Online Exclusive Series Part 2: A Glimmer of Hope

Online Exclusive Series Part 2: A Glimmer of Hope

(Did you miss Part 1? Click here to catch up!)

All was not lost, as in stepped the International Information Systems Security Certification Consortium (ISC)² in 1988. “The Consortium” was formed among several professional organizations to create a global information security certification process for professionals and address the need for standardized curriculum for the burgeoning profession.

The goal was noble and the need certain; however, the execution might be considered less than particularly effective. In 1992, ISC² released the Common Book of Knowledge (CBK). The CBK established a common framework of information security terms and principles, which allowed information security professionals worldwide to discuss, debate, and resolve matters pertaining to the profession with a common understanding. The CBK exposes Information Security (InfoSec) professionals to a very broad landscape of InfoSec coverage and is an excellent resource. However, of the some thousand pages of content in the CBK I used for study, only two were devoted to Information Security Governance. In essence, we were still fixated on the nose-gear light, instead of business indicators.

Auditors — people InfoSec professionals know all too well — actually took a lead role in developing what is known as the Generally Accepted Accounting Principles (GAAP), a standard framework of guidelines for financial accounting. The need is almost too obvious for definition, but if GAAP did not exist, companies would not be able to provide accurate and consistent financial information to investors, creditors and stakeholders of a company.

Surely Information Security has a standard framework of Generally Accepted Information Security Principles — a GAISP if you will.  And of course, there is one. Or rather, there was one.  The Information Systems Security Association (ISSA) had a GAISP.  GAISP was the successor to the GASSP, the Generally Accepted System Security Principles.  The original GASSP project was formed in mid-1992 in response to Recommendation #1 of the report "Computers at Risk" (CAR), published by the United States of America's National Research Council in December of 1990.  The GAISP even had its own domain; both the framework and domain are now dead.

As near as I can tell, GAISP was dropped between 2004 and 2007.  I quote from the last version (emphasis added):

“Recognizing the hierarchic nature of principles, GAISP will be organized in three levels: The Pervasive Principles which target governance and describe the conceptual goals of information security; the Broad Functional Principles which target management and describe specific building blocks (what to do) that comprise the Pervasive Principles; and the Detailed Principles, which target the information security professional and include specific ‘how to’ guidance for implementation of optimal information security practices.”

InfoSec Governance…directing InfoSec Management…directing InfoSec Professionals’ actions:

“…the right target focus areas, and the right order of focus.  It’s as if someone lifted their head enough to recognize that the landing gear light might not be the only problem.  Unfortunately, something happened and all eyes were refocused back on the light, which was, in this case, is the “target information security professionals” and the descending glide slope is ‘target governance’ and ‘target management.’”

What We Need Here is a Good Framework

Michael Dell, founder of Dell Computers, was right when he said, “You don't have to be a genius or a visionary or even a college graduate to be successful. You just need a framework and a dream.”

Notice he didn’t say you need a cornucopia of frameworks, just a framework.

Frameworks are not perfect; they are living standards that get adjusted through growth and learning.  Nevertheless, having what I like to call a “littering of frameworks” is not helpful.  Some may see this as a great thing, because the professional can pick what fits best.  In some ways that is true, but Information Security should not be treated like a doughnut shop.

Why do I say this?

If you are in Information Security you have many choices, not only in how you will be defeated (and you will be — either by hackers, bad code, or management) but in the framework you elect to follow (if you actually pick a framework).  Some of my favorites are ISO/IEC 27002:2005, COBIT, COSO, Common Criteria, ITIL, FISMA, ISF, ISM, NIST SP800’s, PCIDSS, SABSA… just to name a few. You can imagine my joy when DHS teamed up with NIST to release yet another, the Cyber Security Framework. It stems from a couple of executive orders, which created the Critical Infrastructure Cyber Community (C3) Voluntary Program. There is a word in that title that should stick out to you as spelling impending doom. If you do not know which word, you should probably keep reading. If you do know the word, keep reading anyway…for the cathartic pleasure.

There is no framework I have read — from ISO27002 to Cobit to the Cyber Security Framework — for which I do not appreciate the amount of work invested or the completeness of vision. If you have never worked on a committee to develop one of these, you may find it hard to appreciate what a painful journey it can be, with a lot of emotional drain thrown in for good measure. However, as painful as putting a framework together can be, it pales in comparison with trying to implement one.

We are now getting very close to being able to take our eyes off the non-functioning landing gear light and take full appreciation of our glide path. Does anyone think we just do not have enough frameworks? Does anyone think the frameworks we have are pitifully unequal to the task? Maybe we need more certifications. I could list all of those but it would add another 200 pages. Maybe we just do not have enough schools offering Cyber Security curricula. Could it be the “compliancy based” versus “risk based” security paradigm?

About the Author

Martin Zinaich is the information security officer for the City of Tampa’s Technology and Innovation department. The insights in this article were shared at a Wisegate member event, where senior IT professionals discussed these pressing security issues.

Featured

  • Data Driven, Proactive Response

    As cities face rising demands for smarter policing and faster emergency response, Real Time Crime Centers (RTCCs) are emerging as essential hubs for data-driven public safety. In this interview, two experts with deep field experience — Ross Bourgeois of New Orleans and Dean Cunningham of Axis Communications — draw on decades of operational, leadership and technology expertise to share how RTCCs are transforming public safety through innovation, interagency collaboration and a relentless focus on community impact. Read Now

  • Integration Imagination: The Future of Connected Operations

    Security teams that collaborate cross-functionally and apply imagination and creativity to envision and design their ideal integrated ecosystem will have the biggest upside to corporate security and operational benefits. Read Now

  • Smarter Access Starts with Flexibility

    Today’s workplaces are undergoing a rapid evolution, driven by hybrid work models, emerging smart technologies, and flexible work schedules. To keep pace with growing workplace demands, buildings are becoming more dynamic – capable of adapting to how people move, work, and interact in real-time. Read Now

  • Trends Keeping an Eye on Business Decisions

    Today, AI continues to transform the way data is used to make important business decisions. AI and the cloud together are redefining how video surveillance systems are being used to simulate human intelligence by combining data analysis, prediction, and process automation with minimal human intervention. Many organizations are upgrading their surveillance systems to reap the benefits of technologies like AI and cloud applications. Read Now

  • Right-Wing Activist Charlie Kirk Dies After Utah Valley University Shooting

    Charlie Kirk, a popular conservative activist and founder of Turning Point USA, died Wednesday after being shot during an on-campus event at Utah Valley University in Orem, Utah Read Now

New Products

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions.