In the last two columns, I introduced the excellent booklet called Visible Ops Security: Achieving Common Security and IT Operations Objectives in 4 Practical Steps, by Gene Kim, Paul Love and George Spafford.
Today I’m reviewing their chapter entitled, “Phase 2: Find Business Risks and Fix Fragile Artifacts.”
The chapter begins with a summary explaining that with infinite risks and finite resources and time, we have to focus our attention on securing critical areas of the business. As with the Phase 1 chapter, this one also includes a succinct and sometimes amusing chart of common issues. Some of the highlights (or lowlights, depending on your perspective) that had me chuckling with recognition include the following (quoting):
• Information security often can’t focus its efforts on the top risk areas (We have hundreds of business applications that we need to secure and support… There is just no way that our information security team can stay on top of it all. We are spread way too thin. I figure that each one of us is covering hundreds of systems and thousands of controls.”
• Must repeat audit work year after year (We are repeating a lot of documentation and substantiation work for IT controls… Last year we spent thousands of hours on this. And we’re going to do it all over again this year. / Why? Because instead of building controls into daily IT operations, we substantiate the presence of controls after the fact.)
• Top-down risk-based processes never finish (There’s some hope that the new Enterprise Risk Management [ERM] task force will address some of these issues… The problem is that they’ve been at it for three years, and there are no indications that the consultants they’re using are ever going to leave. In fact, the only certain thing is their next invoice, and another one of their horrible half-day workshops.)
The authors explain, “we extend the focus of Phase 2 beyond just operational risks, to those risks relevant to information security, compliance, and financial reporting. To make sure that we focus on what really matters, we go through an explicit scoping step for IT services and systems to ensure that we can explicitly link information security controls to risks that can affect the achievement of business objectives or requirements.”
Their methodology includes the following approaches, each step of which is fully explained in the text (in the unquoted sections, I am merely summarizing highlights):
• “Establish an initial scope of the business process and IT services and systems that really matter by using a top-down, risk-based approach.”
• “Cover the periphery” (identify “externally facing systems” whose compromise could cause catastrophic consequences)
• “Zoom out to rule out” (ensure that we are focusing on business issues, not noodling around interesting technical issues regardless of whether they matter in real-world consequences)
• “Find and fix IT control issues” (identify the business functions where controls are inadequate to reduce risk and mitigate damage from breaches of security)
• “Streamline IT controls for regulatory compliance” (build reusable controls that can save time and money for all sectors of the enterprise in meeting security standards)
Their discussion continues with excellent examples drawn from cases involving Sarbanes-Oxley compliance and then turns to principles enunciated by the Institute of Internal Auditors (IIA) Research Foundation called the “Guide to the Assessment of IT General Controls Scope Based on Risk” or “GAIT.” The IIA makes four documents freely available for download about this methodology:
• The Gait Methodology (“GAIT-1”)GAIT-2”)GAIT-R”)Case Studies of Using GAIT-R to Scope PCI Compliance
• GAIT for IT General Control Deficiency Assessment (“
• Gait for Business and IT Risk (“
•
I am grateful to the authors of Visible Ops Security for introducing me to the GAIT methodology.
Next time, I’ll delve into the authors’ discussion of “Phase 3: Implement Development and Release Controls.”
