With cyber criminals becoming smarter and innovative day by day, it takes a lot for an organization to be one step ahead in the battle. When an unauthorized person gains access to confidential data, he can inflict great harm to the unsuspecting customer. Therefore, IT Security Governance is a critical business function for IT Managers in all organizations. Security experts are of the view that a well designed and structured information security protocol will help reduce data breaches to negligible levels. However, they caution, it is not a static protocol, it has to be constantly upgraded to be an effective management tool.
The necessary steps to have a robust IT Security Program are:
Step 1 – Establish a program for Information security and governance
To manage an information security program a well structured governance plan should also be in place simultaneously. The governance plan will help in the following ways:
- Help align the security structure with business objectives of the organization
- Risk of data breaches will be effectively curtailed and managed
- Allocated resources are properly utilized making the entire program cost effective
- All stakeholders will be on the same page instead of working at cross purposes
To start a governance program the initial steps are:
- Establish a security committee consisting of senior staff, armed with sufficient authority
- Clearly define the roles and responsibility of each arm of the business
- Have a clear, well defined, reporting structure as this will eliminate multiple power centers
Step 2 – Design an information security strategy
The security strategy should be aligned to the business goals of the organization. Each arm of the security strategy should take care of one or more of the organization’s business goals. Once approved, it usually takes about two years to fully implement and test the strategy.
Step 3 – Create a risk and compliance management process
Due to compliance needs to meet regulations or industry standards, the organization should create a risk management process within the overall security program. This is very important as compliance with the law is essential and a breach will expose the organization to criminal liability and huge costs. The risk assessment strategy should cover all levels of the organization, processes and technology. Sufficient training should be given to staff to ensure they understand the importance and implications of the information security program.
Step 4 – Day to day security operations
There will be day to day security operations to ensure the entire security governance plan is working as intended. Some of the daily review and scrutiny activities for security governance are:
- Managing security technology
- Change control process
- Review of logs of various operations
- ID Administration and control
- Security patches
- Security updates and warnings
- Regulatory updates
To determine the efficacy of the security scenario, metrics can be used and depending on the results, parts of the security regime can be tweaked for improvement. Each organization will use different metrics since they have different business goals and security needs.
Step 5 – Incidence response management
In spite of all that is done in the field of security and its governance, no organization is absolutely immune from a security breach. Therefore, it is imperative that a sound, comprehensive incident response plan be implemented and tested at frequent intervals. The three arms of incidence response management are:
- First responders – they will swing into action as soon as a data breach occurs
- Forensic investigation – this team will investigate how the security breach occurred
- Evidence preservation, Business Continuity and Communication – they have the responsibility to see that the evidence of the breach is preserved and not accidentally erased. They will also set in motion the communications needed with all stake holders and also start the process to ensure Business Continuity
In today’s world, a sound information security governance structure is essential. A well planned, tried and tested program will go a long way in preventing data breaches in an organization.
Disasters
