Building an effective security program can be a daunting challenge for any size company. This is because you don't only need to think of technical measures, but also integrate this into your organization's culture and environment, as well as manage it over time. In this article we are highlighting the core components required to build an effective information security program with following core components:

• Administrative security controls
• Define your risk appetite and methodology
• Essential Security Policies
• Use of a Security Framework
• Asset management
• Identity and access management
• Security awareness program
• Technical security controls
• Endpoint protection
• Email security
• Logging and monitoring
• Network security
• Vulnerabilitiy management
• Developing and maintaining an effective security program

Administrative security controls

Administrative security controls include policies, methods, and procedures that assist in the implementation of security within an organization. While deploying security technologies such as antivirus software and firewalls may appear to be one of the first steps in deploying a security program, you must first implement information security rules and procedures to enforce these requirements and steer the program's development. The definition of a risk appetite, corporate security policies, the adoption of a security framework, asset management, identity and access management, and a security awareness program are crucial administrative measures.

Define your risk appetite and methodology

Defining your organization's risk appetite and methodology is an important part of your risk management. You are basically defining how you will be identifying your risks in an independently repeatable way (methodology), what level of risk your organization is willing to accept in your business proceedings (appetite), and what you plan to do about different levels of identified risks when they arise (treatment). Your risk appetite and methodology help establish parameters and priorities for your policies, procedures, and internal controls, which can be modified over time to align with your business expectations and requirements.

Essential Security Policies

A security policy is a document that outlines how an organization intends to safeguard its physical and information technology (IT) assets. As technology, vulnerabilities, and security requirements evolve, security policies become live documents that are regularly updated and modified.

Here are some commonly used security policies.

• Acceptable Use Policy (AUP)
  The AUP describes acceptable computer equipment usage. It is utilized for business objectives to serve the company's, clients', and customers' interests in the course of routine operations. The AUP describes improper usage of information systems and the potential harm it poses. Inappropriate conduct may harm the network system and result in legal repercussions. An example of inappropriate use is when an employee uses a corporate computer to obtain data for purposes unrelated to his or her employment. The AUP outlines permissible use and inappropriate behavior when handling confidential or private information.
• Change Management Policy
  The change management policy of an organization ensures that modifications to an information system are managed, approved, and tracked. The business must ensure that all modifications are implemented in a manner that minimizes negative effects on services and customers. The change management policy contains techniques for planning, evaluating, reviewing, approving, communicating, implementing, documenting, and reviewing changes after their adoption. Change management depends on accurate and timely documentation, regular monitoring, and a formal and well defined approval process. The change management policy addresses SDLC, hardware, software, database, and application configuration changes, such as moves, additions, and deletions.
• Incident Response Policy
  The incident response policy is part of an organization’s business continuity plan. It outlines an organization’s response to an information security incident. The incident response policy should be documented separately from the disaster recovery plan, as it focuses on procedures following a breach of data or other security incident.The policy should include information about the incident response team, the personnel responsible for testing the policy, the role of each team member, and the actions, means, and resources used to identify and recover compromised data. Phases of incident response include preparation, identification, containment, eradication, recovery, and post-incident.
• Remote Access Policy
  Connecting to an organization's network from any host constitutes remote access. The remote access policy is intended to minimize exposure to potential damages caused by illegal usage of resources. This policy should be communicated to all workers and contain provisions for sending and receiving email and using intranet resources. The policy should additionally stipulate VPN and disk encryption requirements.
• Vendor Management Policy
  The vendor management policy verifies the compliance and information security capabilities of a vendor. The policy should address the procedure for acquiring suppliers as well as the management of all vendors. The organization must evaluate the business associate's capacity to create, receive, maintain, or transmit private information on its behalf. The organization must have faith that the third-party vendor will protect the information responsibly. It is crucial that the firm maintain a tier-based list of its vendors, complete with vendor contacts and legal penalties in the event of a data breach. Creating internal response strategies for each vendor in the case of a breakdown is another critical step. The policy should address vendor selection procedures, risk management, due diligence, contractual standards, reporting, and continuing monitoring. In addition, the policy should address the relationship between risk management and compliance management procedures in other domains.
• Password Creation and Management Policy
  The password creation and management policy provides assistance on building, implementing, and reviewing a defined procedure for creating, changing, and protecting strong and secure passwords used to verify user identities and get access to company systems or data. The policy should include training and education regarding the significance of selecting a strong password. It should include rules for changing temporary passwords as well as the risks associated with reusing old passwords. The policy should also stipulate particular complexity and length restrictions for passwords. It should educate users on the dangers of using a simple password or including personal information. The policy should also specify any exclusions, such as applications or other information systems with different password requirements, that are not covered by the standard. It should include information about password logouts and maximum retry attempts, as well as processes for documenting all failed login attempts.
• Network Security Policy
  A comprehensive network security policy maintains the confidentiality, integrity, and availability of data on a company's systems by adhering to a defined protocol for conducting a periodic evaluation of information systems and network activity. The policy assures that systems have hardware, software, or procedural auditing methods that are adequate. Audit events consist of failed login attempts, the startup or shutdown of information, and the use of privileged accounts. Other items logged include firewall abnormalities, activity over routers and switches, and newly added or uninstalled devices. The date, time, and provenance of the activity should be recorded by the organization.
• Mobile Device Management (MDM) Policy
  This document outlines the acceptable use of corporate assets like mobile phones, tablets, and laptops. This can be combined with other side policies like Bring Your Own Device (BYOD) policies, describing what is acceptable and what is not.
• Classification Policy
  Not all assets are to be protected in the same way because they have a different criticality to your business. By defining classification policies, you will be able to clearly describe what types of assets need to be protected and how they are to be protected. Simple classifications can be "Public", "Confidential" and "Sensitive", but depending on your needs you can add more levels of classification.

Use of a Security Framework

No one likes to reinvent the wheel, and the same holds true for security best practices. Existing security frameworks such as NIST (National Institute of Standards and Technology), ISO (International Organization for Standardization), and CIS (Center for Internet Security) assist firms in establishing successful security plans. In the initial phases of designing a security program, the executive team and security leadership will select a framework that will serve as the program's foundation. Not choosing to adopt a framework will result in the security team wasting time, and can lead to an unstructured and ineffective security program in the long run. These frameworks provide all the guidelines required to establish a comprehensive and effective security program, while also guaranteeing that no processes are overlooked.

Asset Management

Asset management is a vital administrative control, especially if an organization wishes to adopt technical security that is effective and compliant. This idea refers to the deployment and decommissioning of corporate assets, such as laptops, mobile devices, and network and server infrastructure. You cannot secure what you do not know exists, and therefore, asset management is an administrative control designed to ensure that the IT department and security team have a comprehensive overview of all devices inside the firm and a method for spotting "rogue devices" that were deployed without following the normal deployment process.

Typically, assets are divided into "Primary assets" (assets that, when impacted, have a direct impact on the business, and "Supporting assets" (assets that support the primary assets).

An accurate and continuously updated asset inventory is essential to your security, and should therefore get the attention and resources it deserves in your security program.

Identity and Access Management

The saying "you cannot secure what you do not know exists" also applies to user accounts. An identity and access management program is necessary to ensure that a procedure exists for appropriately provisioning and deprovisioning accounts and modifying permissions when employment status or job responsibilities change. This function is essential for minimizing the risk posed by user accounts and ensuring compliance with the principle of least privilege. A procedure must exist between the HR and IT departments to trigger the deployment of a corporate computer and user account, as well as the amount of network access required for the job position, when a user is hired. Similarly, if the user is promoted, moves to a different job, or is terminated, the identity and access management systems must account for and respond to these changes. If they transferred to a new team, their level of access should be modified to withdraw permissions that are no longer required and issue new permissions as appropriate. If an employee is terminated or resigns, the identity and access management team must immediately disable their account and stop any active connections to reduce the risk of malicious access or data exfiltration.

Security Awareness Program

Education and training for security awareness is another essential component of an efficient security program. This is due to the fact that employees are typically the last line of defense in the event that technical security controls are unable to prevent a malicious email, website, or file download from occurring. It is of the utmost importance to ensure that the security team is doing its part to constantly remind personnel of appropriate practices and typical sorts of frauds. Even though software is used in businesses to do security training and simulations, it is essential to have a policy that underpins the security education program. This is done to verify that the security team overseeing the end-user training is acting in line with the policy. For instance, a company's policy might indicate that it will conduct phishing simulations once a month, quarterly security awareness campaigns, and semi-annual security awareness training. Phishing simulations are simulated phishing scams that are used to evaluate employees' reactions to fraudulent emails. A security team is able to use software to build a technical security training program that is in line with the expectations of the organization since this is made possible by having a policy that establishes these standards.

Technical Security Controls

These are security controls (i.e., safeguards or countermeasures) for an information system that are primarily implemented and executed by the information system through mechanisms contained in the hardware, software, or firmware components of the system.

Some common technical controls include secure OS (operating system) configurations, otherwise known as OS hardening, antivirus solutions, and firewalls.

In addition to controls that are based on software or configuration, there are also technical controls that are more conceptual or procedural in nature. Things such as Zero Trust Network Access (ZTNA), Network Access Control (NAC), vulnerability management, and logging and monitoring all depend on some level of technical implementation. However, these are all overarching concepts that require multiple processes and procedures, in addition to policies, to support their successful development and implementation.

Endpoint Protection

Endpoint protection refers to all of the technological security controls that are utilized in order to safeguard an endpoint, which may also be referred to as a workstation or a server. Endpoint protection typically consists of an antivirus program, which should be of the next-generation variety these days and should include EDR (endpoint detection and response) capabilities, as well as operating system security and hardening, a firewall, internet security, and vulnerability scanning. Together, these security tools offer a higher level of technical protection by way of secure configurations, filtering of a user's internet activities and the behavior that occurs on their device, and automatic blocking of known malicious behavior or activity, such as the execution of a command or the download of a file linked to malware.

Email Security

In order to protect email communications, it is necessary to set up an email entry point that is capable of screening, analyzing, and blocking emails that may contain harmful content. Corporate email security is designed to stop fraudulent emails before they reach users' inboxes, as I'm sure we've all experienced at least once. Before an incoming email is delivered, email security tools will typically perform an inspection on it to look for known signatures of malicious emails, such as known bad senders, phishing links, or file hashes. These tools will also look for common indicators that the email isn't legitimate, such as misspelled words or a sense of urgency in the text. Modern email security solutions also provide more extensive capabilities, such as post-delivery quarantine in the event that a malicious email is discovered to have been delivered, and "Report Phish" capabilities, which enable a user to report an email they received so that it can be reevaluated by the email security tool. These capabilities are provided in the event that a malicious email is detected to have been delivered.

Logging and Monitoring

It is absolutely necessary to have adequate recording and monitoring systems in place before beginning any activity related to detection or reaction. It is essential to not only have these capabilities, but also to have them centralized under something known as a SIEM, which stands for a Security Information and Event Management system. SIEM technologies make it possible for a company to deliver logs from a variety of sources—typically active directory logs, endpoint security tools, and firewalls, among others—to a single place, where the security team can run searches and produce alerts. The capabilities of modern SIEM tools have been extended even further in order to provide out-of-the-box playbooks for automation and common watchlists. These features are intended to assist security teams in identifying known harmful behaviors and activities and in automatically carrying out actions when certain conditions are met. For instance, a team may want to enable a playbook that would automatically quarantine a device once there is evidence that it has been used for nefarious purposes. This expedites the reaction and swiftly neutralizes a possible danger, so preventing the threat from spreading laterally and infecting additional systems.

Network Security

Filtering of traffic that moves through the internal network as well as traffic that enters or exits the network from the internet is one of the technical controls that are a part of network security. A firewall is the most popular type of security control for a network. It is responsible for inspecting data packets as they travel through it to verify that they are not coming from or going to a dangerous location. Next-generation firewalls have even further developed features, such as inspection that is able to identify malicious software and data exfiltration. In addition to firewalls, several additional network security solutions can contribute to the security principles inside an enterprise. The general aim is to help network security teams adhere to the principle of least privilege. This is accomplished by only granting access to those network resources that an employee, contractor, or guest needs to do their job on the network.

Vulnerability Management

Because of the ever-changing nature of the threat landscape, vulnerability management is an absolutely necessary practice. It is a term that refers to the processes and procedures that, when combined, operate to find, analyze, and correct vulnerabilities, also known as flaws, in systems and organizational infrastructure.

When we think about asset management, one thing that comes to mind is how important it is to have an accurate asset inventory. This is because having an accurate asset inventory is necessary in order to guarantee that a security team is conducting vulnerability assessments against all corporate devices.

A security team can use vulnerability tools to view the vulnerabilities that are present within the corporate environment, drill down into specific asset groups like servers or workstations, and even more specifically review the vulnerabilities discovered on specific systems. This is made possible by having a single place to go to view the vulnerabilities that are present within the corporate environment.

In addition to conducting ongoing scans for security flaws, the security team is responsible for coordinating their efforts with colleagues from across IT and the business divisions in order to prioritize and address any issues that are discovered. This procedure, which is also known as patch management and describes how an organization will patch or remediate the vulnerabilities detected on its systems, is also referred to as "patch management." In most cases, a policy will mention the acceptable time to remediate critical, high, medium, and low severity vulnerabilities. The policy will often state that the discovery should be mitigated as quickly as possible if it is deemed critical.

Conclusion

The process of developing and putting into action a program to protect sensitive information is neither simple nor quick. It requires careful preparation, adequate resources, and a significant amount of time. And once a company has implemented the components that are discussed in this article, it is required to make ongoing efforts to advance the maturity of the program and its capabilities, as well as to ensure that it remains current with both established security best practices and new types of threats. The protection of sensitive data is a difficult challenge for which there is no easy answer. The culmination of administrative and technical controls, along with physical security, should be used to create one-of-a-kind security programs for each company that effectively protect an organization, as well as its people, processes, and technology.

Using our Brainframe.com ISMS/GRC solution, we help you implement, document, and maintain all of the elements discussed in this article in a centralized way, while allowing you to efficiently collaborate internally and also with external consultants for elements in which you might lack the expertise.

Start for free now! 

Like with GDPR, don't wait until the last moment because this will only be more expensive and put unneeded stress on your teams!

Start your free account