Newsletters Welcome, Guest Log In | Register

Join the Community

Exchange

Get full access to our community's expertise and resources.

Register Now >

Re: Where Do I Get My Controls?

18 Replies Last post: Nov 20, 2009 7:55 PM by MikeBailey   1 2 Previous Next
Ralph DeFrangesco   54 posts since
Oct 3, 2008
Reply

Dec 16, 2009 1:32 PM

Where Do I Get My Controls?

There are many places to get controls, ISO17799 and CobiT to name two. Does it  really matter where I get my controls from?

JeffGoldman   10 posts since
Nov 3, 2009
1. Nov 16, 2009 8:39 AM in response to: Ralph DeFrangesco
Re: Where Do I Get My Controls?

Yes. Today the main driver of security practices are usually led by some regulatory compliance requirement. This is not to say that companies are not concerned with overall general security like ensuring their environment is meeting an internally driven corporate standard (ie. , Physical security measure, Virus Scan on all machines, VPN connectivity for remote access, Firewalls protecting internal resources from inbound traffic) but the major push for major changes in security practices of an environment are usually motivated by a regulation that bears with it some undesired consequence related to failing an audit.

 

For instance, to name just a couple popular standards: today their is Sarbanes Oxley that requires publicly traded companies to comply with a set of standards that ensure accounting measures, integrity of data, and the confidentiality of data are met, and there is PCI (Payment Card Industry Standards) that act as a regulatory law for any company that accepts credit card numbers, or even handles the credit card transaction in any way, whether directly or indirectly, to meet a set of standards for how that data is managed, accessed, stored, and protected.

 

Even though there are the obvious controls companies of all sizes implement to provide piece of mind and business contiuity to general business, there are those controls that are those controls inspired by regulatory compliance. The grading system for meeting those standards is pass/fail (even though there is usually some sort of extension available, if necessary, to reaudit) and these standards directly affect which controls are selected to meet the requirements of the audit.

WarrickStJean   28 posts since
May 11, 2009
2. Nov 16, 2009 8:57 PM in response to: Ralph DeFrangesco
Re: Where Do I Get My Controls?

     As an information security professional I believe that the source of a companies IT controls is of extreme importance. As with any structure that is purpose built and meant to stand the test of time, serious consideration must be put into it's foundation. A solid information security structure will rely heavily on a foundation and framework that are both durable and flexible.

 

     In architecting and developing sound IT governance controls a range of factors will need to be considered. Some of those factors will include:

 

i. Region(s) of operation i.e. City, State, Country, Continent,  International

ii. Industry i.e. Medical, Manufacturing, Government etc.

iii. Size of organization

iv. Command and Control topology i.e. Centralized, Autonomous etc.

 

 

     The forementioned factors are but a few that will help the individual or team to determine which standards organization(s) should be used as a reference model. The field of information technology is one which has matured quite over a relatively short period of time and continues to do so at a rapid pace. Standard controls exist because they have been proven to work reliably in a range of scenarios. Businesses can cherry pick from the most widely adopted and universally accepted controls since these will be the ones that have been subject to the most rigorous scrutiny.

 

     There is no need to "recreate the wheel" when significant time and effort has already been applied to developing proven controls.Unless the business is based on a unique model and is creating a new platform (e.g. Internet '95 - '01) then it would behoove those responsible to stick to the "tried and true", making minor adjustments as needed. Appart from the expedience of adoption from adopting existing standards, there is the fringe benefit of ease of administration and reduced cost$ when using a commonly adopted model.

JeffGoldman   10 posts since
Nov 3, 2009
3. Nov 16, 2009 9:10 PM in response to: WarrickStJean
Re: Where Do I Get My Controls?

Great points Warrick. When selecting controls there is "no need to recreate the wheel". Usually the time constraints on meeting these requirements wouldn't allow for that much piloting and testing anyway.

 

The factors you mentioned along with the many others have been considered and mapped out in many ISO's and standards making the process of selecting controls easier; because even though you have the map that shows you your destination, the path there is not always an easy one.

 

"Standards" are just that for a reason... they are standards.

WarrickStJean   28 posts since
May 11, 2009
4. Nov 16, 2009 10:24 PM in response to: JeffGoldman
Re: Where Do I Get My Controls?

Jeff,

     I agree, regulatory compliance is a major driver for the adoption of many controls. Most compliance reglations have been mandated based on the consensus that general implementation of these standards will create transparency for business, consumers & regulators alike.

 

     The lifeblood of our great capitalist system is the ability of business to be creative while operating within a set of general parameters and controls. Adopting all known controls and standards may be too restrictive for most companies especially new ones. It may make sense for budding companies to adopt controls which allow them the greatest flexibility while meeting their desired objectives. More mature organizations should not make dramatic changes without serious consideration, but should remain flexible to new standards and new ways of implementing old ones.

 

    Companies must be very deliberate about the sources of their controls. Once the decisions are made and the controls are adopted then resources should be applied to understand and administer these regulations properly. Companies should not only seek to adopt changes, but where applicable they should participate and make meaningful contributions to the process. These controls will have far reaching impacts down the road and may well help to define business and IT culture for many management cycles.

Royce"The-Go-to-Guy"Richards   9 posts since
Nov 5, 2009
5. Nov 19, 2009 4:08 PM in response to: Ralph DeFrangesco
Re: Where Do I Get My Controls?

As stated in previous posts.  A company may obtain controls from a variety of sources.  Risk analysis/assessment/management has been in use for quite some time now.  Such techniques are used as a means to perpetuate the positive flow of business by avoiding the crippling affects of undesirable events.  Companies invest mucho dineros year after year to maintain a well prepared/controlled work environment. 

On one hand, it just makes good business sense for an organization use controls defined by ISO, for instance, to prepare and plan wisely for the unexpected since potentially disruptive and sometimes catastrophic events are inevitable.  On the other hand, why spend all that money to prepare for the possibility of disaster when no one has to know about it?  Therein lies the problem.  

In today’s society there are numerous regulatory entities.  There are also myriad news and media agencies.  If a company has not done their due diligence, the public will eventually find out about it.  If an incident takes place where a company, although it may have some types of controls in place, looses valuable private data such as citizens’ social security numbers and credit card info, the media will make the public aware.  Once everyone knows, the next step would be to find out how that company ”let” it happen. 

In such a scenario, an organization could be assessed fines and lawsuits as well as having its reputation smeared.   The best way to prepare for such an event is probably to be certified by or be in compliance with a group such as ISO, HIPAA, GLBA, SOX, PCI.  By doing so, Company X will have to select and implement controls that are already considered to be valid, time-tested, and tried-and-true. 

Bear in mind that being compliant or selecting controls from some ready- made list doesn’t mean disaster won’t strike, but at least the organization can save face by proving that they invested time and effort by doing there due diligence.

Royce"The-Go-to-Guy"Richards   9 posts since
Nov 5, 2009
6. Nov 19, 2009 4:29 PM in response to: JeffGoldman
Re: Where Do I Get My Controls?

Peace of mind is a huge factor.  The sources and types of controls used obviously have a tremendous impact on the likelihood of the occurrence of a particular risks/threats.  However, nothing is full proof.  The controls are meant to mitigate risk, not eradicate it.  Just take a look at some of the definitions for mitigate:

·         To reduce, lessen, or decrease.

·         To act in such a way as to cause an offense to seem less serious.

·         To reduce or moderate the severity of something.

When companies like PCI make claims that no organization that is PCI compliant has been compromised, they set an unrealistic expectation and create a false sense of security for both businesses and consumers.  People must realize that privacy and protection of goods and information is fleeting, though  I’m sure regulatory entities will continue to sing that song as long as the masses continue to buy into it.

JeffGoldman   10 posts since
Nov 3, 2009

Royce,

 

Keep in mind all of the "standards" are based onproven strategies and are to be used as a guide that is documented and has been thoroughly put into practice and been tested. When adding a safeguard, all anyone can go on is what has been developed and proven to perform. To be a PCI compliant business the business must meet the PCI set of standards. This is the minimum levels of acceptable safeguards and controls. As you stated, no control is fool proof, but if a company is PCI compliant at the time of their certification, they proved to be meeting those requirements. That doesn't mean they maintained that level of compliance the entire time afterwards. PCI is a yearly audit. And that is where the problem lies. The false security is not PCI's fault but is the fact that the company, baiscally, let down their guard. I truly believe that if a company was to become PCI compliant and follow proper procedure of maintaining and monitoring of those controls then they would be demonstrating a true-sense of security.

 

Message was edited by: JeffGoldman

Dawit   8 posts since
Nov 5, 2009
8. Nov 19, 2009 6:24 PM in response to: Ralph DeFrangesco
Re: Where Do I Get My Controls?

Yes it really matters where we get our controls form my whole perspective is focus on regional matters for instance if we doing our risk assessment for a company lets located in japans we have to take in consideration of the compliance that is specifically fashioned for that region or country if its small firm without any connection international however if we are assessing big accompany like Sony Bank Inc (Japan) it worth to utilize and get the controls form ISO17799 and CobiTso.So every time we have to look for the equivalent standard that will suit for our client in order to adhere the successfulness of the project goal here are the list of equivalent for some countries.

Countries

Equivalent Standard

Australia

New Zealand

AS/NZS ISO/IEC 27002:2006

Brazil

ISO/IEC NBR 17799/2007 - 27002

Czech Republic

ČSN ISO/IEC 27002:2006

Denmark

DS484:2005

Estonia

EVS-ISO/IEC 17799:2003, 2005 version in translation

Japan

JIS Q 27002

Lithuania

LST ISO/IEC 17799:2005

Netherlands

NEN-ISO/IEC 17799:2002 nl, 2005 version in translation

Poland

PN-ISO/IEC 17799:2007, based on ISO/IEC 17799:2005

Peru

NTP-ISO/IEC 17799:2007

South Africa

SANS 17799:2005

Spain

UNE 71501

Sweden

SS 627799

Turkey

TS ISO/IEC 27002

United Kingdom

BS ISO/IEC 27002:2005

Uruguay

UNIT/ISO 17799:2005

Russia

ГОСТ/Р ИСО МЭК 17799-2005

To summarize Its is really important to take in consideration and yes it matters where we get the contr4ols form.

Dawit   8 posts since
Nov 5, 2009
9. Nov 19, 2009 6:32 PM in response to: WarrickStJean
Re: Where Do I Get My Controls?

i. Region(s) of operation i.e. City, State, Country, Continent,  International

ii. Industry i.e. Medical, Manufacturing, Government etc.

iii. Size of organization

iv. Command and Control topology i.e. Centralized, Autonomous etc.

you made nice point by jotting down some of the factors that we have to take in consideration, especially regional I took time to research a little bit and came up with some information about it u can see  it on my post but also the type of industry you mentions also it’s an important variable to be considered  but I get bit confused when  on the forth factor I still try to make benefit out of it. If you have detail info about he fourth factor u have mentioned feel free to share with us.

Royce"The-Go-to-Guy"Richards   9 posts since
Nov 5, 2009
10. Nov 19, 2009 10:17 PM in response to: JeffGoldman
Re: Where Do I Get My Controls?

Jeff,

 

You make a good point.  Maybe my criticism of the regulatory industrywas a little harsh.  Their intended purpose is a good one, and for the most part they serve to protect consumers and clientele just as much as the company's that invest in their tools. 

 

Point taken.  

John.Kimmel   8 posts since
Nov 5, 2009
11. Nov 19, 2009 11:16 PM in response to: Ralph DeFrangesco
Re: Where Do I Get My Controls?

Where you get your controls from is less important than the use of a standardized control list. The use of standardized controls can save both time and resources, while improving quality. Since the controls do not have to be made up, the additional time saved can be used to create a better risk analysis. The standardized controls are likely better than anything we would create since teams of highly qualified people worked on them.

 

By using a standard such as ISO 17799, Cobit, etc your analysis can more easily be compared to others. Using standardized controls gives your report additional credibility. Certain regulations require specific controls be met for compliance, such as HIPA. Without a predetermined layout compliance may not be met.

 

Which standardized controls should be used is dependant on what field/area you are trying to assess. Medical fields should use HIPA, while financial should use Sarbanes Oxley. Unless specified by federal or other regulation, the company should use whatever controls are most suited to their business, however standardized controls should always be used.

 

With the growing popularity of Risk Management, there is no reason for individuals to create their own controls. The benefits of using standardized controls far outweigh any negatives. By using standardized controls we are reinforcing the risk management processes, while helping to move it forward and gain acceptance. As long as the controls are suited to the business and meet compliance , it is not as important where they were obtained only that they were obtained from an accredited source and suite the business.

John.Kimmel   8 posts since
Nov 5, 2009
12. Nov 19, 2009 11:13 PM in response to: Dawit
Re: Where Do I Get My Controls?

Dawit,

I agree with your geographic assesment. I found the comparison chart rather informative. The ISO 17799 standard is very useful since it appears to have wide acceptance. I agree with your assesment of a  standardization of controls for comparison purposes. It is well suited for legal matter as well as international trade.

Millie   8 posts since
Nov 3, 2009
13. Nov 19, 2009 11:35 PM in response to: Ralph DeFrangesco
Re: Where Do I Get My Controls?

It do not matter where you get your controls as long as you acknowledge your threats and your focus is on the best interest of the organizational system.  As it was mentioned Cobit (Control Objectives for Information and related Technology) uses a set of practices which is also similar to Coso (The Committee of Sponsoring Organizations of the Treadway Commission).  Both are similar in providing internal controls which would help to mimimize risk. 

Millie   8 posts since
Nov 3, 2009
14. Nov 19, 2009 11:48 PM in response to: John.Kimmel
Re: Where Do I Get My Controls?

Great point to acknowledge the standardized controls which should be used should depend on what system you are trying to assess. It makes since to use whatever controls that are most suited for your business.  I like the fact that there are so many types of controls to choose from so that you don't have to make up your own.

Re: Where Do I Get My Controls?

Go to original post 1 2 Previous Next

Budget & Finance Toolkit for IT - 2010 Edition

Download a comprehensive collection of templates, forms, instruction and advice that will help you to plan and submit your 2010 IT Budget.

Learn more >

Windows 7 Upgrade Project Kit

Moving to Windows 7? The Windows 7 Upgrade Project Kit is the ideal support tool for managing all phases of an organizational upgrade to Windows 7. The tools and templates in this kit will help you develop a strategy and map out the implementation tactics which link your Windows 7 deployment to your company's bottom line.

Learn more >

Data Warehousing for Business Intelligence

Comprehensive storage solutions for better data access and retrieval, leading to better-informed business decisions.

Enterprise Manager

Tools, best practices and expert advice on managing your enterprise IT infrastructure, databases, and Web service components.

Application Performance Management

Application delivery and performance tools for Web applications to insure high availability and productivity.

Business Intelligence

Best-practice tools, strategies and technologies for determining and managing the data you need to make better business decisions.

Virtual Cloud Management

Read this white paper to learn the importance and features of a sound technology that enables you to connect, relate, measure, and view your services to optimize the management of virtual environments.

Performance Under Pressure: The State of Enterprise Web Application Quality and Availability

This research study finds that Web application issues are an all-too-common problem and examines these Web-based enterprise application issues from two perspectives: that of an online customer and that of a site manager.