Freely subscribe to our NEWSLETTER

Historically, information security has been addressed primarily as a technical issue. Preventive controls, such as firewalls, user access control mechanisms, encryption of data and communications, digital signatures, data backup systems, and detective controls, such as intrusion detection systems or security monitoring platforms, have formed the basic components of security architecture. Often, the technical controls are complemented by a set of security policies, procedures and guidelines aimed at controlling the actions of personnel.

This approach, though, has proven to be insufficient. Security incidents continue to rise and security problems remain unsolved while information security experts have been challenged to effectively communicate the value of information security to enterprise management. The root cause of these problems may be the definition of information security itself. There is a lack of consistency as each sector, industry and even enterprise has had to define information security uniquely, based on very specific business needs. This lack of consistency has contributed to a lack of understanding and a lack of appreciation for the value of information security.

INFORMATION SECURITY DEFINED

To define information security in an organisation, one must understand its business objectives, identify stakeholders and link them to information protection attributes. Organisations have to be trusted to achieve customer acquisition and retention, which directly affect their revenue. This trust is a key success factor that is directly related to:

• Business integrity—Each business decision is conducted as described in its official literature. It is fair to the customer and inspires trust. Information integrity (avoiding data manipulation) is a key information security component related to customer trust.

• Customer asset protection—Customers need to be confident that their money, credit card numbers and bank account numbers are safe, especially in online transactions, where their funds are essentially electronic. Customers need to trust an organisation to secure their financial assets; confidentiality, integrity and availability are crucial security parameters.

• Customer privacy—Customers provide their personally identifiable information (PII) to a whole host of ‘trusted’ sources. As in customer asset protection, trust in the business is important for making them feel comfortable with sharing such information. Trust is particularly important when dealing with large amounts of money because customers have to feel safe and also that their personal data have been protected.

Providing services to the public also has societal and political facets. Businesses must adhere to a governmental regulatory and legal framework. The provision of secure and fair outlets to citizens is a matter of social responsibility. Moreover, the government is a shareholder of business (directly or indirectly through taxing); thus, business success affects the corresponding governmental revenue.

The aforementioned facts are clarified in relation to information security when the drivers of shareholders’ trust are studied in more detail. For example:

• Each licensed business has to comply with rules and terms of the license, which in turn have general or more detailed information protection requirements. These vary from general statements for fairness, antifraud rules and service availability requirements to more detailed technical controls such as network security rules, operating security policies or certification requirements. Shareholders need to be confident that a business complies with the license obligations and, more generally, the legal and regulatory framework, since this is a main corporate viability factor.

• In competitive business environments, information security acts as a competitive advantage that, in turn, ensures customer acquisition. Shareholders trust a business if it operates as a competitive corporation, and due to the importance of protecting its information from breaches, information security becomes a competitive parameter.

In relation to the business role of information security, drivers should be:
–Shareholders’ trust:

. Corporate viability, which is driven by compliance of license terms

. Competitive advantage, which ensures customer acquisition

. Brand name value preservation, which ensures customer retention

. Legal and regulatory compliance (e.g., the integrity of financial records and PII protection)

– Customers’ trust:

. Business integrity

. Service availability

. Protection of the confidentiality of customers’ sensitive information

Using this definition of information security for the business sector, a holistic approach is required for addressing the information security requirements of each unique organisation. This requires a detailed business analysis for embedding information security into the specific business processes and also for addressing the human factor and minimizing the uncertainty it introduces. International security standards provide a solid base for information security from a business perspective.

THE INFORMATION SECURITY STANDARDS LANDSCAPE

The Security Control Standard (SCS) is an extension of the globally recognized information security standard ISO 27001 of the International Organization for Standardization (ISO), which is related to the establishment of information security management systems (ISMSs). Such systems provide the framework for managing information security from planning to implementation, monitoring and improvement.

ISACA has published a set of information technology (IT) auditing standards and the Risk IT: Based on COBIT framework, which provides a set of guiding principles for effective management of IT risk. Risk IT complements COBIT, a comprehensive framework developed by ISACA for the governance and control of business-driven, IT-based solutions and services. In 2009, ISACA published An Introduction to the Business Model for Information Security, the first publication released under the Business Model for Information Security (BMIS), which addresses information security from a business perspective, and in 2010, the full model was published as The Business Model for Information Security.

Other standards include the Payment Card Industry Data Security Standard (PCI DSS), a set of requirements for enhancing payment account data security, and the Special Publications (800 series) of the US National Institute of Standards and Technology (NIST), which are documents of general interest to the computer security community. The aforementioned standards provide an indicative view of the information security standards landscape. Other standardization bodies and associations provide their own guidelines in the field. In addition, technical security best practices of system vendors provide additional guidelines.

The modern business sector has to select the information security standards to use as a basis for its security architecture, and it must customize this selection according to its specific business needs.

BASIC PROCESSES

Studying the information security standards horizontally, a number of basic processes/steps that lead to the identification of information security requirements are:

• Step 1: Business impact analysis—Each business process is recorded and analyzed in terms of business impact from the realization of a possible security threat.

The business must answer a number of questions to calculate the impact of security breaches, including:
– How much would this cost the business in monetary terms?
– What would be the indirect costs (e.g., from reputation loss) if information is sold?
– What would the legal implications be?
Business processes are then prioritized based on an impact scale that identifies the most critical issues.

• Step 2: Risk analysis—During this process, the possibility for the occurrence of a security incident is calculated, based on a database of security weaknesses. The risk analysis takes into account technical and procedural parameters, such as:
– Are there technical controls in place to safeguard customer data?
– Do procedures exist to complement the technical security controls?

• Step 3: Risk management—The result of the risk analysis is a prioritization of risk in relation to the impact level (the result of the business impact analysis) and the identification of possible security measures for addressing the risk. The risk management process—the selection of appropriate security measures for addressing the risk or for risk transferring or acceptance—is determined by the management of the organisation.

• Step 4: ISMS implementation—After the controls have been selected, they should be correlated under a common information security management system (ISMS). This correlation requires deep understanding of the operation of the organisation; consideration of human, cultural, technical, business and external factors; and continuous improvements.

Business Model for Information Security

One of the most recent information security frameworks that addresses information security from a business point of view is ISACA’s BMIS.

The following definitions of the BMIS elements (derived from An Introduction to the Business Model for Information Security) are necessary for understanding how BMIS works:

• Organization design and strategy—An organization is a network of people, assets and processes interacting with each other in defined roles and working toward a common goal.

• People—The people element represents the human resources and the security issues that surround them. It defines who implements (through design) each part of the strategy. It represents a human collective and must take into account values, behaviors and biases.

• Process—Process includes formal and informal mechanisms (large and small, simple and complex) to get things done.

• Technology—The technology element is composed of all of the tools, applications and infrastructure that make processes more efficient.

To understand the operation of BMIS in practice, it is important to study the links connecting organization design and strategy, people, process, and technology.

CONCLUSION

Information security will be understood, provide added value and effectively contribute to the operation of an organization only if it is designed and implemented as a core ingredient of the business strategy. Stakeholder, shareholder and customer trust are the key ingredients of information security; organizations from all sectors should identify such key ingredients in order to provide a business definition to information security.

While technical security controls are important, what distinguishes a typical information security management system from an effective one is the ability to correlate all parameters in the operation of an organization, especially the human factor. While absolute information security is theoretically unachievable, organizations have the ability to reduce uncertainty and to continuously improve their approaches to making information security a business enabler.

Christos K. Dimitriadis, Ph.D., CISA, CISM, is international vice president of ISACA and head of information security at INTRALOT S.A, a Greece-based multinational supplier of integrated gaming and transaction processing systems.

1) International Organization for Standardization,
ISO/IEC 27001:2005, Information technology—Security
techniques—Information security management systems—
Requirements, 2005

About ISACA

With 95,000 constituents in 160 countries, ISACA® (www.isaca.org) is a leading global provider of knowledge, certifications, community, advocacy and education on information systems (IS) assurance and security, enterprise governance and management of IT, and IT-related risk and compliance. Founded in 1969, the nonprofit, independent ISACA hosts international conferences, publishes the ISACA® Journal, and develops international IS auditing and control standards, which help its constituents ensure trust in, and value from, information systems. It also advances and attests IT skills and knowledge through the globally respected Certified Information Systems Auditor™ (CISA®), Certified Information Security Manager® (CISM®), Certified in the Governance of Enterprise IT® (CGEIT®) and Certified in Risk and Information Systems Control™ (CRISC™) designations. ISACA continually updates COBIT®, which helps IT professionals and enterprise leaders fulfill their IT governance and management responsibilities, particularly in the areas of assurance, security, risk and control, and deliver value to the business.