Organizational Support for IT Security Policy Enforcement
Abuse of a company’s technology can leave it at risk. Failure to follow policies can lead to regulatory noncompliance. Failure to follow up and resolve issues can result in lawsuits. These situations can lead to more regulatory sanctions and expensive legal fees.
Enforcement of security policies needs to be ingrained in an organization. Many people must participate—enforcing policies is not a one-person role. Enforcement of policies is achieved through layers. This includes organizational committees enforcing policies and monitoring workers’ actions. Each layer validates that security policies are being followed. The goal is to build awareness and enforcement throughout the organization over time. IT security policy compliance is everyone’s role.
NOTE
The introduction of new policies forces change within the existing culture. Unfortunately, security policy changes are needed. For example, new threats emerge and new policies are required to address them. It is also true that many people tend to resist change. It’s important that change be discussed well in advance of introducing new policies. Individuals must internalize and embrace policies for them to be effective.
An organization needs to decide what it wants to accomplish through policy enforcement. The organization can choose to focus on a limited number of areas such as access control, data leakage protection, and virus protection. Alternatively, the organization can use policies to enforce change in the culture. Certainly, enforcing security policies changes habits and thus the culture. Whatever the specifics, policy enforcement must have a goal. The most obvious is to ensure compliance with policies—but that is somewhat circular. Sometimes companies have ineffective policies. This often stems from not thinking clearly about policy goals. If your goal is good password management, but your policy requires a 50-character random password, that will almost guarantee employees write down their password because they cannot remember it. In this case, you have actually subverted your real goal by enforcing this unreasonable policy.
When introducing change, remember that it may create conflict. Security policies may conflict with how people naturally react. For example, you’ve been trained on social norms such as the simple act of opening the door for someone. You probably see these acts as being polite. Yet a security policy prohibits opening a door or allowing someone behind you to gain entry. You’re expected to deny access to uncredentialed workers and perhaps even to a well-liked coworker. Policies may require you to deny access to senior executives. These seem like small issues, but they can create internal conflict and uneasiness in workers. These conflicts are inevitable. Workers who take a commonsense approach may have their thinking challenged. Nevertheless, part of enforcement is recognizing the conflicts and working with employees to overcome them.
NOTE
The person primarily responsible for setting goals in security should be the chief information security officer (CISO). The CISO’s key task is to build support for implementing security policies and programs within the executive ranks. The CISO’s ability to build personal relationships with executives and gain their trust is the most effective tool for implementing security.
Executive Management Sponsorship
Executive management today is pulled in many directions. It’s a fast-paced world, for some industries more so than others. To be effective, executives need to be surrounded by employees with a strong sense of clarity, purpose, and action. Effective leaders have the ability to encourage people to achieve the leaders’ goals. They lead the organization in the right direction in order to achieve a specific goal. They use their values, knowledge, and skills to motivate and get others to excel. Effective executives persuade people to do the right thing for a better future.
Executive management support is not just about budgets and mandates. When you have executive management support, you have powerful allies. Executives can overcome objections and persuade an organization to adopt policies. They can coach the chief information security officer (CISO) on how to avoid pitfalls.
Executive support is key to security policy enforcement. At some point in the enforcement process you need to change workers’ behaviors. This can require disciplinary action. Even taking workers aside and coaching them runs the risk of negatively impacting a department. It is important that you lay the foundation for such discussions in advance. You accomplish this through the executive of the department. This executive can send a clear message that there’s zero tolerance for ignoring security policies. The executive must be clear that violations of policies will be taken seriously. This type of message establishes a tone at the top.
TIP
Work with the people who report directly to executive management before presenting any proposal. Direct reports are often trusted advisers. Even if you have a good idea, the executives often defer decisions until they can discuss the issue with advisers. By presenting your proposal to the adviser first, you avoid delays. Advisers can also be strong advocates for you with the executive.
Governance Versus Management Organizational Structure
Enforcement is most effective when it comes from the employees’ own leadership. Information security teams often do not enforce policies directly. Security teams do not directly manage all employees and thus, typically cannot “order” an employee to comply with policies. So how do security policies get enforced? Usually security teams monitor for compliance and then report noncompliance to leadership. It’s then up to leadership to direct employees and ensure the right behavior occurs. This can include disciplinary action up to and including termination (firing) in the case of a serious violation of security policies.
It’s important to remember that the employees look to executive management for direction. The executive leaders are expected to lead by example. This means they follow the same policies as employees. When they exempt themselves, they devalue the importance of the policies.
Executive management should take an active interest in key performance indicators and show continued support for the program. They should be visible in approving any deviation from policies and approve it only when necessary. This visibility sends a powerful message about the importance of security policies and risk management. When an incident does occur, this preparation creates less chance of pushback. The executive is more likely to enforce policies to support his or her personal credibility. Once executives put their own credibility behind policies, they are less likely to allow violations to occur.
Finding the right level of leadership to take action can be a challenge. It’s generally more effective to have leadership governance and management committees responsible for IT security policy enforcement. There is a difference between governance and management within an organization. To see this difference, consider Control Objectives for Information and related Technology (COBIT) 5.0 definitions, as illustrated in FIGURE 14-1. As you see by the figure, governance sets strategic direction, and management executives run day-to-day operations. Governance, as defined by COBIT 5, “ensures that enterprise objectives are achieved” and directs management to execute. It’s these governance processes that balance competing interests such as the business needs to make a profit and the customer needs to buy services at a fair price. Governance sets the direction for management to follow. It’s then up to management to achieve its goals “in alignment with the direction” set by the governance processes. Management is responsible for running day-to-day operations. Both organizational structures monitor activity.
FIGURE 14-1 How governance and management work together within the COBIT 5.0 framework.
Governance committees are more likely to monitor activity after the fact and in the aggregate to assess whether goals are being achieved. Management committees are likely to monitor activities before, during, and after as part of running the operations. What does this mean for the compliance program? It means that you need to monitor the effectiveness of quality assurance within management processes.
Management committees are responsible for running the business. As they run these processes, they need to be checking whether security is in place. For example, as they create an ID, they also need to ensure it has the right kind of access before it is issued. Before moving code into production, management needs to make sure it has all the security features turned on.
Both management and governance committees would be interested in results from QC reviews and compliance assessment. Remember, governance generally deals with issues in the aggregate. What that means is that governance cares about the accumulation of issues that would impact the organization’s goals. For example, governance might care that 30 percent of the online systems fail a Payment Card Industry Data Security Standard (PCI DSS) vulnerability assessment. Governance committees tend to focus on total amount of PCI DSS testing rather than any one specific test. The 30-percent failure rate might indicate potential risk of fines, or the risk that a hacker could disrupt the company’s ability to accept credit cards. These risks could impact the company’s goals and objectives.
Management would also be interested in the PCI DSS assessment. Management would want to know a range of details, such as which vulnerabilities failed and on which systems. Management would want to know why the QA processes were not able to detect the problem before the systems went into production. Management processes typically deal with the detail needed to run the business day-to-day, whereas governance deals with setting strategic direction.
Both management and governance committees are generally provided monitoring reports from the compliance program. These compliance reports provide the information needed for leadership to take action. Additionally, the management processes are generally used to identify root causes and recommendations for fixing any noncompliance problems.
To continue the 30-percent PCI DSS assessment example, management might identify a root cause for the high rate of failure. The problem may be due to outdated technology. Management may recommend an increased budget to replace the outdated technology. Governance processes consider the recommendation and the impact of the situation on the organization’s goals, and they approve funding for the technology replacement.
The Hierarchical Organizational Approach to Security Policy Implementation
The organization itself has a role in enforcing policies. This is typically handled through gateway committees. These committees are executive management processes to review technology activity. They often provide approvals before a project or activity can proceed to the next stage. This is why they are referred to as “gateways.” They are literally the gateway for new technology projects entering the organization.
Some organizations combine different functions into one oversight board. Larger organizations often separate committee functions. The names of these committees depend on the organization. Regardless of how these committees are combined or divided, the membership should include senior leaders across the organization.
Don’t get confused by committee names or the number of committees in an organization. The key is to understand how committees within an organization view risk and enforce policies. The following are committee roles and responsibilities found in most organizations:
- Project committee—Approves project funding, phases, and base requirements
- Architecture review committee—Approves standard technologies and architectures
- External connection committee—Approves external data connections
- Vendor governance committee—Approves new vendors and oversight of existing vendors
- Security compliance committee—Approves controls for compliance with laws and regulations such as Sarbanes-Oxley (SOX)
- Operational risk committee—Approves risk tolerance and oversight of risk exposure to the business
These committees have line of sight into all major projects and initiatives within the organization. Each committee looks at risk from a different perspective; however, they all play a role in enforcing security policies.
TIP
Committees often have charters. These are formal documents that outline the mission and goals of the committee. These charters are valuable sources of information as to the function of the committee.
Project Committee
The project committee reviews project concepts, designs, and testing phases. It approves when a project can go into production. The number of phases requiring the committee’s approval depends on the project life cycle (PLC). The intent is to identify project problems early to reduce costly mistakes. This external project review is an ideal time to examine any security policy issues.
This committee has the authority to stop a project that fails to adhere to policy. This is a powerful organizational enforcement mechanism. At a minimum, the committee asks the project team about any known security policy deviations. Additionally, representatives from the security team are members of the committee. They can ask focused security policy questions. For example, they may ask PCI DSS compliance questions about a new online credit card processing system being deployed. The security or audit staff often perform an assessment of a project. That assessment would be submitted to the committee for resolution of any security policy issues.
Architecture Review Committee
The architecture review committee promotes standard use of technology and architecture. By creating architectural models to be followed, the organization can more rapidly deploy consistent technology solutions. These models usually have much of the security policies embedded in their design. Consequently, deploying standard sets of technology ensures highly reliable and compliant solutions.
This committee has the authority to stop a project that fails to adhere to these technology standards. The committee can enforce security policies. This is accomplished by deploying technology solutions that are compliant with security policies. Additionally, the committee needs to resist adopting technology that deviates from the security policies. When noncompliant technology needs to be adopted, the risk must be accepted by the business. The committee presents the risk and technology recommendation to the business.
External Connection Committee
The external connection committee defines how data is transmitted outside the organization. This includes how and what data is sent and received. This committee works closely with the vendor governance committee to make sure no external connections to unauthorized parties are approved. A focus of the committee is the security and reliability of these third-party connections. For organizations with little external connection, these responsibilities may be rolled into other committees, such as the architectural review committee. Another focus is defining what data may be sent to a third party. The committee generally does not give blanket approval for all types of data to be sent once a secure connection is built.
This committee typically enforces communication and encryption security requirements. No connections that violate these policies are approved.
TIP
Sending sensitive or confidential data outside the organization to a third party must be considered a major decision and event. Make sure the third party has adequate controls in place before turning on the external connection.
Vendor Governance Committee
The vendor governance committee has both a business and a technology role. The business role is the oversight of the vendor relations. This role ensures that vendors deliver on commitments. In other words, this committee ensures that the vendor meets the service level agreement (SLA) in the contract. The committee also examines concerns about product quality.
The technical role of the committee is to ensure that the vendor complies with contracted policies. These contracted policies should be at least as restrictive as your own policies. For example, assume you identified a security policy requirement to log access to a file. This is to be compliant with a regulation. Just because that file is now transmitted to a vendor to be processed doesn't mean the security policy requirement for logging ceases to exist.
Vendor contract requirements must require a level of care for data equal to or better than the organization’s. Vendor governance policies must require the organization to put in place a way of ensuring such care is taken. It’s not adequate to simply sign a contract. Accountability for that data remains with the organization. For example, under the Gramm-Leach-Bliley Act (GLBA), a bank is responsible for protecting an individual’s personal financial records. The bank is still accountable if a vendor on the bank’s behalf processes that data.
The bank must ensure the vendor has adequate controls in place. This can be accomplished by auditing the vendor. You can also ask the vendor to provide evidence of a recent audit. The contract itself, which is a promise by the vendor, is not considered evidence that the vendor is adequately handling the bank’s data.
Security Compliance Committee
The security compliance committee typically has many roles. One of the key roles is to determine when policy violations occur. The security compliance committee reviews risk and vulnerability assessments. The committee often focuses on pervasive controls. A pervasive control is a common control that is used across a significant population of systems, applications, and operations. For example, assume the same ID and password can be used across many systems and applications. That control would be considered pervasive in the environment. The security compliance committee role is to ensure those controls conform to the security policies. The committee may also be a gateway for projects to ensure that controls follow policies.
It is important that pervasive controls comply with security policies. These controls have significant impact on securing systems and applications. If there is a weakness in one of these controls, a weakness exists throughout the infrastructure. These controls are also critical to compliance testing. For example, many organizations rely on these controls for SOX compliance. When these controls do not work, organizations can find themselves out of compliance with key regulations.
Operational Risk Committee
The operational risk committee, often referred to as ops risk, has both a business and a technology role. The committee’s primary role is to manage risk to the business. The operational risk function makes sure the business is operating within risk appetite and risk tolerance. For example, ensuring proper segregation of duties can ensure that some risks are properly controlled.
To illustrate this point: You would not want the same person to be able both to set up a vendor and to order and accept goods from that vendor. If you did, that person could set up a fake vendor. The person could then order goods without receiving anything, but would trigger an invoice, which the company would then pay. This means the company would have paid a fake vendor who supplied no goods. The dishonest employee, in other words, would have created a channel to divert funds from the company to a partner in crime, or even to his or her own bank account.
The ops risk committee has an enforcement role for security policies. The committee is responsible for ensuring that the policies are adequate to control key business risks. Security policies, by definition, control business risk. This means the committee is required to approve any deviations from security policies, thus accepting the accompanying risk.
The operational risk committee views risk as an individual event and as a portfolio of risks. By looking at risk both ways, the committee can determine a risk tolerance for the organization. For example, suppose the committee finds isolated instances of policy violation. Perhaps it’s too expensive to replace outdated technology. These isolated instances may be acceptable risks individually; however, the combination of so many isolated cases may undermine a key compliance program. The committee needs to look at accepting risk both from the specific event and as part of a larger portfolio of risk.
The CISO or delegate is typically a committee member. He or she plays an important role by explaining the level of risks accepted by the committee on behalf of the business. Other members of this committee are typically business leaders. These leaders help enforce security policies within the business.
Organizations vary in size and management approach. As a result, the number of committees and their responsibilities can vary. Some organizations combine the functions of several of these committees. The key point is that these responsibilities need to be formally assigned to some committee within the organization.
Front-Line Managers’ and Supervisors’ Responsibility and Accountability
Once policies are established, management must figure out how to implement them. This includes making the policies operational. For line management that means the following:
- Ensuring everyone on the front-line team is trained
- Taking on the role as the go-to person for questions
- Applying the policies consistently
- Gathering metrics on the policy’s effectiveness
- Ensuring everyone follows the policy
Front-line managers and supervisors work with employees every day. They see what works and what does not. They need to work with their teams to make sure everyone understands the new policies. Managers ensure everyone has gone through awareness training. They also answer any outstanding questions. If they don’t know the answers, they find out where to get the information. They are responsible for ensuring their team is ready to implement policies. They also ensure the policy rollout is on schedule within their team’s responsibility.
Front-line managers and supervisors are directly accountable to ensure that employees are implementing the policies consistently. This oversight includes gathering metrics on how well the implementation is working. Sometimes policies have unintended consequences. These individuals need to document the situation when policies don’t work out as designed. They are responsible for notifying management of issues and problems.
Inevitably, something will go wrong. If someone fails to follow policy, managers are responsible for finding out why and resolving the problem. Sometimes that includes disciplining an employee. Other times, it is more a matter of finding out why the employee wasn’t successful and overcoming the problem with coaching or additional training.
The result of these managers’ and supervisors’ efforts is enforced policies. These efforts ensure policies are implemented and are working properly.
Grass-Roots Employees
Employees react to the environment around them. It’s rare that a worker comes to work with the intent not to follow a security policy. Obviously, it is possible that employees with malicious intent could exist in an organization; however, this is not the primary cause for failure to adhere to policies. Often it is that they don’t fully understand the policy, or it is very inconvenient to adhere to. The problem is exacerbated if policy enforcement is either nonexistent or inconsistent.
This means that employees have great influence over coworker actions. If one employee is violating some policy with apparent impunity, it becomes more likely that other employees will consider violating that policy. This peer pressure provides a grass-roots enforcement method. In close-knit teams, peer pressure can be a tremendous asset. Such pressure is most effective when employees know that infractions will bring scrutiny and lead to embarrassment in front of the group. The key is management’s response to security policy violations. The peer pressure is more likely to be applied when the response of management is visible. This is similar to driving on a road in the United States. If you see several other drivers exceeding the speed limit by 10 miles per hour without consequence, you may feel emboldened to speed yourself.
Enforcement need not always be punitive. Rewards can also be a means of policy enforcement. If someone is exemplary at following some critical policy, they should be recognized. If a given team or department goes for an extended period of time without any incidents, they should be rewarded. The specific criteria and mechanisms for reward will vary among organizations.
Employees are key to understanding how to align policies to business. They understand the level of risk for a particular business function. Based on that risk, appropriate enforcement can be applied from employees, front-line managers, and supervisors.
Policies evolve as the business evolves. The risk management process must have a feedback loop from employees to ensure that the policies still make sense for the business.