COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION

Transcription

1 COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION Developed by Jesse C. Schroeder August 08, 2015 For Western Governors University Completion of the Masters of Information Security & Assurance

2 Contents COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION Introduction... 5 High Level Discussion of the Assessment Model... 6 Review of Multiple Models... 6 NIST Special Publications rev. 1, , & OSSTMM v DISA ACAS ISSAF OWASP Proactive Controls ISO & COBIT IBM Security Services PCI v Identification of Necessary Categories Sectional Discussion of the Assessment Model and Implementation Comprehensive Policy... 17

3 Documentation Creation Defining Business Requirements Identify Assets Create Risk Tolerance Levels Mitigation Strategies Scheduling Automated Manual Security Assessment Automation Creating Security Culture Security Awareness Updating Documentation Third Party Input Staff Education Guidance A Layered Approach Requirements Driven... 26

4 Means Driven Needs Driven Creation of Initial Security Baseline Initial Implementation Goal Achievement Metrics Application of Practice Metrics Successive Implementations Planning Tracking Correcting Reporting References Appendix A: RISK ASSESSMENT METHODOLOGY EVALUATION... 34

5 Introduction COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION This is a living document and will be altered to fit the needs of the organization that utilizes this documentation. The purpose of this documentation creates a comprehensive security assessment system to fulfill the end-user requirements of Innova Corporation. With this system, the company can use the documentation to create a security baseline for their organization and use the provided documentation to repeat the same process at satellite offices. The creation of this documentation is not site specific and can be used by any large organization to establish or audit the information security model of their operating environment. The security model has been developed for Innova Corporation 1, which has over 1000 unique user instances. The functional requirements are that the organization takes the documentation and utilize the process thoroughly and in the order described to determine the probability of asset loss or compromise on the information systems of the business. This documentation reviews various security standards and attempts to create a comprehensive security assessment system for implementation at Innova Corporation. The documentation reviewed is: NIST Special Publications , , & OSSTMM v3 DISA ACAS ISSAF OWASP Testing Guide ISO & COBIT 5 PCI v3.1 1 Hypothetical Company

6 The following documentation includes: COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION A high level discussion of the assessment model A sectional discussion of the assessment model and implementation Guidance for the creation of documentation during implementation Guidance for the education of implementation staff A discussion about the creation of an initial security baseline A discussion about successive implementations High Level Discussion of the Assessment Model Review of Multiple Models The following is a brief overview of the findings in the various models that have undergone review for the creation of a comprehensive security assessment system for Innova Corporation. Listings from the research have been placed under the title of each documentation. These findings will be utilized to identify and create the necessary categories for the assessment model systemization. NIST Special Publications rev. 1, , & The National Institute of Standards and Technology (NIST) creates multiple publications every year for multiple industries and is an agency of the United States Department of Commerce. The focus in this paper is placed upon three reports chosen from the agency in their information technology sub-section of their publications. In the rev. 1 publication (National Institute of Standards and Technology, 2012), the documentation describes three risk tiers for the business to manage. The tiers listed are Organizational, Business Process, and Information Systems. Within each tier, the business will need to implement four steps of risk management. These include: Step 1: Frame Risk / Establish Context

7 COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION Step 2: Assess Risk Step 3: Respond to Risk Step 4: Monitor Risk The establishment of the three tier system focuses on covering all areas of the business and utilizes the steps listed above to ensure that each step in the tier is properly documented. The rev.1 publication does not use the tier system to create silos inside the business, instead all three tiers work together to create a holistic approach. The NIST rev.1 emphasizes living documentation by updating the assessment framework as needed for each tier of the risk management processes. When it comes to the conduction of assessments for each tier, there are five steps of the process (National Institute of Standards and Technology, 2012). These include: Identifying the threat source and events that occur Identifying the vulnerable areas and current operational conditions Determine the likelihood of the exploitation occurrence Determine the magnitude of exploitation impact Determine the risk level for the organization The previous list creates a model that emphasizes identifying each threat and determining information about the threat quickly so that the business can recover and mitigate any damage. In the publication (National Institute of Standards and Technology, 2010), the documentation focuses on five areas of security for a business to utilize. These areas include: Emphasis Real Time Management Clear cost-effective decision in line with mission Security culture

8 Use tools COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION Emphasis responsibility / accountability The five areas, identified above, create a model of security that works alongside the needs of the business. The documentation discusses the used vendor tools for automation and creates a dependence on making discussions in a cost-effective manner to mitigate risk. This methodology produces the understanding that it is not necessary to reduce risks to nonexistence, instead business must chose to accept certain risks based upon a cost benefit analysis of risk level. In the publication (Scarfone, Souppaya, Cody, & Orebaugh, 2008) there is a detailed set of instruction for creating a security testing and assessment model. This documentation lists seven major sections that provide technical guidance for completing the assessment process and remediation activities. An overview includes: Overview of assessments Technical examination techniques Identification of targets and analyzation for potential vulnerabilities Techniques used to validate vulnerabilities Planning security assessment Key factor in execution of assessment Reporting finding and remediation The documentation is extremely detailed with various techniques that can be utilized in each of the seven sections. An understanding taken from this documentation can be identified as possibly twelve key areas that have been identified by Yang Xiao (Xiao, 2014): 1. Identify scope 2. Roles and responsibilities 3. Limitation and assumptions

9 4. Systems configuration 5. Network traffic 6. Network rulesets 7. Vulnerability scanning 8. Network discovery 9. Protocol identification 10. Password cracking 11. Social engineering 12. Penetration testing 13. Cause identification 14. Mitigation review 15. Reporting This list creates a well-defined shorthand of what the publication contains. The NIST report contains too much information for what is to be applied to the scope of the model for Innova but does have valid sections that will be utilized. OSSTMM v3 The Open Source Security Testing Methodology Manual (OSSTMM) version 3 offers a multipurpose usage in its documentation, suggesting that the information can be used for ethical hacking, penetration testing, or security assessments. The OSSTMM v3 is very detailed and emphasizes providing only fact based evidence when using its testing methodology (ISECOM, 2010). Due to this emphasis, the documentation also highly suggests that individuals become certified to encourage proper implementation of their model. This leads to decision making that does not lend itself towards a risk based approach due to the subjective nature of the business defining its own risk tolerance levels.

10 However, the OSSTMM v3 does suggest that its model can be adapted for the utilization of operational security. Innova will be able to implement sections of the OSSTMM v3 into the mitigation strategies during the creation of the assessment system. DISA ACAS The Defense Information Systems Agency (DISA) has released a document called the Assured Compliance Assessment Solution (ACAS). This documentation can be readily understood by reading the case study about proper security hygiene documentation release by Tenable Network Security due to the partnership of the Department of Defense (DoD) and Tenable. This case study emphasis five key areas for creating better cyber hygiene in an organization by utilizing a security hygiene model of network management. These five steps need to repeat on a regular basis to ensure compliance with the ACAS. These five items include (Tenable Network Security, 2014): Inventory all devices on the network Inventory all software on the network Develop and manage information security configurations Automate vulnerability assessments and remediation Actively manage and control the use of admin privileges The SANS Institute 2 has worked directly with Tenable to create a living document that contains twenty items for security the information network of an organization (SANS Institute, 2015). This documentation suggests that fifteen out of the twenty items needed for security the network can be automated. Creating a framework of automation, which encourages the usage 2 A private United States company specializing in information security and cyber security training. More information can be found at

11 of vendor tools, cuts down on the workload to maintain security and assess the current status of an information environment. ISSAF The Open Information System Security Group (OISSG) has worked to create the Information System Security Assessment Framework (ISSAF). Section 6 of this documentation demonstrates an evaluation checklist for assessing the methodology of a risk assessment (OISSG, 2004). The documentation addresses eight questions to identify and ensure the proper areas have been created for a risk assessment. The creation of the model for Innova Corporation will address these questions 3 to ensure the proper development of the desired model. OWASP Proactive Controls The Open Web Application Security Project (OWASP) Proactive Controls discusses a living documentation model of the top ten strategies for securing a network. At the time of this writing, OWASP list the following as their top ten (OWASP, 2015): 1. Parameterize Queries 2. Encode Data 3. Validate All Inputs 4. Implement Appropriate Access Controls 5. Establish Identity and Authentication Controls 6. Protect Data and Privacy 7. Implement Logging, Error Handling and Intrusion Detection 8. Leverage Security Features of Frameworks and Security Libraries 9. Include Security-Specific Requirements 10. Design and Architect Security Into Infrastructure 3 See Appendix A.

12 This list is used by establishing a scope of areas that are associated with higher risk levels. These items are listed in a hierarchical order and should be followed as listed. Updates to this list do occur and the list should be monitored on a regular basis to establish a proper perspective of risk level. ISO & ISO publication & are closely linked together in terms of policy management and scope. These two documents will be addressed together instead of individually. The implementation of these publications emphasizes the usage of a four stage model to create a model of comprehensive management. These stages are (Calder & Watkins, 2012): Plan on how to best implement solutions Do the work of implementing the solutions discussed Check to see if the implementations had the desired effect Act to mitigate any further problems and report on the findings, thus starting the process again There are 6 steps in the Plan stage and 5 steps of the Do stage of this model and they are defined as (Calder & Watkins, 2012): 6 Step Model Plan Stage: o Define Scope o Define InfoSec Policy o Define Systematic Approach to assessment and Criteria o Implement Approach to discover risks o Review results and define Mitigation o Prepare statement of applicability 5 Step Do Stage:

13 o Create Risk treatment plan o Implement plan and controls o Arrange staff training o Manage resources o Monitoring procedures These findings will be used to help create the comprehensive security assessment model for the Innova Corporation. The planning and doing stages of the ISO & documentation will be used in the policy and requirements sections of the model for Innova. COBIT 5 The Information Systems Audit and Control Association (ISACA) released version 5 of the Control Objectives for Information and Related Technology (COBIT) in April of 2012 (ISACA, 2012) and has continued to develop this implementation. In the documentation, there is a listing of five key principles that are needed to comply with the COBIT 5 model. These are: Meet Stakeholder Needs Cover All Enterprise Single Integrated Framework Holistic Approach Separate Governance from Management The COBIT model emphasizes ensuring that the needs of the organization are met on a business level first and that implementation of the model cover the entire organization in a single comprehensive framework. IBM Security Services IBM has released multiple white papers, one of which discusses four key components that will help secure large organizations. These are (IBM Corporation, 2013):

14 1. Prioritize business objectives and set risk tolerance 2. Protect the organization with a proactive security plan 3. Prepare a response for a sophisticated attack 4. Promote and support a culture of security awareness These four security practices identify the need to create a plan that emphasizes the needs of the business first and base the security practices on those needs. The previous four components can further be broken down into IBM s ten security essentials, which the documentation identifies as (IBM Corporation, 2013): 1. Build risk aware culture 2. Manage incidents & respond 3. Defend the workplace 4. Security by design 5. Update systems 6. Control access 7. Isolate services 8. Create a culture of security 9. Inventory assets 10. Identify people and monitor them in the operation PCI v3.1 The Payment Card Industry (PCI) has a Security Standards Council that releases data security standards for consistent data security measures globally (PCI Security Standards Council, LLC, April, 2015). In their current standard, released April 2015, PCI includes 6 sections of identification. These include: Build and Maintain a Secure Network and Systems Protect Critical Business Data Maintain a Vulnerability Management Program

15 Implement Strong Access Control Measures Test Networks Maintain an Information Security Policy The previous sections are then broken down into action steps that organizations can take to comply with the PCI standard v3.1. The listing below develops a listing that business can utilized to become PCI compliant. Configure the following to control network: Proactive Policy (PCI Security Standards Council, LLC, April, 2015) 1. Install and maintain a firewall configuration to protect cardholder data 2. Do not use vendor-supplied defaults for system passwords and other security parameters 3. Protect stored business data 4. Encrypt transmission of cardholder data across open, public networks 5. Protect all systems against malware and regularly update anti-virus software or programs 6. Develop and maintain secure systems and applications 7. Restrict access to cardholder data by business need to know 8. Identify and authenticate access to system components 9. Restrict physical access to cardholder data 10. Track and monitor all access to network resources and cardholder data 11. Regularly test security systems and processes 12. Maintain a policy that addresses information security for all personnel Identification of Necessary Categories After a study of the previous documentation, it has been found that similar categories from the documentation can be identified for the creation of a comprehensive security

16 assessment system. Many of the papers identify the same categories and emphasize their need in the creation of the Innova security assessment system. The categories were chosen based upon the need to cover all information security areas at Innova Corporation and the ability to reuse the information during any modification or exportation of the documentation. These categories have been identified as follows: Identify the needs of the business Assessment Automation Create a schedule for testing and comparison of results Utilize policy for the entire business Continue to Update the Documentation Educate Staff Create Culture of Security

17 Sectional Discussion of the Assessment Model and Implementation Comprehensive Policy The creation of a comprehensive policy to address the security assessment system includes the four key areas associated with the IBM Security Services. All policies created focus on an organization wide approach to risk management and all sections of the business need to work together to promote a culture of security. 1. Prioritize business objectives and set risk tolerance 2. Protect the organization with a proactive security plan 3. Prepare a response for a sophisticated attack 4. Promote and support a culture of security awareness Documentation Creation The creation of documentation for a comprehensive policy needs to be based upon an assessment template framework. This documentation will act as a checklist for the implementation of policies created for security assessments. The framework includes: Stakeholder requirements for proper business governance Managed asset categories based upon the identified requirements o Subcategories listing tools that are used for assessing security Reports returned from security assessments listing risk matrix levels o Mitigation strategies for identified vulnerabilities Actions taken towards securing the network by the organization Timestamps and professionals responsible for the documentation Utilizing this framework creates a standard for the comprehensive security assessment system that can be easily scanned and understood by the professionals working on the information systems. Also, with the inclusion of timestamps and names of the responsible parties, this documentation includes the element of nonrepudiation.

18 Defining Business Requirements COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION To define the business requirements of Innova Corporation, the assessment team needs to take a few initial steps before any further documentation can be created. First the team must identify the assets. Second, risk tolerance levels need to be created. These two step are associated with the ISSAF, wherein the initial steps are defined for the creation of risk association. Identify Assets The initial step in creating the assessment model for Innova Corporation is to create an overview of the business. This is done by identifying all of the assets attached to the information network. Viewing the definition in the DISA ACAS section of the models, it can be seen that these assets include: Hardware Software Documentation or Multimedia User accounts Permissions Once established, this information needs to be discussed with company stakeholders to acquire a definitive governance model for the business. This model establishes the requirements for the continued success of the business. Only the top stakeholders of the business understand what is required for the continual success of the business model. Create Risk Tolerance Levels The creation of risk tolerance levels allows the organization to manage the risk levels associated with the assets of the business. This is needed because the business cannot focus on

19 all risks at once. Therefore, a hierarchy of risks needs to be defined for the organization. This assessment model create three layers of risk: High, Medium, and Low. These three layers are based upon the probability of asset exploitation and the impact it may have on the business. To understand which assets may be at a higher risk level than others, the OWASP Proactive Controls model has been reviewed. Innova must now take the assets that are identified as critical to the business and associate them with the current probable levels of exploitation and associate them with a risk level. Doing this creates the risk matrix for the organization and prioritizes the risks based upon these ratings. To be clear, this matrix will not become populated until a risk assessment is implemented at the organization. Mitigation Strategies Once assets have been discovered with unacceptable risk levels, mitigation strategies need to be implemented. These strategies are based upon the tools used to assess the information systems. Automated tools return varying mitigation strategies. Therefore, it is required that the organization use multiple sources for scanning the network to identify vulnerabilities. When the tools return mitigation strategies, the employees must simply follow the instructions to close the security holes in the network. It is suggested, but not required, that the company use vendors that supply proof of the identified vulnerabilities when selecting tools for the use of scanning the network. This means that the tools will actively exploit vulnerabilities, one such tool is Netsparker 4. In this way, Innova security personnel can have proof that the vulnerability can actually damage the system because these types of tools do not return vulnerabilities that they cannot exploit, ensuring an very low or nonexistent false positive rate. 4 Information can be found at

20 If Innova employees come across vulnerabilities that they do not understand, the company should call the vendors of the security tools that the implementation team has chosen and discuss possible ways to fix the unknown problem. Or, if a vulnerability cannot be fixed, then a meeting needs to be held with the stakeholders to discuss possible mitigation strategies and a business level. Scheduling Two types of scheduling have been identified for creating the assessment system based upon the NIST documentation, automated and manual scheduling. The main purpose of scheduling the implementations and mitigation strategies of the assessment model are to verify the implementation procedures and validate mitigation events. Automated The automated scheduling is based upon the tools used for implementing part of the security assessment model. Automation occurs when enabling processes that can be run without oversight. These processes are the tools selected by the organization for scanning the network and searching for vulnerabilities. The automated process are maintained by third parties and the tools develop reports for Innova based upon the settings that are enabled in the tools. Creating a list of automated settings that the scanning tools can use will be created based upon the policies created during the creation of the business requirements and management policies. Selecting and purchasing tools for the organization will be a joint process between the stakeholders of the organization and the management team that is implementing their requirements. Tools change and are updated all the time. However, at the time of this writing, the tools that Tenable Network Security has created, in conjunction with the identified requirements from the DoD, are top of class for automatically scanning information networks.

21 Manual COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION Manual scheduling for the security assessment system is used to implement the defined policies by employees of Innova Corporation. This strategy is used when there are changes to the network and systems at the business, a review needs to be undergone to ensure the automated tools are running properly, or a security assessment needs to occur. When implementing a security assessment, it is necessary to schedule the required working hours to completing the tasks documented in the management section of the comprehensive policy. Without the proper human resources dedicated to completing the assessment, there is an unknown chance of successfully securing the information network. If a secure network cannot be guaranteed, then there is no point in undergoing a partial security assessment implementation. The business undergoes a shift in the risk matrix when changes to the network and systems at the business occur. This is due to implementing a different set of variables into the network. Depending on what is implemented, huge shifts may occur and leave the critical resources of the business vulnerable to assault. The only way to ensure the security of the network is to undergo a security assessment and use the successive implementation model discussed in this document. A schedule for reviewing the automated reports from the scanning tools is a requirement for the completion of security assessment implementation. The staff that is accountable for implementing and overseeing the tools utilized in the security assessment must be able to complete their tasks. In this way, the vendors can be held accountable for their tools that are implemented on the Innova network. If the employees are not allowed the necessary resources for the completion of their tasks, then the chain of accountability falls apart and, therefore, the security model.

22 Security Assessment Automation COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION As described in the DISA ACAS section of the high level review, multiple sections of the security assessment model can be automated. This automation is continuous and reports to the team assign to review this documentation. The main benefits of utilizing automated tools are: Reduction in labor and reporting error Minimize vulnerability exposure Shift responsibility Constant monitoring Consistent report forms A multitude of automated monitoring tools exist to assess the security posture of an organization and is beyond the scope of this paper. However, the need for such tools is obvious due to the benefits described above. When automated tools are used, the reporting error of humans is reduced to the levels automated in the software. This creates a minimal amount of error that is shifted to the vendors that supply the tools implemented because those companies are responsible for the training of Innova employees that are managing their product. The reduction in labor is justified by the reduction in work hours necessary to implement the security assessment. Varying tools need a differing amount of oversight and will cut the workload at a rate based upon that oversight. Also, it is required that Innova choose tools that utilize constant monitoring of the network for quick identification of vulnerabilities and risk mitigation. This method reduces the risk of long term vulnerability exposure time to a minimal level by delivering consistent reporting forms on a scheduled basis to the security assessment implementation team. The implementation team will need to review the automated reports and add them to the living documentation of the security assessment framework. The team will also need to use

23 these reports when the mitigation procedures take place and add their own documentation about the results of their work to the assessment documentation. Creating Security Culture Developing a security culture at Innova Corporation requires the establishment of trust in the business and the employees that work there. The consequences of creating a culture of security at a business involve the prevention of fraud and misuse of information resources (Ross, 2011). In order to create this culture, the implementation of strategic drivers at the organization. These drivers include: Establishing leaders of security Ensuring a budgetary establishment for security Utilizing policy to ensure responsibility Creating security awareness and education programs The leader of information security at the organization are established through the creation of the three tier staff education guidance section of this paper. These leaders work directly with stakeholders to establish security requirements for the organization. The stakeholders ensure the budgetary requirements for the policies are met due to the security assessment policies being based upon the business requirements during the creation of policy. The policies created hold the individuals who implement them responsible. This is one of the requirements of the comprehensive security assessment system. Security Awareness Creating a security awareness and education program for employees at Innova involves: Input from the stakeholders about the needs of the business Concise actionable steps employees can take to enact security requirements Development of a security reporting model for the organization

24 COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION A hold harmless doctrine for reporting to enable the development of trust in the organization. All staff members need to attend a minimum of one training session to understand the requirements being placed upon them by the organization. This will ensure the accountability of all employees at Innova and allow additional documentation in to the living model of the security assessment. Updating Documentation The documentation of the comprehensive security assessment system will need to be updated when new information is discovered about the assessment process. This discovery will come from the implementation of the model, third party documentation, acquiring new software or hardware services, or other unforeseen sources. Due to the design of the living document assessment model, versioning control can be implemented To control the various version of the documentation, a numbering strategy is used for maintaining the versioning process. Three decimal versions are used (0.0.0), thus creating A, B, and C. These columns are used as follows: Column A: Major revisions to the assessment model, thus creating the need to deprecate the previous model. Column B: Yearly review and update of the assessment model with reports appended to the documentation. Column C: Each successive implementations with reports appended to the documentation. The initial documentation is known as the prototype model and has a versioning number of Each revision, whether major or minor, needs to be kept for a minimum of five years, starting at the time of release of the documentation.

25 Third Party Input COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION During the lifetime of the security assessment model for Innova Corporation, there will be reports released from vendors and researchers that will need to be addressed and added to the assessment model for Innova. When this occurs, Innova may choose to address the issue immediately or wait until the appropriate time. However, this information cannot be ignored and needs to be compared to the threat matrix of the business. Once assessed against the matrix, Innova can more easily find the appropriate time scale for addressing the newly release information. Staff Education Guidance A Layered Approach The staff of Innova Corporation will need education and guidance during the stages of the security assessment life cycle. Understanding the needs of a fully developed education model comes from understanding the three tiers of an appropriate education program (Roper, Grau, & Fischer, 2006). These three tiers are each driven by the needs of the assessment program and each have clearly defined responsibilities for the individuals that are implementing them. Each tier is designed to target a specified sector of the security assessment system with defined performance objectives. Innova needs to develop content specific to each tier and define communication channels for information to flow throughout the organization without hindrance. After the education program has been developed and implemented, this information will be added to the security assessment as a vector for evaluation to ensure effectiveness. When evaluations are undertaken, the results of the observations need to be added to the comprehensive security assessment system documentation as part of the security baseline. Ensuring the staff executing the management process is directly correlative with the success of business security.

26 Requirements Driven COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION The requirements driven approach to staff education utilizes the business requirements. This tier of the education model is used to implement policies of protection for the identified assets. The team implementing this tier has the responsibility to: Create policy for the assessment system that covers business assets Maintain the policies created by utilizing the living documentation model Act as leaders towards the other two tiers Communicate with all teams involved to ensure all needs are met and understood Using this list to hold the Requirements Driven tier accountable will ensure that the business needs are being achieved. Developing an education platform from the list of questions enables the business to guarantee the understanding of the employees who will be dedicated to executing the list. Means Driven The means driven approach to staff education focuses on the scheduled operations of the comprehensive security assessment system. These scheduled operations are: Implementation of the security assessment policies Review of the reports generated by the tools utilized during assessment Mitigation of the vulnerabilities discovered during assessment Reporting the results to the Requirements Driven tier Works with a dedicated scheduling process for assessment implementations Developing an education platform that utilizes the above list will require discussions with the Requirements team and the vendors of the tools utilized during implementation. The

27 Means Driven tier has the heaviest burden of technical education and will need to be given the appropriate amount of time to develop the skills needed for implementation. Once the Means Driven team has achieved the skills necessary to properly implement the desired actions of the above list, only then can that team be held responsible for the completion of their tasks. Needs Driven The needs driven approach to staff education creates a team that will respond to high risk critical situations that need to be handled immediately. This team is a subdivision of the Means Driven tier and consists of individuals that have the ability to respond under pressure. The requirements of the Needs Driven tier are: On call for an immediate response of critical risk mitigation Works out of band from the Means Driven scheduling Communicates directly with company stakeholders and Requirements Driven tier Consist of the leaders of both the Requirements and Means tiers. Reports are given to the Requirements tier to be placed in the living documentation This list creates a safety net for the organization in times of critical risk. The training for the Needs Driven tier utilizes the training from both previous tiers and also includes its own dedicated training material. The education program for the Needs Driven tier requires a crisis management training course, which ensures the employees will be able to focus on the immediate problem, understand the longer term consequences of the decisions that are made during a time of crisis, and clearly communicate with all necessary parties at the time of crisis.

28 Creation of Initial Security Baseline Initial Implementation COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION The initial implementation of the comprehensive security assessment system can be easily understood by three key practices: 1. following the guidance of practices from the discussions in previous sections of the documentation, 2. comparing the implementation testing to identified goal achievement metrics, and 3. comparing the implementation testing to the desired application of practice from the initial documentation. Areas 2 & 3 described above have been researched in the COBIT 5 (2012) model from ISACA. This implementation will create a security baseline for Innova that will be used for successive implementations. The security baseline is the state of the information network after the first complete cycle of the security system, including mitigation, as defined by this security system. The initial mitigation process is critical for ensuring that the company has closed major security holes and the onboarding process of the security culture has begun to take hold at Innova Corporation. Goal Achievement Metrics The goal achievement metrics for the creation of the initial security baseline are defined before the baseline is created. These metrics are the definitions of what a successful implementation involves and are therefore designated by the policies that were created at the beginning of the security assessment. Goal achievement metrics for the Innova Corporation are listed as questions and include: Did the business fix security issues based upon the guidance of the automated controls? Did the company properly log the policies and results of the security assessment? Did the organization create policies that enveloped the entire organization? Did Innova place priority on completing the assessment process?

29 All of these questions can be answered after the initial implementation of the security assessment model is complete and the questions may be reused, if appropriate, during any subsequent implementations. Application of Practice Metrics The application of practice metrics involved with the creation of the initial security baseline is also a set of questions that need to be checked against the work complete. In this case, the metrics are associated with the implementation of the methods used to discover and mitigate the vulnerabilities on the network. The questions are: Did the implementation team use the governance model created by the stakeholders to create a management model for mitigating those risks? Did the employees follow the policies created for implementing the management strategies? Where the reports from the tools reviewed and utilized for mitigating the risks discovered during the automated scanning practice? Where the documents filed in the living documentation of the comprehensive security assessment system for storage and future review or comparison? If any problems were discovered during the security assessment that could not be properly mitigated, was there a meeting held to discuss other mitigation strategies with stakeholders or tool vendors? Once all of the above questions are answered, then Innova has assessed, responded to the risks associated with their information system, and is in a position to continue to monitor the network for abnormal activities until the next security event takes place. This is a minimal set of questions and should be added to during the lifetime of the security assessment system.

30 Successive Implementations COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION The following categories have been identified to be used with each successive implementation of the comprehensive security assessment system. The four categories are based upon the ISO & model and NIST rev.1. These create a cyclical approach to security management. Planning After the initial implementation of the comprehensive security assessment system, Innova will need to plan successive implementations. In order to plan those implementations, Innova will review the previous implementations of the security system and discover the areas that need to be addressed inside the network. These areas are based upon the creation of the security baseline and the living documentation of the security model. The security assessment team will need to set a schedule of work and base the schedule upon a yearly cycle, unless major changes to the information system occur in the interim. Tracking The tracking of successive implementations will be placed in the living documentation, noted with the proper implementation label. The tracking utilizes the framework for documentation created in the comprehensive policy section. Correcting In the correction section of successive implementations, the business identifies areas of mitigation and completes the processes necessary to protect the network. By protecting the network, it is understood that these goals are based upon the needs of the business in the planning stage of the successive implementation.

31 Reporting COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION The reports from the automated tools and the manual mitigation reports should be added to the living document of the assessment system. These documents should be reviewed and compared to the current security baseline to monitor any unwarranted changes. If anything unusual is noticed during the review of the reporting phase, further investigation in to the system will be needed and if the anomaly is not comprehensible, then another security implementation is warranted.

32 References COMPREHENSIVE SECURITY ASSESSMENT SYSTEMIZATION Calder, A., & Watkins, S. (2012). IT Governance An International Guide to Data Security and ISO27001/ ISO27002 (5th ed.). Philadelphia, PA: Kogan Page. IBM Corporation. (2013). Responding to and recovering from sophisticated security attacks: The four things you can do now to help keep your organization safe. Somers, NY: IBM Global Services. ISACA. (2012). COBIT 5: A Business Framework for the Governance and Management of Enterprise IT. Rolling Meadows, IL: ISACA. ISECOM. (2010). Open Source Security Testing Methodology Manual. Cardedeu, Spain: ISECOM. National Institute of Standards and Technology. (2010). Guide for Applying the Risk Management Framework to Federal Information Systems. Gaithersburg, MD: National Institute of Standards and Technology. National Institute of Standards and Technology. (2012). Guide for Conducting. Gaithersburg, MD: National Institute of Standards and Technology. OISSG. (2004, August 10). Information Systems Security Assessment Framework Draft 1.0. Retrieved from Sourceforge: OWASP. (2015, August 7). OWASP Proactive Controls. Retrieved from OWASP: PCI Security Standards Council, LLC. (April, 2015). Payment Card Industry (PCI) Data Security Standard Version 3.1. Wakefield, MA: PCI Security Standards Council, LLC.

33 Roper, C., Grau, J., & Fischer, L. (2006). Security Education, Awareness and Training: From Theory to Practice. Burlington, MA: Elsevier Inc. Ross, S. (2011). Creating a Culture of Security. Rolling Meadows, IL: ISACA. SANS Institute. (2015, August 15). Critical Security Controls: Guidelines. Retrieved from SANS: Scarfone, K., Souppaya, M., Cody, A., & Orebaugh, A. (2008). Technical Guide to Information Security Testing and Assessment. Gaithersburg, MD: National Institute of Standards and Technology. Tenable Network Security. (2014). Tenable Solutions for the Cyber Hygiene Campaign. Columbia, MD: Tenable Network Security, Inc. Xiao, Y. (2014). Vulnerability Assessment for Substation Automation Systems. In Y. Xiao, Security and Privacy in Smart Grids (p. Chapter 8). Boca Raton, FL: Taylor & Francis Group, LLC.

34 Appendix A: RISK ASSESSMENT METHODOLOGY EVALUATION 5 The process for periodic risk assessment for information security in the Organization environment identifies the follow up actions, after the risk assessment has been completed, to manage the newer risks that have been realized in the environment. 1. Does the risk assessment exercise at minimum include the following? 1.1. Identification of all business critical information assets. (E.g., Data, paper documents, software, hardware etc.)? 1.2. Vulnerabilities assessment for the identified assets? 1.3. Identifying the risk scenarios for compromise of the assets via the vulnerabilities identified? 1.4. Assessing a probability of the risk scenario to come to pass on a rate scale? 1.5. Assessing the impact on the business if the risk scenario were to come to pass? 1.6. Calculating the risk rating by multiplying the probability by the impact? 1.7. Prioritizing the risks based on the risk ratings? 2. Does the Organization conduct a comprehensive organization wide risk assessment exercise to reassess the threats, vulnerabilities and business impact for information security & 5 See Reference OISSG.

35 is the Chief Information Security Officer (CISO) duly assisted by the respective Information Security Officers (ISOs) during this periodical risk assessment exercise? 3. Is there a Risk Assessment Template which is used as a general framework for the conduct of the risk assessment? 4. Is there a risk management plan developed to minimize the exposure of the company to the high risks that are identified? 5. Are the controls implementation instructions issued on the basis of the risk management plan, which will clearly identify responsibilities and timelines for implementation? 6. Does the CISO with assistance from the ISOs verify and validate the desired implementation actions within the stipulated time? 7. Are the details of the risk assessment, risk management plan and implementation will be preserved for a stipulated period? (3-5 years) 8. Apart from the yearly risk assessment is a risk assessment carried out whenever there is a major change to the P&O network and systems such as addition of a new business application, relocation or redeployment of an existing application system, major changes to network architecture?