Case 1 : Control Analysis Assignment

         The first case of  the course "Designing and Executing Information Security Strategies" deals with control analysis and recommendations. The scenario and questions posed are given below. I will post my response in the next post. 

Day 0, life is normal
Q 1 : Explain and support information assurance controls for access to sensitive client banking information by HMC employees?
Q2. Explain and support information assurance controls for how access control is handled administratively?

Yesterday’s Status

·         Financial Services ASP, provides credit clearance software services for 20 large banks worldwide

·         We provide the platform and the software, their (the banks) people operate the system

·         Our DBAs have access to the banks databases for support reasons

·         Network security, database security, application security are all ours

·         All of our customers audit us, using whatever standard they see fit ISO 27002, BS 7799, SS 627799, etc

What’s important to our customers

·         Information in the database includes

·         Names

·         Date of birth

·         Financial details (income, savings, net worth)

·         Credit Card info

·         SSN

·         They want to know that every person with access to the data meets certain criteria

o    Background checked

o    Qualified for the work

o    Authorized specifically for access to their data

Important, Part 2

·         They want to know that there is distinct separation of duties for adding authenticated access to the database

·         They want to know exactly how network (not authenticated) access to web servers, application servers and database servers is protected

·         They want to know who has access to what, and they want to audit these accesses.

 Today (as of 2:00 p.m.) life is getting interesting

·         One of our financial subsidiaries has purchased a company from the country of Georgia, who’s primary business is outsourced programming.

·         While the subsidiary still has local operational control of daily tasks, final decisions are now made by the management team in Tbilisi.

·         For economic reasons, we will be combining management networks and IT support.

 Today as of 4:30 p.m.

·         CEO of the financial subsidiary decides that Tbilisi DBAs are Waaaay less expensive, so we’re going to use them when we can

·         In fact, the Tbilisi data center looks like a great Disaster Recovery site for the US operation.

 Homework 1: Basic Risk Analysis and controls recommendations for a new business environment.

·         Given the case details presented here, prepare and post for peer review information assurance controls for:

o    Access to sensitive client banking information by HMC employees (300 - 500 words)

o    How access control is handled administratively (300 - 500 words)

Suggestions for the Assignment

·         You’re the CISO, so you’re expected to lead, but the CEO is still your boss. Refer to the “What’s important to our customers” slide for inspiration.

·         When in doubt about a detail of how your company operates, make it up – BUT DOCUMENT YOUR ASSUMPTION.

·         Don’t get hung up overly complicated control descriptions. Say as much as you need to convey what is required.

·         Unlike some other classes you have taken, there are no right answers… GOOD answers are well justified and considered while BAD answers are not justified or do not apply to the case.