Security Program Management

NOTE: This file is a DRAFT chapter intended to be part of the NIST Computer Security Handbook. The chapters were prepared by different parties and, in some cases, have not been reviewed by NIST. The next iteration of a chapter could be SUBSTANTIALLY different than the current version. If you wish to provide comments on the chapters, please email them to [email protected] or mail them to Ed Roback/Room B154, Bldg 225/NIST/Gaithersburg, MD 20899.

DRAFT

5. Security Program Management

5.1 Purpose of Security Program Management

Organizations should view information resources security as a management issue, treated like any other item of strategic importance. Information and information processing assets (computers) are a critical component of most organizations' ability to perform their mission and business functions. The purpose of a security program is to protect these vital assets. Accordingly, ensuring security requires the development of a comprehensive management approach that integrates fundamental protection considerations.

In general, organizations divide the management of security into two major types of activities: 'Central' and 'System' activities. Central security activities are the tasks carried out on behalf of the organization such as policy development, compliance reviews, and oversight. System level security activities are those tasks performed by functional management, 'end-users,' and computer systems personnel to secure a particular computer system. These tasks include performing risk analyses, installing safeguards, and administering security.

The purpose of this chapter is to present security as a management function. An organization-wide approach to security program management is presented. Because organizations differ vastly in size, complexity, management styles, and culture, it is not possible to describe one ideal security program. However, this chapter does describe some of the features and issues common to most organizations.

Note: This chapter addresses security program management, not the various activities such as risk analysis or contingency planning, that make up an effective security program.

5.2 Structure of a Security Program

Most organizations have security programs which are distributed throughout the organization with different elements performing different functions. While this is a desirable management structure, the distribution of the security function in many organizations is haphazard, based on chance. Instead, the distribution of the security function should be the result of a planned and integrated management philosophy.

Figure 5-1 shows a management structure based on that of an actual Federal agency. The agency in the example has five major units each of which has several large computer facilities. Each facility runs multiple applications. This type of organization needs to manage security at the agency level, the unit level, the computer facility level, and the application level.

There are many benefits to managing computer security at multiple levels. Each level contributes to the overall security program with different types of expertise, authority and resources. In general, the higher levels (such as the Headquarters or Unit Levels in the Agency described above) have more clout, better ability to set policy, to see the "big picture," and to enforce. On the other hand, the systems levels (such as the computer facility and applications levels) are more familiar with the technical and procedural requirements and problems of the systems and the users. The levels of security program management are complementary; each helps the other be more effective.

Recognizing that each organization will have its own structure, this chapter divides security program management into two levels: the central level and the system level. The central security program address the overall management of security within an organization or a major component of an organization. The system level security program addresses the management of security for a particular information processing system. Most organizations have at least these two levels and many organizations, such as the example above, have several more levels.

5.3 Central Program

The purpose of a central security program, as stated above, is the overall management of security within an organization. In the federal government, the organization could consist of a department, agency, installation or other major operating unit.

A central security program provides two quite distinct types of benefits. The first type is increased efficiency and economy of security throughout the organization. The second type is the ability to provide enforcement and oversight. Both of these benefits are in keeping with the purpose of the Paperwork Reduction Act, as implemented in OMB Circular A-130.

The Paperwork Reduction Act establishes a broad mandate for agencies to perform their information management activities in an efficient, effective, and economical manner.... Agencies shall assure an adequate level of security for all agency automated information systems, whether maintained in- house or commercially. (Section 5; Appendix III, Section 3.)

OMB Circular A-130, therefore, requires that Federal agencies have computer security programs.

5.3.1. Efficiency and Economy

A central security program can manage or coordinate the use of security-related resources across the entire organization. The most important of these resources are normally information and financial resources.

It is a truism to discuss both the overload of information available to modern managers and the utility of well-managed information. Most organizations, however, have trouble collecting information from myriad sources and effectively processing and distributing it within the organization. This section discusses some of the sources and uses of security information.

Within the Federal government, many organizations such as the Office of Management and Budget, the General Services Administration, and the National Institute of Standards and Technology provide information on computer, telecommunications, and information resources. This information includes security- related policy, regulations, standards, and guidance. A considerable portion of the information is channelled through the Senior Designated Official for each agency (see FIRMR Part 201- 2). Agencies are expected to have mechanisms in place to distribute information received by the senior designated official.

Security-related information is also available from private and Federal professional societies and groups. These groups will often provide the information as a public service, although some private groups charge for it. However, even for information that is free or inexpensive, the costs associated with personnel gathering the information can be expensive. For instance, it is not cost effective for an organization to send everyone to every security conference.

Internal security-related information, such as procedures which worked, or did not work, virus infections, security problems and solutions also need to be shared within an organization. Often these issues are specific to the operating environment and culture of the organization.

A security program at the organization level should provide a way to collect the internal security-related information and distribute it as needed throughout the organization. Sometimes an organization can also share this information with external groups. Figure 5-2 shows a simplified version of this flow of information. For example, in most organizations, external interaction occurs at both the organization and system levels. However, the central security program should be aware of the interaction at the system level to aid in the sharing of information and to make sure that the organization has identified and tapped all important sources.

Another use of an organization-wide conduit of information is the increased ability to influence external and internal policy decisions. If the central security program office can speak for the entire organization, then it is more likely to be listened to by upper management and external organizations. However, to be effective, there must be excellent communication between the system level security programs and the organization level. For example, if an organization were considering consolidating its mainframes into one site (or considering distributing the processing currently done at one mainframe site), the central security program personnel could discuss the security implications and costs or cost savings. If the central security program knows the actual costs of providing for multiple contingency options and other security factors, then the central security program can speak authoritatively during policy discussions.

Beside being able to help an organization use information more cost effectively, a security program can also help an organization better spend its scarce security dollars. Organizations can develop expertise and then share it, reducing the need to contract out repeatedly for similar services. The following example is based on the Agency in Figure 1:

Each of the agency five operating units developed a separate specialized expertise, and the organization as a whole shares the increased knowledge base. Operating Unit #1, which uses primarily UNIX, developed skills in UNIX security. Operating Unit #2, which uses primarily MVS, but has one UNIX machine, concentrated on MVS security but relies on Unit #1's skills for their one UNIX machine.

The central security program can also develop its own areas of expertise. Many security programs develop skills in contingency planning and risk analysis in order to help the entire organization perform these vital security functions.

Besides allowing an organization to share expertise, and therefore save money, a central security program can also use its position to negotiate discounts based on volume purchasing of security hardware and software.

5.3.2. Oversight

Besides helping an organization to improve the economy and efficiency of its security program, the central security program can also serve as an independent evaluation or enforcement function. The purpose of this oversight role is to ensure that organizational subunits are cost-effectively securing resources and following applicable policy. While the Office of Inspector General (OIG) and external organizations, such as the General Accounting Office (GAO), also perform a valuable evaluation role, they operate outside the regular management channels. See Chapter XXXX for a further discussion of the role of independent audit.

There are several reasons for having an oversight function within the regular management channel. First, since security is a part of the regular management of organization resources, it is a responsibility which cannot be abdicated to another organization. Second, it allows an organization to find and correct problems without the potential embarrassment of an IG or GAO audit or investigation. Third, the organization may find different problems than an outside organization. The organization better understands its assets, threats, systems and procedures than an external organization, and people involved in the audit may share information within the organization they would withhold from an outsider.

5.4 Central Security Program Elements & Considerations

In order for a central security program to be effective, it must be an established part of organization management. If system managers and applications owners do not need to consistently interact with the security program, then it can become an empty token of upper management's "commitment to security." The following paragraphs describe some of the means of becoming an established program and some of the indicators that a program has achieved this goal.

Stable Program Management Function. A well-established program will have a program manager recognized within the organization as the IT security program manager. In addition, the program will be staffed with able personnel and links will be established between the program management function and IT security personnel in other parts of the organization. A security program is a complex function that needs a stable base from which to direct the management of security resources, such as information and financial resources. The benefits of an oversight function cannot be achieved if the security program is not recognized within an organization as having expertise and authority.

Stable Resource Base. A well-established program will have a stable resource base in terms of personnel, funds, and other support. Without a stable resource base, it is impossible to plan for and execute programs and projects effectively.

Published Mission and Function Statement. A published mission statement grounds the IT security program into the unique operating environment of the organization. The statement clearly establishes the function of the IT security program and defines responsibilities for both the IT security program and other related programs and entities. Without such a statement, it is impossible to develop evaluation criteria for the effectiveness of the IT security program.

Existence of Policy. Policy, as discussed in Chapter XX, provides the foundation for the IT security program and is the means for documenting and promulgating important decisions about IT security. In addition to policy, a central security program should also publish standards, regulations, and guidelines which implement and expand on policy. These are also discussed in Chapter XX.

Long-Term Security Strategy. A well-established program explores and develops long-term strategies to incorporate security into the next generation of information technology. Since the IT field moves rapidly, it is essential to plan for future operating environments.

Compliance Program. An IT security program must address whether the organization is in compliance with national policies and requirements as well as organization specific requirements. National requirements include those prescribed under the Computer Security Act of 1987, OMB Circular A-130, the FIRMR, and FIPS PUBs.

Liaison with Other Offices Within the Organization. There are many offices within an organization that potentially affect IT security. The IRM and traditional security offices (such as personnel, industrial, or physical security) are the two most obvious. However, IT security often overlaps with other offices such as Safety, Reliability, and Quality Assurance, Internal Control or the Inspector General. An effective program must have established relationships with these groups in order to integrate security into the management of an organization. The relationships must be more than just passing information; the offices must influence each other.

Example: Agency IRM Offices engage in strategic and tactical planning for both information and information technology, in accordance with the Paperwork Reduction Act and OMB Circular A-130. Security should be an important component of these plans. The security needs of the agency should affect information technology choices and the information needs of the agency should effect the security program.

Liaison with External Groups. As discussed in this chapter, there are many sources of security information, such as NIST's Computer Security Program Managers' Forum, computer security bulletin board, and the Forum of Incident Response and Security Teams (FIRST). An established program will be knowledgeable of and take advantage of external sources of information. It will also be a provider of information.

5.5 System Level Security Program

The purpose of the system level security program is to ensure appropriate and cost-effective security for each system. A central security program, as explained above, addresses the entire spectrum of information resources security for an organization. The system level security programs implement security for each information system. This includes influencing decisions about what controls to implement, purchasing and installing technical controls, day-to-day security administration, evaluating system vulnerabilities, responding to security problems, etc. It encompasses all the areas discussed in this Handbook.

The system level security program is the advocate for security. The system security officer is the person who must raise the issue of security and help work on solutions. For example, has the data owner made clear the security requirements of the system? Will bringing a new function online impact security? Is the system vulnerable to hackers and viruses? Has the contingency plan been tested? Raising these kinds of questions will force system managers and data owners to identify their security requirements and ensure that they are being met.

5.6 System Level Security Program Elements and Considerations

Like the central security program, there are many factors which influence how successful a system level security program is. Many of these are similar to the organization level. This section addresses some additional considerations.

Integration with System Operations. The system level security program must consist of people who understand the system. For security management to be effective, it must be integrated into the management of the system. Effective integration will assure that system managers and data owners consider security in the planning and operation of the system. The system level security program manager must be able to participate in the selection and implementation of appropriate technical controls, security procedures, and must understand system vulnerabilities. The system level security program must be able to respond to system security problems in a timely manner.

For large systems, such as a mainframe data center, the security program will often include a manager and several staff positions in such areas as access control, user administration, and contingency and disaster planning. For small systems, such as an office-wide LAN, the security program may be an adjunct responsibility of the LAN administrator.

Separation From Operations. A natural tension exists between security and operational elements. In many instances, operational components, which tend to be far stronger entities, seek to resolve this tension by having the security program embedded in IT operations. The typical result of this organizational strategy is a security program that lacks independence, has minimal authority, receives little management attention, and has few resources. As early as 1978, the General Accounting Office (GAO) identified this organizational mode as one of the principal basic weaknesses in federal agency IT security programs. While it is possible for central security programs to face this problem, system level programs face this problem more often.

This conflict between the need to be a part of system management and independence has several solutions. The basis of many of the solutions is a link between the security program and upper management, often through the central security program. A key requirement of this setup is the existence of a reporting structure which does not include systems management. Another possibility is for the security program to be completely independent of system management and report directly to higher management. There are many hybrids and permutations such as co- location of security and systems management staff, but separate reporting (and supervisory) structures. Figure 5-3 presents an example of placement of the security program within a typical Federal agency.

Figure 5-3 (see attachment)

System Security Plans. The Computer Security Act mandated that agencies develop computer security and privacy plans for sensitivie systems. The purpose of this plan is to ensure that each Federal and Federal interest system has appropriate and cost-effective security. System level security personnel should be in a position to develop and implement security plans. Chapter XX, Life Cycle, discusses the plans in more detail.

5.7 Interaction Between the Central and System Level Security Programs

The need for central and system level security programs to work together has been a major theme of this chapter. A system level program that is not integrated into the organizational program may have difficulty influencing significant areas affecting security.

The system level security program implements the policies, guidance, and regulations of the central security program. The system level office also learns from the information disseminated by the central program and uses the experience and expertise of the entire organization. The system level security program furthers distributes information to systems management as appropriate.

The communication, however, is not one way. The system level security program tells the central office about needs, problems, incidents, and solutions. The organization shares experience and expertise. The central security program can then represent the system to the organization's management and to external agencies and advocate programs and policies beneficial to the security of all the systems.

5.8 Interdependencies

Policy. Policy is the basis for the IT security program. The central security program(s) normally produces policy concerning general and organizational security issues. However, the system level security program normally produced some issue-specific policies and policies affecting only one system. Chapter XX, Policy, provides additional guidance.

Life Cycle Management. The process of securing a system over its life cycle is the role of the system level security program. See Chapter XX Life Cycle Management.

Independent Audit. The independent audit function described in Chapter XXXX should be complementary to the compliance function performed by a central security program.

General. The general purpose of the IT security program, to improve security, causes it to overlap with every control. Most controls will be addressed at the policy, procedural, or operational level by the central or system security program.

5.9 Cost Considerations

Section XXXX discussed how an organization-wide security program can manage security resources, including financial resources, more effectively. The cost considerations for a system level security program are more closely aligned with the overall cost savings in having security.

The most significant cost of a security program is personnel. In addition, many programs make frequent and effective use of consultants and contractors. A program also needs funds for training of personnel and travel to perform oversight, information collection and dissemination activities, and meet with personnel at other levels of security management.

5.10 References

CSI Course: Managing an Organization Wide Security Program

OMB Circular A-130, especially Main Body and Appendix III

FIRMR 201-2 (Designated Senior Officials)

Information Resources Security: What Every Federal Manager Should Know. GSA IRMS

"Security Policy and Organization Structure" in Information Security for Managers. Chapter 1.2

Computer Security Act of 1987

GAO Report LCD 78-123, "Automated Systems Security--Federal Agencies Should Strengthen Safeguards Over Personal and Other Sensitive Data"