Note: If you click any
of the 4 images presented in this chapter, it will display a larger and better
image quality at regular size. We shrunk the images on these pages to half its
scanned size so it would fit on web page better.
|
Special Publication 800-12: An Introduction to Computer Security
- The NIST Handbook
|
Chapter 6:
COMPUTER SECURITY PROGRAM
MANAGEMENT
Computers and the information
they process are critical to many organizations' ability to perform
their mission and business functions.56
It therefore makes sense that executives view computer security as
a management issue and seek to protect their organization's computer
resources as they would any other valuable asset. To do this effectively
requires developing of a comprehensive management approach.
| OMB
Circular A-130, "Management of Federal Information Resources,
"requires that federal agencies establish computer security
programs. |
This chapter presents an
organizationwide approach to computer security and discusses its important
management function.57 Because organizations
differ vastly in size, complexity, management styles, and culture,
it is not possible to describe one ideal computer security program.
However, this chapter does describe some of the features and issues
common to many federal organizations.
6.1 Structure of a Computer
Security Program
Many computer security
programs that are distributed throughout the organization have different
elements performing various functions. While this approach has benefits,
the distribution of the computer security function in many organizations
is haphazard, usually based upon history (i.e., who was available
in the organization to do what when the need arose). Ideally, the
distribution of computer security functions should result from a planned
and integrated management philosophy.
Managing computer security
at multiple levels brings many benefits. Each level contributes to
the overall computer security program with different types of expertise,
authority, and resources. In general, higher-level officials (such
as those at the headquarters or unit levels in the agency described
above) better understand the organization as a whole and have more
authority. On the other hand, lower-level officials (at the computer
facility and applications levels) are more familiar with the specific
requirements, both technical and procedural, and problems of the systems
and the users. The levels of computer security program management
should be complementary; each can help the other be more effective.
|
Sources
of (Some) Requirements for
Federal Unclassified Computer Security Programs
A federal
agency computer security program is created and operates in
an environment rich in guidance and direction from other organizations.
Figure 6.1 illustrates some of the external sources of requirements
and guidance directed toward agency management with regard
to computer security. While a full discussion of each is outside
the scope of this chapter, it is important to realize that
a program does not operate in a vacuum; federal organizations
are constrained - by both statute and regulation - in a number
of ways.
Figure
6.1
|
Since many organizations
have at least two levels of computer security management, this chapter
divides computer security program management into two levels: the
central level and the system level. (Each organization, though, may
have its own unique structure.) The central computer security program
can be used to address the overall management of computer security
within an organization or a major component of an organization. The
system-level computer security program addresses the management of
computer security for a particular system.
|
Sample
Federal Agency Management Structure
Figure
6.2 shows a management structure based on that of an actual
federal agency. The agency consists of three major units, each
with several large computer facilities running multiple applications.
This type of organization needs to manage computer security
at the agency level, the unit level, the computer
facility level, and the application level.
Figure
6.2
|
6.2 Central Computer Security
Programs
The purpose of a central
computer security program is to address the overall management of
computer security within an organization. In the federal government,
the organization could consist of a department, agency, or other major
operating unit.
As with the management
of all resources, central computer security management can be performed
in many practical and cost-effective ways. The importance of sound
management cannot be overemphasized. There is also a downside to centrally
managed computer security programs. Specifically, they present greater
risk that errors in judgment will be more widely propagated throughout
the organization. As they strive to meet their objectives, managers
need to consider the full impact of available options when establishing
their computer security programs.
6.2.1 Benefits of Central
Computer Security Programs
A central security problem
should provide two quite distinct types of benefits:
- Increased efficiency
and economy of security throughout the organization, and
- the ability to provide
centralized enforcement and oversight.
Both of these benefits
are in keeping with the purpose of the Paperwork Reduction Act, as
implemented in OMB Circular A-130.
The Paperwork Reduction
Act establishes a broad mandate for agencies to perform their information
management activities in an efficient, effective, and economical
manner...Agencies shall assure an adequate level of security for
all agency automated information systems, whether maintained in-house
or commercially.58
6.2.2 Efficient, Economic
Coordination of Information
A central computer security
program helps to coordinate and manage effective use of security-related
resources throughout the organization. The most important of these
resources are normally information and financial resources.
Sound and timely information
is necessary for managers to accomplish their tasks effectively. However,
most organizations have trouble collecting information from myriad
sources and effectively processing and distributing it within the
organization. This section discusses some of the sources and efficient
uses of computer security information.
Within the federal government,
many organizations such as the Office of Management and Budget, the
General Services Administration, the National Institute of Standards
and Technology, and the National Telecommunications and Information
Administration, provide information on computer, telecommunications,
or information resources. This information includes security-related
policy, regulations, standards, and guidance. A portion of the information
is channeled through the senior designated official for each agency
(see Federal Information Resources Management Regulation [FIRMR] Part
201-2). Agencies are expected to have mechanisms in place to distribute
the information the senior designated official receives.
Computer security-related
information is also available from private and federal professional
societies and groups. These groups will often provide the information
as a public service, although some private groups charge a fee for
it. However, even for information that is free or inexpensive, the
costs associated with personnel gathering the information can be high.
Internal security-related
information, such as which procedures were effective, virus infections,
security problems, and solutions, need to be shared within an organization.
Often this information is specific to the operating environment and
culture of the organization.
A computer security program
administered at the organization level can provide a way to collect
the internal security-related information and distribute it as needed
throughout the organization. Sometimes an organization can also share
this information with external groups. See Figure 6.3.
Another use of an effective
conduit of information is to increase the central computer security
program's ability to influence external and internal policy decisions.
If the central computer security program office can represent the
entire organization, then its advice is more likely to be heeded by
upper management and external organizations. However, to be effective,
there should be excellent communication between the system-level computer
security programs and the organization level. For example, if an organization
were considering consolidating its mainframes into one site (or considering
distributing the processing currently done at one site), personnel
at the central program could provide initial opinions about the security
implications. However, to speak authoritatively, central program personnel
would have to actually know the security impacts of the proposed change
-- information that would have to be obtained from the system-level
computer security program.
| An
organization's components may develop specialized expertise,
which can be shared among components. For example, one operating
unit may primarily use UNIX and have developed skills in UNIX
security. A second operating unit (with only one UNIX machine),
may concentrate on MVS security and rely on the first unit's
knowledge and skills for its UNIX machine. |
Besides being able to help
an organization use information more cost effectively, a computer
security program can also help an organization better spend its scarce
security dollars. Organizations can develop expertise and then share
it, reducing the need to contract out repeatedly for similar services.
The central computer security program can help facilitate information
sharing.
Personnel at the central
computer security program level can also develop their own areas of
expertise. For example, they could sharpen their skills could in contingency
planning and risk analysis to help the entire organization perform
these vital security functions.
|
Some
Principal Security Program Interactions
Figure
6.3 shows a simplified version of the flow of computer
security-related information among various parts of an organization
and across different organizations.
Figure
6.3
|
Besides allowing an organization
to share expertise and, therefore, save money, a central computer
security program can use its position to consolidate requirements
so the organization can negotiate discounts based on volume purchasing
of security hardware and software. It also facilitates such activities
as strategic planning and organizationwide incident handling and security
trend analysis.
6.2.3 Central Enforcement
and Oversight
Besides helping an organization
improve the economy and efficiency of its computer security program,
a centralized program can include an independent evaluation or enforcement
function to ensure that organizational subunits are cost-effectively
securing resources and following applicable policy. While the Office
of the Inspector General (OIG) and external organizations, such as
the General Accounting Office (GAO), also perform a valuable evaluation
role, they operate outside the regular management channels. Chapters
8 and 9 further discuss the role of independent audit.
There are several reasons
for having an oversight function within the regular management channel.
First, computer security is an important component in the management
of organizational resources. This is a responsibility that cannot
be transferred or abandoned. Second, maintaining an internal oversight
function allows an organization to find and correct problems without
the potential embarrassment of an IG or GAO audit or investigation.
Third, the organization may find different problems from those that
an outside organization may find. The organization understands its
assets, threats, systems, and procedures better than an external organization;
additionally, people may have a tendency to be more candid with insiders.
6.3 Elements of an Effective
Central Computer Security Program
For a central computer
security program to be effective, it should be an established part
of organization management. If system managers and applications owners
do not need to consistently interact with the security program, then
it can become an empty token of upper management's "commitment
to security."
Stable Program Management
Function. A well-established program will have a program manager
recognized within the organization as the central computer security
program manager. In addition, the program will be staffed with able
personnel, and links will be established between the program management
function and computer security personnel in other parts of the organization.
A computer security program is a complex function that needs a stable
base from which to direct the management of such security resources
as information and money. The benefits of an oversight function cannot
be achieved if the computer security program is not recognized within
an organization as having expertise and authority.
Stable Resource Base.
A well-established program will have a stable resource base in terms
of personnel, funds, and other support. Without a stable resource
base, it is impossible to plan and execute programs and projects effectively.
Existence of Policy.
Policy provides the foundation for the central computer security program
and is the means for documenting and promulgating important decisions
about computer security. A central computer security program should
also publish standards, regulations, and guidelines that implement
and expand on policy. (See Chapter 5.)
Published Mission and
Functions Statement. A published mission statement grounds the
central computer security program into the unique operating environment
of the organization. The statement clearly establishes the function
of the computer security program and defines responsibilities for
both the computer security program and other related programs and
entities. Without such a statement, it is impossible to develop criteria
for evaluating the effectiveness of the program.
Long-Term Computer Security
Strategy. A well-established program explores and develops long-term
strategies to incorporate computer security into the next generation
of information technology. Since the computer and telecommunications
field moves rapidly, it is essential to plan for future operating
environments.
Compliance Program.
A central computer security program needs to address compliance with
national policies and requirements, as well as organization-specific
requirements. National requirements include those prescribed under
the Computer Security Act of 1987, OMB Circular A-130, the FIRMR,
and Federal Information Processing Standards.
|
Example
Agency IRM
offices engage in strategic and tactical planning for both
information and information technology, in accordance with
the Paperwork Reduction Act and OMB Circular A-130. Security
should be an important component of these plans. The security
needs of the agency should be reflected in the information
technology choices and the information needs of the agency
should be reflected in the security program.
|
Intraorganizational
Liaison. Many offices within an organization can affect computer
security. The Information Resources Management organization and physical
security office are two obvious examples. However, computer security
often overlaps with other offices, such as safety, reliability and
quality assurance, internal control, or the Office of the Inspector
General. An effective program should have established relationships
with these groups in order to integrate computer security into the
organization's management. The relationships should encompass more
than just the sharing of information; the offices should influence
each other.
Liaison with External
Groups. There are many sources of computer security information,
such as NIST's Computer Security Program Managers' Forum, computer
security clearinghouse, and the Forum of Incident Response and Security
Teams (FIRST). An established program will be knowledgeable of and
will take advantage of external sources of information. It will also
be a provider of information.
6.4 System-Level Computer
Security Programs
While the central program
addresses the entire spectrum of computer security for an organization,
system-level programs ensure appropriate and cost-effective security
for each system.59 This includes influencing
decisions about what controls to implement, purchasing and installing
technical controls, day-to-day computer security administration, evaluating
system vulnerabilities, and responding to security problems. It encompasses
all the areas discussed in the handbook.
System-level computer security
program personnel are the local advocates for computer security. The
system security manager/officer raises the issue of security with
the cognizant system manager and helps develop solutions for security
problems. For example, has the application owner made clear the system's
security requirements? Will bringing a new function online affect
security, and if so, how? Is the system vulnerable to hackers and
viruses? Has the contingency plan been tested? Raising these kinds
of questions will force system managers and application owners to
identify and address their security requirements.
6.5 Elements of Effective
System-Level Programs
Like the central computer
security program, many factors influence how successful a system-level
computer security program is. Many of these are similar to the central
program. This section addresses some additional considerations.
Security Plans.
The Computer Security Act mandates that agencies develop computer
security and privacy plans for sensitive systems. These plans ensure
that each federal and federal interest system has appropriate and
cost-effective security. System-level security personnel should be
in a position to develop and implement security plans. Chapter 8 discusses
the plans in more detail.
System-Specific Security
Policy. Many computer security policy issues need to be addressed
on a system-specific basis. The issues can vary for each system, although
access control and the designation of personnel with security responsibility
are likely to be needed for all systems. A cohesive and comprehensive
set of security policies can be developed by using a process that
derives security rules from security goals, as discussed in Chapter
5.
Life Cycle Management.
As discussed in Chapter 8, security must be managed throughout a system's
life cycle. This specifically includes ensuring that changes to the
system are made with attention to security and that accreditation
is accomplished.
Integration With System
Operations. The system-level computer security program should
consist of people who understand the system, its mission, its technology,
and its operating environment. Effective security management usually
needs to be integrated into the management of the system. Effective
integration will ensure that system managers and application owners
consider security in the planning and operation of the system. The
system security manager/officer should be able to participate in the
selection and implementation of appropriate technical controls and
security procedures and should understand system vulnerabilities.
Also, the system-level computer security program should be capable
of responding to security problems in a timely manner.
For large systems, such
as a mainframe data center, the security program will often include
a manager and several staff positions in such areas as access control,
user administration, and contingency and disaster planning. For small
systems, such as an officewide local-area-network (LAN), the LAN administrator
may have adjunct security responsibilities.
Separation From Operations.
A natural tension often exists between computer security and operational
elements. In many instances, operational components -- which tend
to be far larger and therefore more influential -- seek to resolve
this tension by embedding the computer security program in computer
operations. The typical result of this organizational strategy is
a computer security program that lacks independence, has minimal authority,
receives little management attention, and has few resources. As early
as 1978, GAO identified this organizational mode as one of the principal
basic weaknesses in federal agency computer security programs.60
System-level programs face this problem most often.
This conflict between the
need to be a part of system management and the need for independence
has several solutions. The basis of many of the solutions is a link
between the computer security program and upper management, often
through the central computer security program. A key requirement of
this setup is the existence of a reporting structure that does not
include system management. Another possibility is for the computer
security program to be completely independent of system management
and to report directly to higher management. There are many hybrids
and permutations, such as co-location of computer security and systems
management staff but separate reporting (and supervisory) structures.
Figure 6.4 presents one example of placement of the computer
security program within a typical Federal agency.61
|
Example
of Organizational Placement of Computer Security Functions
Figure
6.4 illustrates one example of the placement of the computer
security program-level and system-level functions. The program-level
function is located within the IRM organization and sets policy
for the organization as a whole. The system-level function,
located within the Data Center, provides for day-to-day security
at that site. Note that, although not pictured, other system-level
programs may exist for other facilities (e.g., under another
Assistant Secretary).
Figure
6.4
|
6.6 Central and System-Level
Program Interactions
A system-level program
that is not integrated into the organizational program may have difficulty
influencing significant areas affecting security. The system-level
computer security program implements the policies, guidance, and regulations
of the central computer security program. The system-level office
also learns from the information disseminated by the central program
and uses the experience and expertise of the entire organization.
The system-level computer security program further distributes information
to systems management as appropriate.
Communications, however,
should not be just one way. System-level computer security programs
inform the central office about their needs, problems, incidents,
and solutions. Analyzing this information allows the central computer
security program to represent the various systems to the organization's
management and to external agencies and advocate programs and policies
beneficial to the security of all the systems.
6.7 Interdependencies
The general purpose of
the computer security program, to improve security, causes it to overlap
with other organizational operations as well as the other security
controls discussed in the handbook. The central or system computer
security program will address most controls at the policy, procedural,
or operational level.
Policy. Policy is
issued to establish the computer security program. The central computer
security program(s) normally produces policy (and supporting procedures
and guidelines) concerning general and organizational security issues
and often issue-specific policy. However, the system-level computer
security program normally produces policy for that system. Chapter
5 provides additional guidance.
Life Cycle Management.
The process of securing a system over its life cycle is the role of
the system-level computer security program. Chapter 8 addresses these
issues.
Independent Audit.
The independent audit function described in Chapters 8 and 9 should
complement a central computer security program's compliance functions.
6.8 Cost Considerations
This chapter discussed
how an organization wide computer security program can manage security
resources, including financial resources, more effectively. The cost
considerations for a system-level computer security program are more
closely aligned with the overall cost savings in having security.
The most significant direct
cost of a computer security program is personnel. In addition, many
programs make frequent and effective use of consultants and contractors.
A program also needs funds for training and for travel, oversight,
information collection and dissemination, and meetings with personnel
at other levels of computer security management.
References
Federal Information
Resources Management Regulations, especially 201-2. General Services
Administration. Washington, DC.
General Accounting Office.
Automated Systems Security--Federal Agencies Should Strengthen
Safeguards Over Personal and Other Sensitive Data. GAO Report
LCD 78-123. Washington, DC. 1978.
General Services Administration.
Information Resources Security: What Every Federal Manager Should
Know. Washington, DC.
Helsing, C., M. Swanson,
and M. Todd. Executive Guide to the Protection of Information Resources.,
Special Publication 500-169. Gaithersburg, MD: National Institute
of Standards and Technology, 1989.
Helsing, C., M. Swanson,
and M. Todd. Management Guide for the Protection of Information
Resources. Special Publication 500-170. Gaithersburg, MD: National
Institute of Standards and Technology, 1989.
"Managing an Organization
Wide Security Program." Computer Security Institute, San Francisco,
CA. (course)
Office of Management and
Budget. "Guidance for Preparation of Security Plans for Federal
Computer Systems That Contain Sensitive Information." OMB Bulletin
90-08. Washington, DC, 1990.
Office of Management and
Budget. Management of Federal Information Resources. OMB Circular
A-130.
Owen, R., Jr. "Security
Management: Using the Quality Approach." Proceedings of the
15th National Computer Security Conference. Baltimore, MD: Vol.
2, 1992. pp. 584-592.
Spiegel, L. "Good
LAN Security Requires Analysis of Corporate Data." Infoworld.
15(52), 1993. p. 49.
U.S. Congress. Computer
Security Act of 1987. Public Law 100-235. 1988.
Footnotes:
56.
This chapter is primarily directed at federal agencies, which are generally
very large and complex organizations. This chapter discusses programs,
which are suited to managing security in such environments. They may
be wholly inappropriate for smaller organizations or private sector
firms.
57. This chapter addresses the management of security
programs, not the various activities such as risk analysis or contingency
planning that make up an effective security program.
58. OMB Circular A-130, Section 5; Appendix III, Section
3.
59. As is implied by the name, an organization will
typically have several system-level computer security programs. In setting
up these programs, the organization should carefully examine the scope
of each system-level program. System-level computer security programs
may address, for example, the computing resources within an operational
element, a major application, or a group of similar systems (either
technologically or functionally).
60. General Accounting Office, "Automated System Security
-- Federal Agencies Should Strengthen Safeguards Over Personal and Other
Sensitive Data," GAO Report LCD 78-123, Washington, DC, 1978.
61. No implication that this structure is ideal is
intended.
Back
to Previous Page | Back
to Special Publication 800-12 Home Page
Last
updated:
July 6, 2007
Page created: July 1, 2004
