to see the bigger picture,
and it's a really effective communication channel
for assuring alignment of the security program
with business objectives.
Now, a member of management
is gonna be a Chief Information Security Officer.
Now, not every organization
has a Chief Information Security Officer.
They may have an equivalent officer,
or this may be the responsibility of the Chief Risk Officer.
But for our purposes and for your exam,
the Chief Information Security Officer
or its equivalent role
interprets the strategic direction
and is generally held accountable for the success or failure
of the information security program.
Now, the CISO should report up
as high in the organization as possible
to maintain visibility, to limit distortion,
and to minimize conflict of interest.
So for example, if your CISO is reporting to your CIO,
well, potentially there's a conflict of interest there.
So we'd like them to have independence
and be able to report as high up as possible,
hopefully directly to the Board of Directors
or Board of Trustees.
Now, some supporting roles
to the Chief Information Security Officer
include an Information Assurance Officer,
an Information Assurance Manager,
and an Information Security Officer.
So let's look at some of CISO duties.
They're gonna be a subject matter expert,
they're gonna be an advisor, they're gonna be an educator,
and they're gonna be an information security champion.
They're gonna be a cheerleader,
and this is really important.
They're the ones
that are going to bring the excitement and the enthusiasm
about information security or cybersecurity to the table.
They will be responsible
for managing the information security program.
They develop and maintained governance documents.
We'll talk about governance documents,
policies, standards, procedures, agreements
in just a little bit.
They're responsible for communicating
with business process owners and relevant stakeholders
including our data and system owners.
They're responsible for recommending and managing
the information security budget.
They serve on relevant internal and external committees,
and often they'll serve as chair
of the Information Security Steering Committee,
and they will report to and advise the Board of Directors.
Now, there are complimentary roles in the organization
to the Information Security Officer
or Chief Information Security Officer.
We have Privacy Officers, Compliance Officers,
Physical Security Officers, and internal audit.
The Privacy Officer in an organization is responsible
for developing, implementing, and administering
all aspects of an organization's privacy program.
The Compliance Officer is responsible for identifying
applicable statutory, regulatory,
and contractual requirements,
as well as ensuring the compliance thereof,
that we know what the compliance requirements are
and that we're complying with them.
The Physical Security Officer is responsible for ensuring
that appropriate physical security procedures
have been established and controls implemented.
Now, these really are very complimentary roles
and very often have to work together
with an Information Security Officer
or a Chief Information Security Officer,
and in the best of all worlds,
they all report up to the same executive management.
And then lastly, we have internal audit.
Internal audit is responsible
for providing independent objective assurance services.
I love audit.
Audit is really maligned in so many organizations.
People are like, "The auditor's coming.
Don't say anything more."
I think audit just has such an important role and function,
and should be really well respected in an organization.
And then there are some functional roles,
and we've already discussed these functional roles.
Owners, custodians, and users.
Owners are responsible for oversight and decisions
related to classifications, access control,
and protection mechanisms.
Now, the carve out on that was in a MAC environment,
mandatory access control environment,
the owners don't get to make those classification decisions
or the access control decisions.
Those are done.
That's done by classification officers,
and the relationship
between classification, clearance, and need to know.
Now, custodians are responsible
for advising, implementing, managing,
and monitoring those data protection controls.
And our users are responsible
for treating data and interacting with information systems
in accordance with policy and handling standards.
And that brings us to a three-second challenge.
Five challenge questions.
Three seconds each.
You know how to do this.
Question one, the term used to describe
the responsibility of leadership
to determine, articulate, authorize, and fund
the desired state of information security.
One, two, three.
It's gonna be security governance.
Number two, this group has a fiduciary responsibility
to the organization and its stakeholders.
One, two, three.
It's the Board of Directors, or equivalent.
Number three, the group of senior representatives
that are tasked with achieving consensus
on strategy and priorities.
One, two, three.
That's the steering committee.
Number four, specific position or job title
that an individual occupies within an organization or group.
One, two, three.
And that's a role.
And lastly, number five, a group or individual
responsible for advising, implementing, managing,
and monitoring data protection controls.
You better get this one.
This is you and me.
What is it?
One, two, three.
That's a custodian.
All right, that brings us to a security-in-action.
We can apply our knowledge.
It's about perception and support.
You were recently hired
to be the first Information Security Officer
of a pharmaceutical company.
Prior to your arrival,
the information security initiatives and projects
were the responsibility of the IT Director.
Now, you quickly learn that throughout the company
security is viewed in a really negative light.
It's seen as onerous, a productivity inhibitor, and costly.
So my question to you is,
how would you go about addressing this negative perception?
And who in the organization should you enlist
to support your efforts?
What are you gonna do?
This is not that unusual a situation.
So go ahead and put me on pause and jot down some notes.
I would suggest we begin
with evaluating the current situation,
specifically what's causing this negative perception.
And then it's all gonna be about communication.
You want to enlist the support
of the Board of Directors and Executive Management.
You want to engage security champions
throughout the organization, really at all levels,
people who get it, people understand this is important,
people who recognize that protecting our assets,
protecting our company,
by extension is also protecting our stakeholders
and our customers and our investors,
and ultimately our community, and maybe even our country.
And we should request that a Steering Committee be formed
to ensure strategic alignment and prioritization.
And then you want to lead that Steering Committee
with grace and with positivity.
When they have those negative comments
about things that have happened in the past,
let them just roll right over you, right?
You want to lead with grace and positivity.
And engage your business process owners in identifying ways
that security will enhance their desired outcomes.
Doing all that, absolutely, security-in-action.
There's your word cloud.
You know what to do.
When you're ready, I'll see you in the next lesson.