8 ◾ Official (ISC)
2
® Guide to the ISSMP® CBK®
© 2011 by Taylor & Francis Group, LLC
e above are all key pieces of information required for the ISSMP to ensure that
the most eective security is applied to the system. Some people may say that this
is the job of a systems analyst and they would be right, but it is recommended that
the ISSMP work closely with the systems analysts and designers to ensure that secu-
rity is considered during the entire development process.
Identity Management
e information collected has a major impact on the security needs of the system,
specically in the area of identity management, by identifying where the concepts
of “least privileges” and “role-based security” can be applied. Both of these concepts
are demonstrated in the following example:
There are three individuals who work in the payments section of a major corpora-
tion. Mary is the supervisor, who oversees the efforts of Sally and John. Sally and
John draft fund transfers from banks to pay corporate bills. Mary is the only one
who can authorize and make the transfers online. Each bank has a unique method
of authenticating Mary prior to her making a money transfer, i.e., one-time pass-
words and challenge-and-response tokens.
To make the transfers, Sally and John review the vendor invoices using a word-
processing program, and using that data they use a standard Funds Transfer Form
to create a Draft Funds Transfer, which they submit to Mary. Mary reviews the
Draft Funds Transfer and creates a Final Funds Transfer, using the word- processing
program. Mary then connects to the bank via the Internet using an Internet
browser program. With the connection to the bank, she authenticates to the bank
using the book or token authentication processes, which are secured in a safe that
only Mary has access to, and uploads the Final Funds Transfer to the bank. Upon
acceptance of the funds transfer the bank forwards a Transfer Confirmation Notice
to the system. At any time during this process any individual can print a copy of
any file. To ensure that proper oversight is conducted, the corporate auditors must
have access to all of the files that are created during this process.
Knowing all of this, the ISSMP can now recommend the “role-based” security
solutions that can be used to implement the concept of “least privilege.” Table1.2
provides a summary of the privileges that each role (“Drafter” [Sally and John],
“Approver” [Mary], and Auditor [senior management, auditing staff, or third-party
auditors]) will be granted in the system to support this scenario.
Note that in this example, Mary, although she is in the role of supervisor,
does not have full privileges in the system. Specifically, she cannot change the
Submitted Draft Funds Transfer or the Transfer Confirmation Notice. This is to
ensure that she cannot modify key documents required by the auditors to ensure
that the process and the actions of the employees are in full compliance with
standard accounting procedures.
Compliance
In addition to the mission, business, and operating requirements, the ISSMP must
understand the legal and regulatory restrictions and demands that are imposed on