Note: Major General John A. Davis (Retired) recently joined Palo Alto Networks as Federal Chief Security Officer. The below is excerpted from an article appearing in Cyber: The Magazine of the Military Cyber Professionals Association. Read the full article here.
I recently retired from active duty after a 35 year career in the U.S. military, the past decade of which has been devoted to the sometimes mysterious cyber world. I’d like to offer some insight into the personal lessons that I’ve learned during my experience in helping to stand up U.S. Cyber Command and while working cyber policies and strategies at the Pentagon. Although I’ve learned many more lessons, the three that I’ve chosen to share in this article are, in my view, especially important for leaders in both the public and private sectors, because we are all becoming increasingly connected through modern information technology. This means we all share in the exploding opportunities as well as the escalating risks. Below are my top three lessons and I will attempt to add more context in subsequent paragraphs to help both government and industry leaders understand why all sectors of society should care about these key points:
Strong teamwork and effective partnerships are essential to cybersecurity success.
The world is changing dramatically and so too must the balance between opportunity and risk in the information technology decision-making environment.
As more nation-state militaries become involved in cyber operations, we must shine more light on what they are doing and why, in order to set accurate expectations and prevent mistakes.
Lesson number one is about a real need for teamwork and effective partnerships. If I had to come up with a motto for this lesson it would be, “Make friends … lots of friends…you’re gonna need them!” If you think you can go it alone in the cybersecurity business, think again. Many different organizations, both public and private, have critical roles and responsibilities in the cybersecurity environment, but no single organization has all the skills, talent, resources, capabilities, capacity or authority to act effectively in isolation. It truly does take a team approach and strong partnerships to operate effectively. However, creating trusted, credible partnerships requires significant dedication of time and energy from the leadership of an organization.
Read John’s full article here.
Learn more about Palo Alto Networks solutions for government here.
During November 2013, South Africa enacted legislation that seeks to regulate the processing of personal information. It is known as the Protection of Personal Information Act of 2013 (POPIA). Given its infancy and the number of entities seeking compliance, it is understandable that existing resources are limited, constrained and, very likely, expensive. Once fully promulgated, entities processing personal information will have 12 months to demonstrate compliance. What follows is a glimpse into a personal journey towards building a privacy programme and how COBIT 5 has assisted in structuring the approach, consolidating research, thinking beyond IT, and providing detailed guidance in most areas of enablement and implementation.
COBIT 5, based on 5 key principles, is a comprehensive framework which helps enterprises, regardless of size or operation, create value from IT by maintaining a balance between realising benefits and optimising risk levels and resource use. These principles are:
Meeting Stakeholder Needs
Covering the Enterprise End-to-end
Applying a Single Integrated Framework
Enabling a Holistic Approach through the following set of Enablers:
Principles, Policies and Frameworks
Processes
Organisational Structures
Culture, Ethics and Behaviour
Information
Services, Infrastructure and Applications
People, Skills and Competencies
Separating Governance From Management
Meeting Stakeholder Needs
Besides information being ever more pervasive, an enterprise’s need to create and maintain value is made that much more challenging with the rapid evolution of disruptive technology. The rate and pace of change bring about new risk and sometimes diminish existing capabilities to contain and manage the risk.
Regardless of the operation, it is vital that all privacy-impacted processes and all stakeholders, internal and external, local or global, be identified and the stakeholders’ respective responsibilities be communicated, understood and enforced.
This is further impacted by the inherently sensitive nature of personal information and the additional requirements for protection it attracts. The case for responding to legislation should not only be driven by the need to achieve compliance. Risk mitigation, subsequent controls enhancement, audit assurance and opportunities for continuous improvement will certainly be value-driven consequences of an effective and ongoing privacy programme.
Covering the Enterprise End-to-end
Privacy issues affect the entire organisation. In today’s world it is difficult to imagine any entity, regardless of size, doing business in isolation. For example, there is the possibility that a doctor’s practice could communicate the personal information of its 2, and only, administrative staff to a bank when it comes to month-end salary payments and that same doctor’s practice could be using, storing and sharing the personal information of hundreds of patients. A medium-sized company could be collecting the biometric information of its employees to support attendance records or perhaps closed-circuit television (CCTV) images of its visitors as part of its security procedures. A supermarket chain could be sharing the personal information of its customers amongst various departments or possibly disclosing personal information to support some litigation or police investigation. A multinational organisation could task the processing of personal information to a division in a different country or, perhaps, to a third-party processor in another country.
Regardless of the operation, it is vital that all privacy-impacted processes and all stakeholders, internal and external, local or global, be identified and the stakeholders’ respective responsibilities be communicated, understood and enforced.
Applying a Single Integrated Framework
Many governments and regional authorities around the world have introduced some form of privacy legislation and, through various institutions, issued standards, frameworks and certifications that assist with the development and implementation of privacy programmes. These include, for example, the US National Institute of Standards and Technology (NIST), the International Organization for Standardization (ISO) and various information commissioners’ offices across Europe and Australasia as well as the International Association of Privacy Professionals (IAPP). Some may have a regional or national bias but, by and large, there is a high degree of overlap.
ISACA has produced, amongst others things, webinars, white papers, articles and training focusing on privacy. As a single, integrated framework, the maturity, depth and applicability of COBIT 5, even as it stands now, has proven very useful in consolidating my research and approach towards finalising a privacy programme—no doubt, in my opinion, preparing the way for a dedicated professional guide to data privacy.
Enabling a Holistic Approach
Like any goal on its balanced scorecard (BSC), the enterprise’s goal to achieve and maintain compliance with external laws and regulations, coupled with the related IT goals, must be translated to enabler goals. It is important to remember that these enablers should not only support IT-related goals, but should cut across the entire organisation. So, for example, while ‘Managed IT-related business risk’ may be a secondary IT-related goal, it is important to view the risk of non-compliance across the entire organisation. Principles, Policies and Frameworks
In any South African enterprise’s pursuit of its principle to operate within the bounds of legislative and regulatory demands, it must also look to the principles established in POPIA. South Africa’s newly introduced privacy legislation is based on the 8 core privacy protection principles found in legislation within jurisdictions such as the European Union (EU) and the Organisation for Economic Co-operation and Development (OECD). Clearly, it is imperative that the organisation’s executive must define and uphold a data privacy policy that covers all the requirements of the legislation. This is crucial to the organisation’s identification of all stakeholders as well as its understanding of the intent and direction towards the successful deployment and ongoing management and maintenance of its privacy programme.
Supporting the policy should be a code of conduct, standards, practices, procedures, rules and other policies that cover elements such as information classification, labelling, handling and protection, and clear guidelines as to the acceptable use of digital assets. Agreements between the company and any third-party operators or processors must clearly define roles and responsibilities, rights to audit or assess, and consequences for non-compliance. Binding corporate rules are essential to communicating the data privacy policy’s intent and direction across divisions of a South African-based multinational.
A CCTV policy is essential where CCTV is in use. Existing policies, such as monitoring policies in human resources (HR), must be optimised. Depending on operations, data sharing or disclosure policies must be considered. Referencing such frameworks as those mentioned earlier is essential.
The related requirements of other associated South African legislation must also be considered. These include legislation covering areas such as consumer protection, public access to information, credit regulation, interception of communications, electronic communications and transactions, and any codes of conduct as may be defined by industries such as health or finance. Processes
Bear in mind that the enterprise must be covered end to end. While the goals cascade typically culminates in IT-related processes, applying it beyond IT should trigger ideas or opportunities for its application in business-related processes.
By way of example, consider the enterprise goal of compliance mapping to the IT-related goal of compliance, which, in turn, maps to primary COBIT 5 processes such as APO12 Manage Risk and APO13 Manage Security. It is quite possible that, while IT is responsible for controlling the physical access to data centres, services such as building access control or CCTV monitoring are not necessarily managed or controlled by IT, but rather by the business security division. In this scenario, business security and HR would be the primary stakeholders responsible for ensuring compliance with privacy legislation. Organisational Structures
POPIA defines an information officer as being the head of any organisation. He or she is ultimately accountable for the organisation’s compliance. Of course, deputy information officers may be appointed. When developing a Responsible, Accountable, Consulted, Informed (RACI) chart, top-down, bottom-up, internal-external and local-global are the dimensions to be considered.
External stakeholders include the regulator and all data subjects, suppliers and outsourced partners. Internally, information owners (or producers) such as a sales manager or an HR director are specifically responsible for the appropriate access to and classification, integrity and handling of information of their respective data subjects, i.e., customers and employees, respectively. IT is specifically responsible for information custodianship.
These responsibilities cut across the information life cycle from collection and usage to storage and eventual demise. Employees who might be tasked with using personal information also have a duty of care. The heads of legal, internal control and business security must ensure that the management of privacy risk and assurance is embedded in the enterprise risk management process. Staff must understand the procedures to follow in order to facilitate a subject’s data access request or in the event of a privacy breach. Culture, Ethics and Behaviour
As robust as technical controls may be, human behaviour is regularly identified as the weak link causing a security (and, potentially, privacy) breach. A sensitive discussion in an airport lounge, unverified meeting attendees, a lost or stolen unencrypted laptop or flash drive, a soft hack via switchboard, unshredded confidential waste and an uncleaned whiteboard are examples of potential breach scenarios triggered by human behaviour. The executive and senior management must set the tone at the top and lead by example. Everyone is responsible—from the executive through to the person tasked with cleaning a whiteboard after meetings.
Privacy rights and expected behaviours should be embedded in a code of conduct. It is important to stay focused and have the creativity and stamina to maintain training and awareness. One way to do that, for example, is to have an annual privacy housekeeping week. It is also a good practice to recognise good behaviour. A privacy programme is ongoing and not a one-time-only event.
In today’s world, people easily, sometimes recklessly, and other times unknowingly give up their rights to privacy. There are big wins in getting employees to appreciate their rights as enshrined in POPIA. It should stand to reason that they would then appreciate how to handle the personal information of others when going about their normal course of business. ‘Know your rights, know your responsibilities!’ could be a good maxim. Information
Information can be structured or unstructured, formalised or informalised, digital or physical, and, as we know, pervasive throughout the enterprise. Many would concur that information is the organisation’s most important asset. Stakeholders deriving value from the processing of information can be both internal and external. The conditions, or principles, in POPIA cut to the heart of the proper processing of not only personal information, but also special personal information as well as the personal information of children. These conditions include:
Processing with limitations and for a specific purpose
Ensuring information quality and openness with data subjects
Maintaining confidentiality
Maintaining availability and integrity
Facilitating data subjects’ access to their information
A breach of these conditions could lead to litigation with severe financial and reputational implications. It is useful to bear in mind the multiple stages of processing, from collection through demise.
There are a multitude of frameworks, standards and guides provided by the likes of NIST, SANS Critical Security Controls, ISO and ISACA that cover topics such as cyber and information security, privacy risk management, privacy impact analysis, and privacy by design. For example, NIST’s Guide to Protecting the Confidentiality of Personally Identifiable Information (PII) provides specific focus to personal information, especially identification, impact levels, safeguards and breach response.
The COBIT 5 professional guides COBIT 5 for Information Security and COBIT 5 for Risk, though similar and complementary to other guides, regularly provide much more detailed guidance, especially around enablement and implementation. COBIT 5 for Information Security addresses all 7 enablers and is particularly useful in triggering ideas for identifying and responding to privacy-related matters.
The COBIT 5 enabler guide COBIT 5: Enabling Information also proves similar, complementary and more detailed guidance. However, in my opinion, the enabler guide, through addressing various governance and management issues, provides a more contemporary view and approach by including topics such as big data, predictive analytics and privacy. It may also prove worthwhile reading the ISACA white paper Privacy and Big Data. A useful insight gained from a recent ISACA webinar is that there can be no privacy without security and that security alone cannot assure privacy.
Though, traditionally, it can be said that IT is the custodian of the greater portion of an organisation’s information, the issues of disintermediation, as well as cloud computing, bring about a fresh set of risk factors for security and privacy management. With cloud computing, the development and acceptance of standards, specifications and guidelines appear to be in their relevant infancy. Affected organisations would be wise to pay special attention to these areas when it comes to processing of personal information. Services, Infrastructure and Applications
Of particular concern should be the extent to which privacy-related issues and requirements are identified, embedded and managed within services, infrastructure and applications. In application development, for example, has privacy by design been considered and adopted? To what extent are outsourced service providers privacy-compliant? Are service level agreements (SLAs) optimised to reflect any privacy-related requirements? Do architecture principles embody privacy requirements? If not, could this, for example, be a reason for the pain experienced by HR in using in-house technology or systems? People, Skills and Competencies
The successful development, implementation and ongoing management of a privacy programme is dependent on people, skills and competencies throughout the information life cycle. These will most likely be identified in a properly planned privacy programme. Resource development and utilisation can be optimised by aligning with HR and HR processes, promoting the appropriate accreditations and participating in global privacy and information security forums.
Separating Governance From Management
Given the infancy of the legislation and its partial overlap with existing legislation (see earlier examples), there is the risk that some, especially senior, stakeholders may discount the importance, urgency or essence of privacy requirements. This could be due to their knowledge of existing legislation and their assumption that POPIA is, basically, covered by existing legislation. How does the executive level effectively evaluate, direct and monitor if it starts off with this assumption? POPIA states that accountability lies with the head of the organisation. It is often too easy for the chief executive officer (CEO) to delegate responsibility without realising the implications of unclear directions to and expectations of management.
Management must ensure that it has a clear understanding of the data privacy policy requirements and must be empowered to justify, deploy and manage the resources necessary to deliver the privacy programme. As the executive will depend on reliable data for risk management and breach response, management must ensure the efficient deployment and maintenance of the privacy programme.
Where to Next?
At the time of writing, POPIA has been partially promulgated, which means that the Regulator’s office will soon be established. Certain issues requiring clarity should then be addressed so that privacy programmes can be formalised. This is not to say that the journey to compliance should only start then. Most organisations should already have implemented, for example, an information security management system or a CCTV policy or application access controls. The challenge will come in identifying the specific privacy requirements and how they should be incorporated into existing business activity.
Russell Raizenberg, CGEIT, CRISC
Is an independent consultant who develops privacy and risk management solutions for clients. Previously, he was employed with BP Southern Africa in various roles which included accountant, IT manager, IT risk and compliance manager, and project manager in South Africa and at various African affiliates of BP.
The Incident Management and Forensics Working Group today released its “Cloud Forensics Capability Maturity Model”, a new research report that describes a Capability Maturity Model (CMM) that can be used by both cloud consumers and Cloud Service Providers (CSPs) in assessing their process maturity for conducting digital forensic investigations in the cloud environment.
Even the most capable enterprise cannot avoid data breaches entirely. As such, there is a rising need for enterprises to adopt mature forensic security processes. This need will rise at least at the speed at which adversaries improve their attack strategies and techniques. This situation is even more complex in the world of cloud computing. Only with close cooperation between the cloud consumer (who has given up some control) and the CSP (who has inherited it) can adequate, timely and accurate forensic analysis occur.
The target audience for this paper is enterprise users that deal with all aspects
(technical and organizational) of their forensic processes, and that plan to or have
already integrated cloud IaaS services into their IT infrastructure. The starting point for the model was the Carnegie Mellon University Software Engineering Institute’s (SEI) “Software Process Maturity Framework” which identifies five progressive levels of process maturity.
CSA’s Incident Management and Forensics Working Group today released its “Cloud Forensics Capability Maturity Model”, a new research report that describes a Capability Maturity Model (CMM) that can be used by both cloud consumers and Cloud Service Providers (CSPs) in assessing their process maturity for conducting digital forensic investigations in the cloud environment.
Even the most capable enterprise cannot avoid data breaches entirely. As such, there is a rising need for enterprises to adopt mature forensic security processes. This need will rise at least at the speed at which adversaries improve their attack strategies and techniques. This situation is even more complex in the world of cloud computing. Only with close cooperation between the cloud consumer (who has given up some control) and the CSP (who has inherited it) can adequate, timely and accurate forensic analysis occur.
The target audience for this paper is enterprise users that deal with all aspects (technical and organizational) of their forensic processes, and that plan to or have already integrated cloud IaaS services into their IT infrastructure. The starting point for the model was the Carnegie Mellon University Software Engineering Institute’s (SEI) “Software Process Maturity Framework” which identifies five progressive levels of process maturity:
LEVEL
SEI Capability
Forensics Question
1
Initial
How are we ever going to do this?
2
Repeatable
Have we done this before?
3
Defined
What is our process for doing this?
4
Managed
What resources did this require?
5
Optimizing
How can we do this better?
The report provides detailed guidance for each question via scenario planning and recommended process mapping.
As security vendors, we talk a lot about how technology can help maintain our way of life in the digital age by providing the mechanisms to prevent attacks. The other two pieces of that prevention story, however, rely on people and processes.
In the past there was a real shortage of people skilled in the basics of cybersecurity, which meant that cybersecurity roles weren’t filled anywhere near as quickly as they were needed, or inexperienced people were hired and forced to learn on the job, both of which posed huge risks to organizations. I think this is still somewhat true today — there are more cybersecurity roles needed than there are seasoned cybersecurity professionals — but we’ve made progress in solving this problem.
A growing number of universities in the U.S. have added cybersecurity-related degree programs to their educational offerings.
Most of these programs offer online courses, including virtual lab environments and an array of different security technologies. A few offer both bachelor’s and master’s programs.
Courses offered teach network management and security, web security, data privacy and regulations, forensics and gathering data from multiple sensors, applied cryptography, and offensive security (pen-testing), to name a few.
The eventual impact of formalized cybersecurity education, despite concerns, should be positive in the following ways:
At a minimum, formalized cybersecurity courses should raise the general public’s awareness level around how to more safely use the Internet. I don’t expect that the average person will be able to describe the OSI layers or know what SQL injection is, and I’m certain that this increase in general knowledge will be slow, but I do expect that the layman will at least think twice before sticking with default passwords, for example. This should also decrease the amount of insider negligence.
It will become less difficult to hire and retain expert staff. Though technical training within different cybersecurity degree programs may differ, the very fact that it’s now an option for students means that it’s more accessible to a broader audience. Students who may not have otherwise known cybersecurity was a career they could choose may find out that they’re interested in pursuing it. MBA candidates whose goal might be to attain a C-level title can get the education they’ll need to become effective CIOs and CISOs.
If Stan Lee has taught me anything, I know that with great power (that is, knowledge) comes great responsibility, and ultimately a choice must be made: do I use this knowledge for good or evil? Cybersecurity graduates will be faced with several job prospects, including working for cybercriminal organizations. The very fact that we’ll have a larger pool of security experts means that we also risk a larger number turning to the “dark side” and putting on black hats. However, better access to cybersecurity education should also mean more resources for law enforcement to crack down on cyber crime and the individuals perpetrating it.
I prefer to think positively.
It’s certainly a sign of progress when, in the span of 15 years, we’ve come from a time when information security wasn’t really taken seriously, to an age when cybersecurity is so ubiquitous as to warrant its own major within several universities. We now have so many educational institutions offering cybersecurity-related degrees that we can make a Top 10 list for online degree programs alone.
If you haven’t already, think about enhancing your formal skills and enrolling in one of these programs, or ask your company if they’ll sponsor you. Better yet, contribute to our future by letting your kids know that they can now go to college to learn how to hack.
