Lesson 23 - Summarize Effective Security Governance

enterprise governance

system by which entities are directed, controlled and held to account

role

position or job title that an individual has within an organization

stewardship

responsibility for the protection of something entrusted into your care

responsibility

specific duties or tasks that an individual needs to fulfill in a given role

4 Groups of the Governance Ecosystem

1. Board of Directors

2. Executive Management

3. Organizational Roles

4. Functional Roles

Due Care

Legal construct defined as exercising the standard of care that a prudent person would have exercised under similar conditions

Fiduciary

- person or organization that holds a position of trust

- fiduciaries are bound legally and ethically to act in the trustors best interest

Value Delivery

Optimize investments in support of business objectives

Information Security Steering Committee

senior representative of relevant stakeholder groups tasked w/ reach consensus on strategy and priorities (e.g. endorse cybersecurity strategy, set cybersecurity budget, etc)

CISO (Chief Information Security Officer)

- interprets strategic direction and is held responsible for the success/failure of the information security program

- should directly report up as high as possible (e.g. Board of Directors)

Privary Officer

- Organizational Role

- responsible for developing, implementing, and administering all aspects of an organization's privacy program

Compliance Officer

- Organizational Role

- responsible for identifyng applicable, statutory, regulatory, and contractual requirement and ensuring compliance to them

Physical Security Officer

- Organizational Role

- responsible for ensuring appropriate physical security procedures have been established and controls implemented

Internal Audit

- Organizational Role

- provide independent objective assurance services

Owner

- functional role

- responsible for oversight and decisions related to classification, access control and protection

Custodian

- functional role

- responsible for advising, implementing, managing, and monitoring data protection controls

Users

- functional role

- responsible for treating data and interacting with information systems in accourding with organization policy and handling standards

Policy

- high-level governance document

- remain relatively stable over time

- don't contain any implementation details

Agreement

used to legally enforce policies and related governance publications

Standard

- precice, unambiguous specification for the implementation of a policy

- dictate mandator requirements

Baseline

group of standards for a specificy category/grouping

Guideling

- help people understand and conform to a standard

- customized for the intended audience

Procedure

- disecrte steps/instructions for how to carry out an action

- simple step, hierarchical, graphic, flowchart

Simple Step Procedure

list of sequential actions with no decision making

Hierarchical Procedure

organized instructions in a hierarchy where each level is nested within the one above it

Flowchart Procedure

used to communicated process where decision making is required

Plan

detailed strategy or tactic for doing/achieving something

AUP (Acceptable Use Policy)

- details user community obligations pertaining to information and information systems

- teaching document that should be written in a language that can be easily understood

- even though its called a policy, it has a lot of detail

NDA (Non Disclosure Agreement)

- establishes data ownership and reason data is being provided

- stipulates data use criteria, protects data disclosure, prevents forfeiture of patent rights, survives the relationship (e.g. even after you leave the company, you can still be under NDA for a certain time period)

Acceptable User Agreement

- by signing, user acknowledges that they understand and agree to the Acceptable Use Policy

- should be signed prior to being granted access to information/information systems