Pass Isaca CISM Exam in First Attempt Easily

Course Introduction

1. Course Introduction

Now. This domain is entitled Information Security Governance, and the goal of the domain is to give us an overview of what it takes to go from the very beginning. the initial planning statements. the actual development of a security governance programme through its implementation. Management and meeting your objectives that need to be in alignment with the actual business objectives will be a reoccurring theme through much of this course. that the goal of security governance still has to be to keep the business doing what makes it profitable. So business objectives are also going to be a key factor. And remember that we're giving you an overview of what's involved in the field of security governance with some insights into what we would be looking for and what pitfalls you might come across while creating this programme and making sure that it's as thorough a programme as we can make it.

1. Lesson 1: Information Security Governance Overview

Well, I want to welcome you to our course on CISM. We have four domains that we're going to cover as we go through. The first is on information security Security Governance.So we'll learn a lot about the foundation of why CISM is important to us as it deals with governance. From there, we're going to go through the information. Risk management. We'll talk a lot about a lot of the different types of business impact analysis or risk studies that we can go through, why they're important for us, and how we use that information. In domain three, "Information Security Program Development," we'll look at the lifecycles of many different systems that we're going to be auditing and why the Security Program is important for us. And then we're going to talk about information security incident management, which is going to be about how to respond to a security incident through the use of creating IT incident response teams, business continuity programs, or disaster recovery plans, and those types of issues that, if we have a plan, we can try to hold our potential losses and outages to a low level.

2. Information Security Governance Overview Part1

We'll start with an overview of information security and governance to get a sense of the big picture. Now when we think about what information is, we can define it as data that is endowed with meaning and purpose. And I love these fancy phrases, but really, that's what it is. We are seeing more and more of our businesses relying on the data that they store. In fact, data, or information if we want to think of it that way, has become a very important part of all of our lives. When flying an airplane, it's almost an unavoidable component of doing actual business in terms of transferring funds and products. We no longer seem to have that third person who was designed to chart your course and ensure you got to where you needed to go. It's all coming through as business related.Now, for some companies, the information might actually be their business. If you take Google, Ebay, Microsoft, and many other companies as examples, what they are producing is the storage and availability of information. Whether it's through searching websites for products to buy from other people using the auction capability or your operating system and other supporting software.

3. Information Security Governance Overview Part2

Now, all of the information today is really nothing more than blocks of information that are stored on hard drives or solid state drives, but they are just a bunch of ones and zeros. And as I said, the information we see today has become very pervasive in society and business. We have people today that are probably talking to people around the world more frequently than their neighbors, certainly with businesses as far as trade secrets, copyright information about their customers, and the financials, all of which are being stored electronically. In fact, the dependence on information is higher today than it's ever been. Just recently, there was a story about an airline that had a small power outage to their network systems.

grounding hundreds of flights because apparently they didn't know how to manually board people onto the aero plane and check them off a list that they presented with their ticket or boarding pass and couldn't get the computers working to get the flights or, I guess, basically the flight plans filed or created. So really, the dependence on information is just something we haven't seen, at least in my lifetime. I remember going into a bank as a young kid and having a ledger statement filled out and at some point it was reconciled, knowing that if I made a deposit in one branch, it might not be until next week when that deposit is available for me at another branch that they actually know about it.

So it really is good the way in which information works for us today, but our dependence on it is very crucial. Now, you could think of it as information, a resource that's now equal in importance to your traditional land, labor, and capital. Many companies, like I mentioned, Google as an example, is a business that everybody utilizes. Well, maybe not everybody, but a lot of people utilize But it really outside of where the people who work at the company has no brick and mortar type office front, no building or branch that you walk into. So really, that's kind of giving you an idea of how important information is in all of our lives and in all of our enterprises.

4. Information Security Governance Overview Part3

Now, the Gartner Group has estimated that organisations are going to deal with more than 30 times the information than they do today, and that's going to be in the next decade. Now, if you consider the glaring vulnerabilities and the perpetual crisis as modes of activities, this might not be as reassuring as it sounds. When you already think about how dependent we are on information and how vulnerable a lot of information can be and how we have to respond to any breaches of our security, you can imagine that it sounds very scary. I'm thinking of what would happen if GPS went down and somebody interrupted the communications. Granted, that just affects me because I travel a lot. I'd have to go back to the old days of finding a map and figuring out where I was. And that's just one little bitty piece of this entire process of saying, "Wow, it's just crazy, right?" Financially, my bank loses customer records. That's going to affect me no matter where I am. So that's a part of why information security governance is very important to us. We have to be able to find a way to reduce these types of risks. Now, our goal is to gain adequate protection for our information resources. And the issue should be raised regarding the critical governance functions that help us oversee this as a programme to help us get to those objectives, which is our security program.

5. Information Security Governance Overview Part4

Up until recently, the major focus in information security has been protecting the systems that store the information rather than the information itself. Now, I know that sounds strange, but right now, if you think about having a storage-area network or a mainframe that contains all of your information database, we've been trying to protect that system. We try to protect that system in having redundancy in hard drives redundancy and power supplies, backup power supplies, backup means of power grids protecting that system and of course the information that we have on it. But that information is really kind of the point.

We still have to worry about the protection of the communications path and the integrity of the data that's being entered, if it's even correct information, and we just kind of go on and on and on. But that just means that our focus at one point was really just on the storage. Now, information security is going to take a larger view than just even the content, the information or the knowledge that's based on it. Now we have to start looking at protecting the information in all of the stages of it being processed. Again, that's from the gathering of the information, the entering of information, the transmission of information, as well as the storage. Now, there are enormous benefits to information, but we also see new risks, as well as a sometimes confusing patchwork of existing laws and regulations that we have to deal with in trying to work with our information.

6. Information Security Governance Overview Part5

Now information security governance is really going to start off as a responsibility of the board of directors and executive management. In the long run, they are the ones who are liable for the information or the loss of the information. and we consider them to be the owners of the information. In order for you to have effective security governance, you have to have their support. We call that the process of having support from the top down. It needs to be an integral and transparent part of your enterprise governance.

7. Importance of Information Security Governance Part1

Now the benefits of good management can include a lot of positive aspects. Number one, we can plan for any increase in civil or legal liability. Now what does that mean? Well, you know, I think about research. Recently, one of these companies that has games for kids that are connected to the TV, game consoles, and they do a lot of online type of playing had all of their customer information stolen. From what I understand, that could be credit cards—the names and addresses of people who now have millions of potential civil complaints about having had identity theft—the crisis of just going through and getting a replacement credit card.

I'm wondering about any charges being made that they have to fight off and all of that. If you think about it, that suddenly means that a company may have millions of lawsuits. They certainly have some legal liability about how well they store that information. So that's going to continue to increase because lot of these databases that we have are gathering more and more information which meansif it's compromised, brings an increase in liability. Now we also know that when we talk about civil and legal liability, we don't just mean lawsuits but criminal actions as well. We saw a large, I guess I will say, "Enron" since you're out of business. Some of those people went through legal liability, by the way, at the top, starting with the CEO and all of the rest of executive management, for the way in which they were basically cooking the books about their financials. That again was a way of destroying or altering information, things that should have been protected, and it caused a legal liability, including jail and prison time.

Now the other benefit is that we can try to assure good policy compliance. That means if we have policies, and those policies are in place for the purpose of knowing what our goals are for security, but we don't have good management to make sure that we, number one, communicate, train, make people aware, and of course add that top-down effect, then how do we really get good policy compliance? As an example, if you have a policy that says that there's an acceptable use of how I'm going to use email and I start using your email servers to send spam to people across the world or maybe enter into inappropriate conversations, I might use it to share company or corporate secrets.

But if you don't have any actual enforcement of these policies—nobody at the top can really say if you violate them, you're going to be terminated, you may even be criminally prosecuted—then how are you going to really assure that I'm going to be compliant with that policy if there's no enforcement action? I realize I'm giving this almost a negative connotation, but that's one aspect of policy compliance. The other is just making sure I know and understand how that policy applies. To me, all of that is a part of having good management. That also means that we can reduce hopefully with good policy or good governance to reduce the uncertainty of business operations, to be able to optimize the allocations of our limited security resources.

I realized that most of us don't have all the money in the world to buy every single type of security assurance control that we could put in there and try to protect everything and make it 100% secure. At some point I don't want to spend a lot of money when there's not a lot of return. And I'll use an example from the board with information. But recently I went down to an electronics store to buy a new headset for my computer, and it was a very cheap one; it was $4.99. And when I was at the checkout stand, they asked if I wanted to buy the extra insurance policy, a replacement policy. In a way, it was a kind of control, trying to balance the risk. And even though my headset was five dollars, four point ninety-nine, I was curious, like, "Okay, how much is this replacement policy?" And they said it was simply $6.99. It'll be good for two years. And I'm thinking to myself, at that rate, I could have just bought my own backup headset. So not everything is a good investment, I guess, is what I'm trying to say in terms of security, trying to put it into a different little scenario. So good information and security governance should, as I said, help us optimise those resources. It should also help ensure that business decisions are made based on that information.

Now that's an important aspect, right? We want to make sure that when we're looking at our governing set of security governance, our decisions are based on that management of what our programmers and policies are going to be. We can also see an increase in competence in interactions with trading partners. Now, that's also a very important aspect because we expect to see the same from them. As an example, my company's job is to take credit cards from customers for the purchase of goods or services. I'm going to have to communicate with a credit card processing center. They generally have a set of policies that we must follow in terms of security audits and ensuring certain levels of protection in order for them to be willing to open up their networks for communications with us.

And having good cybersecurity governance is going to help make that interaction better. It should also help improve trust and customer relationships. That is, if I were the company whose game console containing all of the customer information was stolen, I would not have much faith that they would return and enter their new information into the same database. And they may have customers that might not return. But if we show a history of doing good with our security governance, then we're going to get an ongoing feeling of trust and hopefully better customer relationships. That should mean better results for the company on the bottom line. And of course, that also is going to help us safeguard the company's reputation, because, again, our reputation is very important. Without a good reputation, you don't see a lot of repeat business or even new business.

8. Importance of Information Security Governance Part2

Now your information, as we said, has a lot of meanings. Another way of describing it is as data endowed with meaning and purpose. We've said that. Now others have stated that knowledge has sometimes become the sole factor for productivity, sidelining both capital and labor. And it goes without saying that knowledge is becoming one of the most important assets and that if you didn't have it, the ability to conduct business would be impossible. You couldn't do it. Think about online companies that are booksellers. They have to have a lot of different information and knowledge exchanges just for you to have a single transaction. You have to be able to have connectivity with your bank to show that you have available funds. There has to be a transfer of those funds electronically to the seller's bank. They have to communicate with the inventory, with shipping, and with ordering replacements after they ship these products out to you. And all of that is just for a single transaction. That just means that without this kind of information and without the ability to have these communications, they just wouldn't be able to do any type of business at all. Now we see that there are a lot of legal and regulatory requirements, and good information security governance is simply going to be called doing good business.

9. Outcomes of Information Security Governance Part1

When we talk about the outcomes of our security governance, we really mean that information security governance is designed to include the elements that are required to improve the assurance and direction of the organization's security posture. With those elements in place, management should be confident that there's at least adequate and effective information security to protect those assets. Again, for all the reasons we want good governance, we don't want to worry about losing information, about losing our reputation, about civil or legal liabilities, and the rest of it.

10. Outcomes of Information Security Governance Part2

Now the objectives of information security really are to develop, implement, and manage the security programme to be able to cover some of the following basic outcomes of security governance. Some of those are things like strategic alignment, which is just the alignment of your information security to the business strategy. Now again, if my company is about making widgets, that's what my security policy has to do: help support the company in being better at making widgets because that's what keeps the company in business. Not necessarily how well you store the information, transmit it, or keep trade secrets. Those are important aspects, don't get me wrong, but that's not necessarily the profit arm of the company that keeps the company thriving and growing. So we can't sometimes be so secure that we're stifling or affecting the actual goal of the business strategy. Rather, we should be supporting it and trying to make the objectives align with each other. Now with that strategic alignment Hopefully, that means your security requirements are going to be thoroughly developed to give guidance on what should be done. that your security solutions will fit into the culture. The governance style The technology and the structure of the organization—and again, that you're aligned with the enterprise strategy and that there are known threats. Vulnerabilities and risk profiles are appropriately looked at and hopefully dealt with or contained.

11. Outcomes of Information Security Governance Part3

One of the other outcomes of your security governance is risk management. Now, risk management is really the foundation for a lot of the policies and the security programmes that you're going to be creating. And we basically want to use appropriate measures to find ways to reduce risk and the potential impacts on information. Now, keep in mind that I said "reduction" rather than "complete elimination." Again, we cannot completely eliminate risk, but we can try to reduce that risk to an acceptable level. We'll get to talk more about that as we move into the actual development process. But in order to have risk management, you first need to understand what the threats and vulnerabilities are. If you don't know what the threats or the vulnerabilities are, then how do you really even know there's a risk? and that's an important aspect. And remember that even though we're talking about information security, a lot of us begin to think about hackers and firewalls and things like that. But other threats to our information and our security can come from natural disasters, failures of equipment, theft, and maybe even accidental actions on the part of our employees. That just means we need to really understand what those threats and vulnerabilities are so that we can appropriately manage that risk. We also need to know what the exposure and consequences of a compromise would be of compromise.In other words, what is the exposure if there was a fire in that building? What are the powers that be looking at historical structures and fire types? What would they tell you? What would be the amount of damage? Would the entire building be a loss? Would there maybe just be some parts of the buildings that are uninhabitable? We need to understand what that exposure is, and of course, what does that mean to us? What's the consequence of that compromise? Because every aspect of information can be compromised, we must now be risk-aware and have a set of priorities. But some information is obviously more important than others. And some loss of information could be the type of loss that is going to affect the dependencies of many other processes and could have a really large cascading effect. So we really want to look at the priorities and how they interact. Of course, the goal of risk management is to reduce risk to an acceptable level. And risk acceptance is really based on an understanding of the potential consequences of having that residual risk. And that's kind of the goal. We're trying to reduce it down to that acceptable level and be able to say, "Okay, now that we've got a lot of that, taking care of what we have left may be more manageable. You.

12. Outcomes of Information Security Governance Part4

Now as we still talk about the outcomes of having information security governance, one of the other outcomes is value delivery, which is optimising your security investments to help support the business objectives. That means we want to include a set of security practises or baseline security requirements. Now, a baseline, and a lot of this you have to remember again as we introduce this domain, is an overview of what we're going to be seeing in more detail. But a baseline can often be thought of as the minimum security that we need. Understanding those minimums is now part of the security practice; it doesn't mean we have to strive for the minimum, but it may be a good baseline from which we can grow now, prioritising our efforts to the areas with the greatest impact and the best business benefit. That's another part of value delivery. Again, there are going to be some assets that are more important to us, and we need to think about those, which are usually at the top of the list when trying to implement security governance, rather than worrying about whether or not people are taking pencils from the closets in our office. Using a standards based solution is another value added,especially standard space, because that helps us with interoperabilitybetween different vendors or even with different organizations havingcomplete solutions covering the process as well as thetechnology of the business organization and knowing that securityis thought of as a process and not just a single event.

13. Outcomes of Information Security Governance Part5

Your resource management is another outcome of your information security governance, and that is using the information security knowledge and infrastructure in a way that's efficient and effective. And it is important to understand because resources is notmore than are not just monetary, it's also on personnelof the environment, of the culture of the company. And it's important that we understand how our resources are managed to get the most out of them. We want to make sure that basically all the knowledge is captured and available. Now, that's one of the biggest things about our resource management: that the knowledge is in the data. We want to make sure that we have it and that it is not so unavailable or locked up under strict security that it's not useful. We can use the resources to help us document security processes and practises so that we can create a security architecture that defines and utilises the infrastructure resources to the best of their ability. Another outcome is the performance measurement. Performance measurements now form an important part of this monitoring and reporting on information security processes. Number one, make sure that your objectives are being achieved. Now, having a set of metrics should also be aligned with the objectives. In other words, they need to be meaningful metrics or parts of the security process that we're monitoring. We want to be able to find shortcomings to get feedback so we can see process improvement. And of course, we may have to consider having external audits to help confirm what we would call our security assertions. In other words, if we think that we have a firewall that's doing what it's supposed to be doing, having an external audit can actually let us know if the logic of our security policies is working. Does that firewall actually block the traffic? Traffic? We asserted that it would. Does it stop the type of attacks or mitigate them the way we assert that they would? A lot of that comes through independent testing.

14. Outcomes of Information Security Governance Part6

One of the last outcomes that we look for in information security is integration. Now, integration means that we are going to integrate all relevance assurance factors to make sure that the processes are basically operating as they are intended. Now, what does that mean for integration? Well, that means that we need to look at all of the organisational assurance functions. When you think about the business as a whole, it's not just information technology. I mean, sure, that's kind of our focus with information security, but we are supporting other business units, and they may have their own set of policies with regards to information—how they retrieve it, how they enter it, how they interact with it. And so that's another part of the integration—to make sure that it's pretty much working with all of the organisational assurance functions of the different business units. That means we want to coordinate the assurance functions for complete security. I don't necessarily need to have you do your security. I do my security because there may be gaps or lapses between the boundaries of what you're doing and what I'm doing rather than what we can do together to come up with a better solution if we don't integrate. That means we should have some overlapping roles and responsibilities, and we want to look at it as a systems approach to security planning and the development of management rather than, again, just doing that kind of isolationist point of view.

15. Lesson 2: Effective Information Security Governance

In this lesson, we're going to talk about effective information security governance. Now, really, information security governance is something that is the responsibility of the board of directors and your executive management, again, keeping with that concept of top-down enforcement. It needs to be an integral and transparent part of enterprise governance. Now, good security governance is required, number one, for your legal and regulatory requirements, which are becoming mandatory. And also, we use it to help show that we're exercising with care.

16. Business Goals and Objectives Part1

Now as we get into this, we're going to start off by talking about the business goals and objectives. Now remember, the corporation, the organization, and the company—words we all seem to kind of use interchangeably as we talk about this—are going to be setup with a business plan and business goals, goals.That means the board of directors and the executive management should have the goal of being able to provide a strategic direction and make sure that their objectives are achieved; those are business goals. Now what does that have to do with security management? Well, security management should be part of the business goals. Our hope is that the alignment will help support the needs of the company. That means that when we look at the strategic direction of a business, it's defined as its business goals and objectives. Then, with information security governance, that would make us kind of a subset of corporate governance. That means that we should be able to provide a strategic direction for security activities and a way to verify that those objectives are going to be achieved while still making sure we are integrated with the business goals and objectives. Some may argue that it is an important aspect, and number one, have these types of strategies to have these goals and objectives, as well as a plan on how to get to those objectives, rather than just walking down the road of progress, hoping you're on the right path. Some people say that it's up to the board and the executive management to do more than just say why their company exists and instead say what they're going to do to help it stay that way. And that's kind of what we're looking at here.

17. Business Goals and Objectives Part2

Now, the framework of your governance as welook at business goals and objectives, the frameworkof the governance usually consists of, number one,having a comprehensive security strategy. But remember, it has to be linked to the business objectives. Now, I might say one way to make sure my database is never hacked into is to not allow any external contact or any connection from the outside. No web-based applications are going to pull that data down and display it to people. And of course, if I'm an e-commerce company that needs to be able to interact with customers and provide information, I'm thinking that a comprehensive strategy of security is somehow not going to work very well with my business objectives. In fact, they are complete opposites of each other. So we need to make sure that we are linking those together. Now, you're governing security policies that address each aspect of the strategy's controls and regulations. That's an important part of what we're looking at. You need to have a set of standards for each policy. Now, when we think about having governing security policies, a policy is really important, and we'll get some more details as we get into some of the other parts of this. But a policy is really just a couple of lines that give us an overview, a little blueprint of where we're going. And of course, we have these little policies for each aspect of the strategy controls, and then we'll create a set of standards to get to that policy. Another part of the framework for governance is to have a good security organisational structure, one with few or no conflicts of interest and also having sufficient authority and resources. Now again, that's where we can see the use of the board of directors and executive management. There was no one to help provide the resources needed and to help add to the authority. And we also need to have in our framework a standard set of metrics and monitoring processes so we can check on compliance and find a way to get feedback on how effective our solutions are. And of course, we can also utilise this information to help make effective management decisions. You.

18. Roles and Responsibilities of Senior Management Part1

Now, when we look at the roles and responsibilities for senior management, we'll start at the board of directors. Information security, governance requirements, strategic direction, resource commitment, and even responsibilities are all factors to consider. And the board of directors is the greatest place to start. They need to be aware of their information assets and how critical they are to business operations. And that can be done through periodic reviews. They may not want detailed reports all of the time, but they do want some kind of review or overview of the process. Now, the policies that we create need to be adopted by the board of directors. They need to agree on those and make sure, of course, that it's working with their overall business goals and objectives because the enforcement of these, as we keep saying and will continue to say, has to be from the top down. Now, your executive management and the policies that were set forth by your senior management or board directors need to have leadership. They have to have ongoing support from the executive management if they're going to be successful.

19. Roles and Responsibilities of Senior Management Part2

A steering committee is going to be a group of people that we can use to ensure, especially for the stakeholders, that all of the security considerations are being reviewed. Their goal should be to help achieve consensus on the priorities and the the trade offs.Think of just the name "steering committee" as meaning that it's a kind of committee to help us find a way to achieve our objectives. An organisation or an organisation should have a CISO, the chief information security officer. Even if you don't have somebody by that formal title, it's still a position that should exist that also has the responsibility, the authority, and the required resources to be able to manage information security.

Hide