When developing or reorganizing a cyber security program, one can consider one of three basic structures as they relate to the cyber security program organization that the cyber security officer will manage and lead. The three basic options are:

One of the major factors in deciding what philosophy and approach to take is the culture of the corporation, as well as the charter of the cyber security officer spelling out the cyber security officer’s duties and responsibilities. The cyber security officer must remember that the more centralized the organization, the more problems and work for the cyber security officer and staff. The old adage “If you want it done right, do it yourself” may work for some, but as a cyber security officer, that approach will bring you more stress than usual. In addition, you will definitely age exponentially. Developing and maintaining a protected information environment for the corporation require the support and active involvement of all employees. Sometimes a cyber security officer forgets that and tries to take on the entire protection matter instead of leading a corporate team effort. Such an approach leads to more problems than solutions for developing and maintaining a protected information environment.

So, what should you do? The best approach seems to be a combination. For example, this corporate cyber security officer decided that the overall information and information systems protection logically should be centralized under the cyber security officer and cyber security program staff. After all, they have the experience and know-how to lead this effort. However, at the same time, why get burdened with trying to write and maintain current cyber security program procedures that must be implemented by the departments to comply with those cyber security program policies? So, procedures written for compliance, as previously stated, will be the responsibility of the corporate departments. Their adequacy will be determined through audits, cyber security program tests and evaluations, noncompliance inquiries, and the like.

In addition, the corporate departments will be responsible for developing, implementing, and maintaining the processes that are an integral part of the procedures needed to comply with the cyber security program.

This cyber security officer decided that the best approach is through the drivers’ (cyber security program–cyber security program requirements) baseline. So, based on the drivers, one is then able to develop a “needs” statement or statements. These can be set forth in various ways, such as the vision, mission, and quality statements, and incorporated into plans, for example, strategic, tactical, and annual, as previously discussed. Regardless of how and in what form you state these needs for the cyber security program, they must support corporate plans, policies, objectives, and goals and must also eventually be tied to action items.

These action items are then analyzed and are implemented—for example, established as cyber security program functions that are then incorporated into the cyber security officer’s cyber security program organization as its charter of responsibilities and accountabilities, as stated in the previous chapter. One step to look at is the process. A process is basically “a series of actions directed toward a particular aim.”² After the drivers and needs are identified, the cyber security officer must establish a process for meeting the identified requirements. The process is basically the details of how a function is to be performed.

The action items should be part of a formal project management program in which, as stated earlier, you, as the cyber security officer, determine that there is a need for some sort of cyber security program action that will take time and must be incorporated into the cyber security program organization. Remember, the project plans have:

There are many cyber security program-related functions; however, at this corporation, the cyber security officer determined that the functions identified in the cyber security officer’s charter were the main functions that were driven by or related to the baseline cyber security program. Therefore, they are the basic functions that should be established, and a flow process description should be developed relative to how the functions should be performed. For example³:

The cyber security officer’s reasoning was that no information should be protected any more than is necessary. The rationale used by the cyber security officer was as follows:

The value of information is time dependent. In other words, information has value for only a certain period of time. Information relative to a new, unique corporate widget must be highly protected, and that includes the electronic drawings, diagrams, processes, etc. However, once the new widget is announced to the public, complete with photographs of the widget, selling price, etc., much of the protected information no longer needs protection.

That information, which once required protection to maintain the secrecy of this new widget, can now be eliminated. This will save money for the corporation because cyber security program costs are a parasite on the profits of the corporation. Those costs must be reduced or eliminated as soon as possible. It is the task of the cyber security officer and staff to continuously look for methods to accomplish this objective.

The cyber security officer reasoned that each department created and used the corporate systems and their information. Therefore, they should be responsible for controlling access to those systems and information.

The major systems, such as the corporate-wide area network, were owned and operated by the IT Department, while individual systems and local area networks (LANs) were owned and operated by the individual departments.

As part of the cyber security program, the corporation, in coordination with other departments’ managers, established a process for all employees who required access to the systems to perform their job functions. Such employees would have to obtain system access approval from their manager and from the manager or designated representative of that system and/or the information owner, such as for financial database access. The owners’ approval was based on a justified need for access as stated by the employee’s manager. If the system and/or information owners agreed, access was granted.

The cyber security officer had found, during the initial evaluation of the cyber security program of the corporation, that departments had logically grouped their information into categories. They had done so to control access to their own files. This made it easy for the security officer, because the managers of the departments agreed that once access to systems was granted by the system owners, access to the information on those systems should be approved by the owners of those groups of files, databases, etc.

Thus, the access control process included a justification by an employee’s manager stating not only what systems, and why, the employee needed access to, but also what information he or she required access to in order to perform his or her job.

For the most part, this was an easy and logical process. For example, in the Accounting Department, personnel generally had access to the groups of files and databases based on their job functions—accounts payable, accounts receivable, etc.

This access control process helped maintain an audit trail of who approved access to whom and for what purposes. It also helped provide a separation of functions that is a vital component of any cyber security program. For example, an accounts payable person should not also be the accounts receivable person and the invoice processing person. Such a system would allow one person too much control over a process that can be—and has been—used for committing fraud.

The benefits of the foregoing process to the cyber security officer were that it documented an informal process that for the most part had been in place, and it also placed cyber security program responsibilities for systems and information access exactly where it belonged, with the identified owners of the systems and information.

In one instance, a cyber security officer found that one manager did not want to take responsibility for a LAN in the department, and since others outside the department used the information, the manager did not want to take ownership of the information. The manager thought the IT Department should be the owner—after all, they were responsible for the maintenance of the system.

The cyber security officer in this case asked the manager if the cyber security officer could then be responsible as the owner of the systems and the information. The manager quickly agreed. The cyber security officer then told the manager that since it was now owned by the cyber security program organization, access to the systems and information would be denied to all those not in the cyber security program organization.

The manager objected, stating that the personnel in his organization needed access to those systems and their information to perform their job functions. After further discussion, the organizational manager agreed that his organization would appear to be the logical owners and subsequently accepted that responsibility.

To perform this function with minimal impact on cost and installation schedules, it was determined that a baseline checklist would be developed and that this checklist would be completed by the suppliers of the product, in concert with the cyber security program staff. Any items that adversely affected the cyber security program would be evaluated based on a risk assessment, using the approved risk management and reporting process.

The process included completion of the baseline cyber security program checklist and a technical evaluation by cyber security program personnel in concert with IT personnel. If the item (hardware, software, etc.) was considered risk-acceptable, it was approved for purchase.

If the item was not risk-acceptable, the risk management process identified countermeasures. Although this process generally approves the purchase of almost all items, some items might have an unacceptable level of risk, but would still be accepted because of their value to the company. In those instances, special audit trails could be created to monitor the use of the item. In any case, the cyber security officer understood that it is always better at least to know that a system is vulnerable than not to know the vulnerability existed until it was too late.

The cyber security officer identified the several potential processes relative to new, modified, or upgraded systems’ hardware, software, and firmware implementation in which the protection of information and information systems could be subject to increased vulnerabilities. The cyber security officer decided to form a project team to evaluate these and other processes. The project team would include the cyber security officer’s staff specialist as the project lead, as well as IT representatives, department representatives, a procurement representative, a contracts representative, and a legal representative. These representatives were chosen for the following reasons:

The ST&E was developed to incorporate testing and evaluating of the total cyber security program processes, environments, hardware, software, and firmware as a proactive method to support risk assessments and the evaluation of the systems’ components.

The cyber security officer believed that the auditors’ compliance audits were more of a checklist process of ensuring compliance with the corporate cyber security program policies and procedures. What was needed, the cyber security officer reasoned, was a way to actually test cyber security program processes, systems, etc., to determine whether they were meeting the cyber security program needs of the corporation—regardless of whether they complied with the cyber security program policies and procedures.

For example, the ST&E would include periodically obtaining a user ID on a system with various access privileges. The cyber security program staff member using that identification would violate that system and attempt to gain unauthorized access to various files, databases, and systems. That information was analyzed in concert with a comparison of the system’s audit trails, thus profiling the cyber security program of a system or network. Also, the ST&E would include a review of records and prior audit trail documents to help establish the “cyber security program environment” being tested and evaluated.

Prior to discussing CEP-DR, it is important to understand why it is needed. It is really a very important aspect of a cyber security program and may even be its most vital part.

The cyber security officer must remember that the purpose of the cyber security program is to: