Online Exclusive Series Part 2: A Glimmer of Hope

Online Exclusive Series Part 2: A Glimmer of Hope

(Did you miss Part 1? Click here to catch up!)

All was not lost, as in stepped the International Information Systems Security Certification Consortium (ISC)² in 1988. “The Consortium” was formed among several professional organizations to create a global information security certification process for professionals and address the need for standardized curriculum for the burgeoning profession.

The goal was noble and the need certain; however, the execution might be considered less than particularly effective. In 1992, ISC² released the Common Book of Knowledge (CBK). The CBK established a common framework of information security terms and principles, which allowed information security professionals worldwide to discuss, debate, and resolve matters pertaining to the profession with a common understanding. The CBK exposes Information Security (InfoSec) professionals to a very broad landscape of InfoSec coverage and is an excellent resource. However, of the some thousand pages of content in the CBK I used for study, only two were devoted to Information Security Governance. In essence, we were still fixated on the nose-gear light, instead of business indicators.

Auditors — people InfoSec professionals know all too well — actually took a lead role in developing what is known as the Generally Accepted Accounting Principles (GAAP), a standard framework of guidelines for financial accounting. The need is almost too obvious for definition, but if GAAP did not exist, companies would not be able to provide accurate and consistent financial information to investors, creditors and stakeholders of a company.

Surely Information Security has a standard framework of Generally Accepted Information Security Principles — a GAISP if you will.  And of course, there is one. Or rather, there was one.  The Information Systems Security Association (ISSA) had a GAISP.  GAISP was the successor to the GASSP, the Generally Accepted System Security Principles.  The original GASSP project was formed in mid-1992 in response to Recommendation #1 of the report "Computers at Risk" (CAR), published by the United States of America's National Research Council in December of 1990.  The GAISP even had its own domain; both the framework and domain are now dead.

As near as I can tell, GAISP was dropped between 2004 and 2007.  I quote from the last version (emphasis added):

“Recognizing the hierarchic nature of principles, GAISP will be organized in three levels: The Pervasive Principles which target governance and describe the conceptual goals of information security; the Broad Functional Principles which target management and describe specific building blocks (what to do) that comprise the Pervasive Principles; and the Detailed Principles, which target the information security professional and include specific ‘how to’ guidance for implementation of optimal information security practices.”

InfoSec Governance…directing InfoSec Management…directing InfoSec Professionals’ actions:

“…the right target focus areas, and the right order of focus.  It’s as if someone lifted their head enough to recognize that the landing gear light might not be the only problem.  Unfortunately, something happened and all eyes were refocused back on the light, which was, in this case, is the “target information security professionals” and the descending glide slope is ‘target governance’ and ‘target management.’”

What We Need Here is a Good Framework

Michael Dell, founder of Dell Computers, was right when he said, “You don't have to be a genius or a visionary or even a college graduate to be successful. You just need a framework and a dream.”

Notice he didn’t say you need a cornucopia of frameworks, just a framework.

Frameworks are not perfect; they are living standards that get adjusted through growth and learning.  Nevertheless, having what I like to call a “littering of frameworks” is not helpful.  Some may see this as a great thing, because the professional can pick what fits best.  In some ways that is true, but Information Security should not be treated like a doughnut shop.

Why do I say this?

If you are in Information Security you have many choices, not only in how you will be defeated (and you will be — either by hackers, bad code, or management) but in the framework you elect to follow (if you actually pick a framework).  Some of my favorites are ISO/IEC 27002:2005, COBIT, COSO, Common Criteria, ITIL, FISMA, ISF, ISM, NIST SP800’s, PCIDSS, SABSA… just to name a few. You can imagine my joy when DHS teamed up with NIST to release yet another, the Cyber Security Framework. It stems from a couple of executive orders, which created the Critical Infrastructure Cyber Community (C3) Voluntary Program. There is a word in that title that should stick out to you as spelling impending doom. If you do not know which word, you should probably keep reading. If you do know the word, keep reading anyway…for the cathartic pleasure.

There is no framework I have read — from ISO27002 to Cobit to the Cyber Security Framework — for which I do not appreciate the amount of work invested or the completeness of vision. If you have never worked on a committee to develop one of these, you may find it hard to appreciate what a painful journey it can be, with a lot of emotional drain thrown in for good measure. However, as painful as putting a framework together can be, it pales in comparison with trying to implement one.

We are now getting very close to being able to take our eyes off the non-functioning landing gear light and take full appreciation of our glide path. Does anyone think we just do not have enough frameworks? Does anyone think the frameworks we have are pitifully unequal to the task? Maybe we need more certifications. I could list all of those but it would add another 200 pages. Maybe we just do not have enough schools offering Cyber Security curricula. Could it be the “compliancy based” versus “risk based” security paradigm?

About the Author

Martin Zinaich is the information security officer for the City of Tampa’s Technology and Innovation department. The insights in this article were shared at a Wisegate member event, where senior IT professionals discussed these pressing security issues.

Featured

  • Facing Facts for Facilities

    Despite the proliferation of constantly evolving security solutions, there remains a troubling trend among many facility operators who often neglect the most important security assets within their organization. Keys and shared devices like radios, laptops and tablets are crucial to successful operations, yet many operators are managing them haphazardly through outdated storage systems like pegboards and notebooks. Read Now

  • Report Reveals Security Training Reduces Global Phishing Click Rates by 86%

    KnowBe4, the cybersecurity platform that comprehensively addresses human risk management, today launched its “Phishing by Industry Benchmarking Report 2025” which measures an organization’s Phish-prone Percentage (PPP) — the percentage of employees likely to fall for social engineering or phishing attacks, indicating the organization’s overall susceptibility to phishing threats. This year’s report found a global average baseline PPP of 33.1%, meaning a third of employees interact with phishing simulations before taking part in best-practice security awareness training (SAT).COVER 2025-PIB-NA-Report_EN-US Read Now

  • TSA Begins REAL ID Full Enforcement Today

    Today, the Transportation Security Administration (TSA) announced the imminent implementation of its REAL ID enforcement measures at TSA checkpoints nationwide. Read Now

  • Body-Worn Cameras on the Rise

    On the evening of Oct. 29, 2024, the owner of 300 Guard based in Houston, was shot while on duty at a convenience store. He returned fire. He was wearing a plated vest and thankfully recovered in the hospital. Read Now

  • Brazil Port Enhances Surveillance and Supports Wildlife Conservation with Sustainable Technology

    Ferroport, which operates the iron ore terminal at the Port of Açu in São João da Barra, Rio de Janeiro, Brazil, has deployed state-of-the-art video surveillance cameras from Axis Communications to enhance nighttime security and visibility, while decreasing environmental impact and prioritizing sustainability. With cutting-edge technology, the port now has precise surveillance cameras that capture high-quality nighttime images, while reducing the amount of artificial lighting that negatively impacts the surrounding ecosystem. Read Now

New Products

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure.

  • Mobile Safe Shield

    Mobile Safe Shield

    SafeWood Designs, Inc., a manufacturer of patented bullet resistant products, is excited to announce the launch of the Mobile Safe Shield. The Mobile Safe Shield is a moveable bullet resistant shield that provides protection in the event of an assailant and supplies cover in the event of an active shooter. With a heavy-duty steel frame, quality castor wheels, and bullet resistant core, the Mobile Safe Shield is a perfect addition to any guard station, security desks, courthouses, police stations, schools, office spaces and more. The Mobile Safe Shield is incredibly customizable. Bullet resistant materials are available in UL 752 Levels 1 through 8 and include glass, white board, tack board, veneer, and plastic laminate. Flexibility in bullet resistant materials allows for the Mobile Safe Shield to blend more with current interior décor for a seamless design aesthetic. Optional custom paint colors are also available for the steel frame.