Information Security Planning and Governance, Information Security Policy Standards, EISP, ISSP, SysSP, Policy Management, Pre-planning audit, Audit Risk Management, Performing Audit, Internal Controls, Audit Evidence, Audit Testing, Audit Finding, Follow-up activities

1. PLANNING FOR SECURITY
&
SECURITY AUDIT PROCESS
SECURITY & RISK MANAGEMENT
MODULE 6
DIVYA TIWARI
MEIT
TERNA ENGINEERING COLLEGE
Information Security Planning and Governance, Information Security Policy Standards, EISP, ISSP, SysSP, Policy Management,
Pre-planning audit, Audit Risk Management, Performing Audit, Internal Controls, Audit Evidence, Audit Testing, Audit Finding,
Follow-up activities

2. PLANNING FOR SECURITY
Information Security
Planning and
Governance
Information Security
Policy, Standards
and Practices
Enterprise
Information Security
Policy (EISP)
Issue-Specific
Security Policy
(ISSP)
System-Specific
Policy (SysSP)
Policy Management

3. Information Security Panning and Governance
• Strategic Planning provides a long-term direction to be taken by whole organization and
also by each of its component parts.
• Strategic planning should guide organizational efforts and focus resource es toward specific,
clearly defined goals.
Organization develops
general strategy
Overall strategic plan for
major divisions
Each level of division then
translates plan objectives
into more specific
objectives
Executive teams also
called C-level of the
organization defines
individual responsibilities
Each individual of the
organization works
towards executing the
broad strategy and turns
general strategy into
action

4. Planning Levels
• Once organization’s overall strategic plan is translated into strategic plans for each major
division or operation, next step is to translate these plans into tactical objectives that move
toward reaching specific, measurable, achievable and time-bound accomplishments.
• Strategic plans are used to create tactical plans, which are in turn used to develop operational
plans.
• Tactical planning focuses on shorter-term undertakings that will be completed within one or
two years.
• Tactical planning breaks each strategic goal into a series of incremental objectives.
• Each objective in a tactical plan should be specific and should have a delivery date within a
year of the plan’s start.
• Budgeting, resource allocation, and personnel are critical components of the tactical plan.
• Tactical plans often include project plans and resource acquisition planning documents (such
as product specifications), project budgets, project reviews, and monthly and annual reports.
• Since tactical plans are often created for specific projects, some organizations call this
process project planning or intermediate planning.

5. • The chief information security officer (CISO) and the security managers use the tactical plan
to organize, prioritize, and acquire resources necessary for major projects and to provide
support for the overall strategic plan.
• Managers and employees use operational plans, which are derived from the tactical plans, to
organize the ongoing, day-to-day performance of tasks.
• An operational plan includes the necessary tasks for all relevant departments, as well as
communication and reporting requirements, which might include weekly meetings, progress
reports, and other associated tasks.
• These plans must reflect the organizational structure, with each subunit, department, or
project team conducting its own operational planning and reporting.
• Frequent communication and feedback from the teams to the project managers and/or team
leaders, and then up to the various management levels, makes planning process more
manageable and successful.

6. Planning and the CISO
• The first priority of the CISO and the information security management team is the creation
of a strategic plan to accomplish the organization’s information security objectives.
• Each organization may have its own format for the design and distribution of a strategic
plan, the fundamental elements of planning share characteristics across all types of
enterprises.
• The plan is an evolving statement of how the CISO and the various elements of the
organization will implement the objectives of the information security charter.
Information Security Governance
• Governance is the set of responsibilities and practices exercised by the board and executive
management with the goal of providing strategic direction, ensuring that objectives are
achieved, ascertaining that risks are managed appropriately and verifying that the
enterprise’s resources are used responsibly.
• In order to secure information assets, an organization’s management must integrate
information security practices into the fabric of the organization, expanding corporate
governance policies and controls to encompass the objectives of the information security
process.

7. • Information security objectives must be addressed at the highest levels of an organization’s
management team in order to be effective and sustainable.
• A broader view of information security encompasses all of an organization’s information
assets, including the knowledge managed by those IT assets.
• According to the Information Technology Governance Institute (ITGI), information security
governance includes all of the accountabilities and methods undertaken by the board of
directors and executive management to provide strategic direction, establishment of
objectives, measurement of progress toward those objectives, verification that risk
management practices are appropriate, and validation that the organization’s assets are used
properly.
Information Security Governance Outcomes
• Effective communication among stakeholders is critical to the structures and processes used
in governance at every level especially in information security governance.
• This requires the development of constructive relationships, a common language, and a
commitment to the objectives of the organization.

8. Strategic alignment of information security with business strategy to support organizational
objectives
Risk management by executing appropriate measures to manage and mitigate threats to
information resources
Resource management by utilizing information security knowledge and infrastructure efficiently
and effectively
Performance measurement by measuring, monitoring, and reporting information security
governance metrics to ensure that organizational objectives are achieved
Value delivery by optimizing information security investments in support of organizational
objectives
Five Goals of Information Security Governance are as follows:

9. Governance Framework
• Corporate Governance Task Force (CGTF) recommends that organizations follow an
established framework, such as the IDEAL framework from the Carnegie Mellon University
Software Engineering Institute.
• This framework, which is described in the document “Information Security Governance:
Call to Action,” defines the responsibilities of:
(1) the board of directors or trustees
(2) the senior organizational executive (i.e., CEO)
(3) executive team members
(4) senior managers
(5) all employees and users.

10. Information Security Policy, Standards and Practices
Policies, Standards, and Practices

11. For a policy to
be effective and
thus legally
enforceable, it
must meet the
given criteria:
Dissemination (distribution)
Review (reading)
Comprehension
(understanding)
Compliance (agreement)
Uniform enforcement

12. Enterprise Information Security Policy (EISP)
• An enterprise information security policy (EISP) is also known as a general security policy,
organizational security policy, IT security policy, or information security policy.
• The EISP guides the development, implementation, and management of the security
program.
• It sets out the requirements that must be met by the information security blueprint or
framework.
• It defines the purpose, scope, constraints, and applicability of the security program.
• It also assigns responsibilities for the various areas of security, including systems
administration, maintenance of the information security policies, and the practices and
responsibilities of the users. It also, addresses legal compliance.

13. • According to the National Institute of Standards and Technology (NIST), the EISP typically
addresses compliance in the following two areas:
1. General compliance to ensure meeting the requirements to establish a program and
the responsibilities assigned therein to various organizational components.
2. The use of specified penalties and disciplinary action.
• The specifics of EISPs vary from organization to organization, most EISP documents should
include the following elements:
1. An overview of the corporate philosophy on security.
2. Information on the structure of the information security organization and individuals who
fulfill the information security role.
3. Fully articulated responsibilities for security that are shared by all members of the
organization (employees, contractors, consultants, partners, and visitors).
4. Fully articulated responsibilities for security that are unique to each role within the
organization.

14. Issue-Specific Security Policy (ISSP)
• As an organization executes various technologies and processes to support routine
operations, it must instruct employees on the proper use of these technologies and
processes.
• Issue-specific security policy, or ISSP:
(1) addresses specific areas of technology.
(2) requires frequent updates.
(3) contains a statement on the organization’s position on a specific issue.
• There are number of approaches to creating and managing ISSPs within an organization.
• Three of the most common are:
1. Independent ISSP documents, each tailored to a specific issue.
2. A single comprehensive ISSP document covering all issues.
3. A modular ISSP document that unifies policy creation and administration, while
maintaining each specific issue’s requirements

16. Systems-Specific Policy (SysSP)
• SysSPs functions as standards or procedures to be used when configuring or maintaining
systems.
• For example, a SysSP might describe the configuration and operation of a network firewall.
Types of SysSP
Managerial Guidance
SysSP
Technical
Specifications SysSP
Combination SysSP

17. Managerial Guidance SysSPs
• A managerial guidance SysSP document is created by management to guide the
implementation and configuration of technology as well as to address the behavior of people
in the organization in ways that support the security of information.
• For example, while the method for implementing a firewall belongs in the technical
specifications SysSP, the firewall’s configuration must follow guidelines established by
management.
• An organization might not want its employees to access the Internet via the organization’s
network, for instance; in that case, the firewall should be implemented accordingly.
• Firewalls are not the only technology that may require system-specific policies. Any system
that affects the confidentiality, integrity, or availability of information must be assessed to
evaluate the trade-off between improved security and restrictions.
Technical Specifications SysSP
• A manager can work with a systems administrator to create managerial.
• Similarly, the system administrator may need to create a policy to implement the managerial
policy.

18. • Each type of equipment requires its own set of policies, which are used to translate the
management intent for the technical control into an enforceable technical approach.
• For example, an ISSP may require that user passwords be changed quarterly; a systems
administrator can implement a technical control within a specific application to enforce this
policy.
• There are two general methods of implementing such technical controls:
1. access control lists
2. configuration rules.
Combination SysSPs
• Many organizations create a single document that combines the management guidance
SysSP and the technical specifications SysSP.
• If this approach is employed, care should be taken to clearly articulate the required actions.
• This policy is a hybrid document that combines policy with procedural guidance for the
convenience of the implementers of the system being managed.
• This approach is best used by organizations that have multiple technical control systems of
different types, and by smaller organizations that are seeking to document policy and
procedure in a compact format.

19. Policy Management
• Policies are living documents that must be managed.
• These documents must be properly disseminated (distributed, read, understood, agreed to,
and uniformly applied) and managed.
• When two companies merge but retain separate policies, the difficulty of implementing
security controls increases.
• Likewise, when one company with unified policies splits in two, each new company may
require different policies.
• To remain viable, security policies must have:
1. a responsible individual
2. a schedule of reviews
3. a method for making recommendations for reviews
4. policy issuance and revision date.

20. SECURITY AUDIT PROCESS
Preplanning
Audits
Audit Risk
Assessment
Performing
Audit
Internal
Controls
Audit
Evidence
Audit Testing
Audit Finding Follow-up
activities

21. Preplanning Audits
• The first step in preplanning is to ask, “What is the objective of this particular audit?”
• The objective may be compliance to a particular standard, surveillance auditing as follow-
up to determine if the staff is still adhering to their own procedures, or something that is
new.
• An excellent method for determining the scope is to start a discussion asking questions
about six key areas.
• Scope is defined as a boundary of what is included and what is not.
Some example questions and topics are given below:
1. Management: What are the business rules and objectives? Has management formally
adopted a standard to be followed? Does management require their systems to be
certified? Does executive management provide accreditation of the complete
hardware/software system before it enters production?

22. 2. Data: What data is involved? Is this customer data, engineering data, financial data? Are
there any regulations governing data restrictions, acceptable or unacceptable use?
3. Intended Usage in Their Workflow: How is this data used? What is it for? Possibly a
manual operation? Is it part of a software application? Ask for their workflow diagram.
4. Technology Platform: Is this data controlled in a computer program? In a file cabinet?
Transmitted wirelessly on cell phones?
5. Facilities: Where does the work get done? Are the main systems located here or
somewhere else? How much space is required to accommodate the staff? Where are the
customers located?
6. People Involved: Who are the people we will work with on the client side? Who are the
people on the auditee side? Using the skills matrix for reference, who is available to be on
the audit team? Do we have the appropriate technical experts available?

23. Audit Risk Assessment
• The purpose of a risk assessment is to ensure that sufficient evidence will be collected
during an audit.
• An audit risk assessment should take into account the following types of risks:
1. Inherent Risks: These are natural or built-in risks that always exist. Driving your
automobile holds the inherent risk of an automobile accident or a flat tire. Theft is an
inherent risk for items of high value.
2. Detection Risks: These are the risks that an auditor will not be able to detect what is
being sought. It would be terrible to report no negative results when material conditions
(faults) actually exist. Detection risks include sampling and nonsampling risks.
a) Sampling Risks: These are the risks that an auditor will falsely accept or erroneously
reject an audit sample (evidence).
b) Nonsampling Risks: These are the risks that an auditor will fail to detect a condition
because of not applying the appropriate procedure or using procedures inconsistent
with the audit objective (detection fault).

24. 3. Control Risks: These are the risks that an auditor could lose control, errors could be
introduced, or errors may not be corrected in a timely manner (if ever).
4. Business Risks: These are risks that are inherent in the business or industry itself. They
may be regulatory, contractual, or financial. Technological Risks These are inherent risks
of using automated technology. Systems do fail.
5. Operational Risks: These are the risks that a process or procedure will not perform
correctly.
6. Residual Risks: These are the risks that remain after all mitigation and control efforts are
performed.
7. Technological Risks: These are inherent risks of using automated technology. Systems do
fail.
8. Audit Risks: These are the combination of inherent, detection, control, and residual risks.
Will your audit be able to accurately prove or disprove the target objective? Is the audit
scope, time allotted, sponsor’s political strength, priorities, and available technical abilities
sufficient?

25. Performing the Audit
• Here one need to make sure you have the appropriate staff, ensure audit quality control,
define auditee communications, perform proper data collection, and review existing
controls.
• In order to perform real audit one must carry out following activities:
1. Selecting the Audit Team
2. Determining Competence and Evaluating Auditors
3. Creating a Skills Matrix
4. Using the Work of Other People
5. Ensuring Audit Quality Control
6. Establishing Contact with the Auditee
7. Making Initial Contact with the Auditee

26. Internal Controls
• Every auditor should consider two fundamental issues concerning internal control:
• Issue 1: Management is often exempt from controls.
• Issue 2: How controls are implemented determines the level of assurance.
• The basic framework of controls according to the ISACA standards.
• The controls are summarized here:
• General Controls (Overall)
• Pervasive Controls (Follows Technology)
• Detailed Controls (Tasks)
• Application Controls (Embedded in Programs)
• Reviewing Existing Controls

27. Audit Evidence
• Evidence will either prove or disprove a point. The absence of evidence is the absence of
proof. Despite your best efforts, if you’re unable to prove those points, you would receive
zero credit for your efforts.
• An auditor should not give any credit to claims or positive assertions that cannot be
documented by evidence. No evidence, no proof equals no credit.
• There are two primary types of evidence, according to legal definition:
• Direct Evidence.
• Indirect Evidence.

28. • Examples of the various types of audit evidence include the following:
• Documentary evidence, which can include a business record of transactions, receipts,
invoices, and logs
• Data extraction, which uses automated tools to mine details from data files
• Auditee claims, which are representations made in oral or written statements
• Analysis of plans, policies, procedures, and flowcharts
• Results of compliance and substantive audit tests
• Auditor’s observations of auditee work or re-performance of the selected process

29. Audit Testing
• Compliance Testing
Compliance testing tests for the presence or absence of something. Compliance testing
includes verifying that policies and procedures have been put in place, and checking that
user access rights, program change control procedures, and system audit logs have been
activated. An example of a compliance test is comparing the list of persons with physical
access to the datacenter against the HR list of current employees.
• Substantive Testing
Substantive testing seeks to verify the content and integrity of evidence. Substantive tests
may include complex calculations to verify account balances, perform physical inventory
counts, or execute sample transactions to verify the accuracy of supporting
documentation. Substantive tests use audit samples selected by dollar value or to project
(forecast or estimate) a total for groups with related characteristics.

30. Audit Findings
• There are two concerns as auditors related to testing:
1. sufficiency of evidence
2. contradictory evidence
• Detecting Irregularities and Illegal Acts.
• Indicators of Illegal or Irregular Activity.
• Responding to Irregular or Illegal Activity.
• Findings Outside of Audit Scope .
• Report Findings.

31. Follow-up Activities
• After issuing a report, you are required to conduct an exit interview with management to
obtain a commitment for the recommendations made in your audit. Management is
responsible for acknowledging the recommendations and designating whatever corrective
action will be taken, including the estimated dates for the action.
• Sometimes events of concern are discovered, or occur, after an audit has been completed.
You should be concerned about the discovery of subsequent events that pose a material
challenge to your final report. Accounting standards recognize these events and classify
them as follows:
• Type 1 events refer to those that occurred before the balance sheet date.
• Type 2 events are those that occurred after the balance sheet date.
• Depending on the type of audit, you may have additional reporting requirements or
activities.

32. MU Exam Questions
May 2017
• What are the components of Enterprise Information Security Policy (EISP)? Compare with Issue
Specific Security Policy SysSP. 10 marks
• Explain what is information planning and governance. What are information policy standards?
10 marks
Dec 2017
• Explain what is information planning and governance. What are information policy standards?
10 marks
• Explain the role of the Audit Committee and how it helps the organization. What is the need of
conducting Audit? 10 marks
May 2018
• SN: Enterprise Information Security Policy (EISP). 5 marks
Dec 2018
• Explain information security policy standards. 10 marks
• SN: Security Audit process. 5 marks

33. May 2019
• Explain what is information planning and governance. What are information policy standards?
10 marks
• Explain the role of the Audit Committee and how it helps the organization. What is the need of
conducting Audit? 10 marks