Online Exclusive Series Part 2: A Glimmer of Hope

Online Exclusive Series Part 2: A Glimmer of Hope

(Did you miss Part 1? Click here to catch up!)

All was not lost, as in stepped the International Information Systems Security Certification Consortium (ISC)² in 1988. “The Consortium” was formed among several professional organizations to create a global information security certification process for professionals and address the need for standardized curriculum for the burgeoning profession.

The goal was noble and the need certain; however, the execution might be considered less than particularly effective. In 1992, ISC² released the Common Book of Knowledge (CBK). The CBK established a common framework of information security terms and principles, which allowed information security professionals worldwide to discuss, debate, and resolve matters pertaining to the profession with a common understanding. The CBK exposes Information Security (InfoSec) professionals to a very broad landscape of InfoSec coverage and is an excellent resource. However, of the some thousand pages of content in the CBK I used for study, only two were devoted to Information Security Governance. In essence, we were still fixated on the nose-gear light, instead of business indicators.

Auditors — people InfoSec professionals know all too well — actually took a lead role in developing what is known as the Generally Accepted Accounting Principles (GAAP), a standard framework of guidelines for financial accounting. The need is almost too obvious for definition, but if GAAP did not exist, companies would not be able to provide accurate and consistent financial information to investors, creditors and stakeholders of a company.

Surely Information Security has a standard framework of Generally Accepted Information Security Principles — a GAISP if you will.  And of course, there is one. Or rather, there was one.  The Information Systems Security Association (ISSA) had a GAISP.  GAISP was the successor to the GASSP, the Generally Accepted System Security Principles.  The original GASSP project was formed in mid-1992 in response to Recommendation #1 of the report "Computers at Risk" (CAR), published by the United States of America's National Research Council in December of 1990.  The GAISP even had its own domain; both the framework and domain are now dead.

As near as I can tell, GAISP was dropped between 2004 and 2007.  I quote from the last version (emphasis added):

“Recognizing the hierarchic nature of principles, GAISP will be organized in three levels: The Pervasive Principles which target governance and describe the conceptual goals of information security; the Broad Functional Principles which target management and describe specific building blocks (what to do) that comprise the Pervasive Principles; and the Detailed Principles, which target the information security professional and include specific ‘how to’ guidance for implementation of optimal information security practices.”

InfoSec Governance…directing InfoSec Management…directing InfoSec Professionals’ actions:

“…the right target focus areas, and the right order of focus.  It’s as if someone lifted their head enough to recognize that the landing gear light might not be the only problem.  Unfortunately, something happened and all eyes were refocused back on the light, which was, in this case, is the “target information security professionals” and the descending glide slope is ‘target governance’ and ‘target management.’”

What We Need Here is a Good Framework

Michael Dell, founder of Dell Computers, was right when he said, “You don't have to be a genius or a visionary or even a college graduate to be successful. You just need a framework and a dream.”

Notice he didn’t say you need a cornucopia of frameworks, just a framework.

Frameworks are not perfect; they are living standards that get adjusted through growth and learning.  Nevertheless, having what I like to call a “littering of frameworks” is not helpful.  Some may see this as a great thing, because the professional can pick what fits best.  In some ways that is true, but Information Security should not be treated like a doughnut shop.

Why do I say this?

If you are in Information Security you have many choices, not only in how you will be defeated (and you will be — either by hackers, bad code, or management) but in the framework you elect to follow (if you actually pick a framework).  Some of my favorites are ISO/IEC 27002:2005, COBIT, COSO, Common Criteria, ITIL, FISMA, ISF, ISM, NIST SP800’s, PCIDSS, SABSA… just to name a few. You can imagine my joy when DHS teamed up with NIST to release yet another, the Cyber Security Framework. It stems from a couple of executive orders, which created the Critical Infrastructure Cyber Community (C3) Voluntary Program. There is a word in that title that should stick out to you as spelling impending doom. If you do not know which word, you should probably keep reading. If you do know the word, keep reading anyway…for the cathartic pleasure.

There is no framework I have read — from ISO27002 to Cobit to the Cyber Security Framework — for which I do not appreciate the amount of work invested or the completeness of vision. If you have never worked on a committee to develop one of these, you may find it hard to appreciate what a painful journey it can be, with a lot of emotional drain thrown in for good measure. However, as painful as putting a framework together can be, it pales in comparison with trying to implement one.

We are now getting very close to being able to take our eyes off the non-functioning landing gear light and take full appreciation of our glide path. Does anyone think we just do not have enough frameworks? Does anyone think the frameworks we have are pitifully unequal to the task? Maybe we need more certifications. I could list all of those but it would add another 200 pages. Maybe we just do not have enough schools offering Cyber Security curricula. Could it be the “compliancy based” versus “risk based” security paradigm?

About the Author

Martin Zinaich is the information security officer for the City of Tampa’s Technology and Innovation department. The insights in this article were shared at a Wisegate member event, where senior IT professionals discussed these pressing security issues.

Featured

  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity

Webinars

New Products

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3

  • XS4 Original+

    XS4 Original+

    The SALTO XS4 Original+ design is based on the same proven housing and mechanical mechanisms of the XS4 Original. The XS4 Original+, however, is embedded with SALTO’s BLUEnet real-time functionality and SVN-Flex capability that enables SALTO stand-alone smart XS4 Original+ locks to update user credentials directly at the door. Compatible with the array of SALTO platform solutions including SALTO Space data-on-card, SALTO KS Keys as a Service cloud-based access solution, and SALTO’s JustIn Mobile technology for digital keys. The XS4 Original+ also includes RFID Mifare DESFire, Bluetooth LE and NFC technology functionality. 3

  • ResponderLink

    ResponderLink

    Shooter Detection Systems (SDS), an Alarm.com company and a global leader in gunshot detection solutions, has introduced ResponderLink, a groundbreaking new 911 notification service for gunshot events. ResponderLink completes the circle from detection to 911 notification to first responder awareness, giving law enforcement enhanced situational intelligence they urgently need to save lives. Integrating SDS’s proven gunshot detection system with Noonlight’s SendPolice platform, ResponderLink is the first solution to automatically deliver real-time gunshot detection data to 911 call centers and first responders. When shots are detected, the 911 dispatching center, also known as the Public Safety Answering Point or PSAP, is contacted based on the gunfire location, enabling faster initiation of life-saving emergency protocols. 3