Business Continuity Plan : Risk Management : Final Project
In
the world of information security, a constant flow of information takes place,
and so does the need to manage this information. Data can come from various
sources such as customer information, internal business, or even legal
documents and policies. This means for any business to succeed they need to
prepare for potential threats and mitigate risk as much as possible. By
successfully implementing a risk management plan, organizations can identify,
assess, and treat risks that could affect the confidentiality, integrity, and
availability of an organization's assets. In today’s writing, we will look at a
corporate call center to examine the effectiveness of having RMP in place.
Call
centers tend to fall into the category of a large organization, which means
it’s going to require a strict set of security policies in place. Due to larger
capacity, it’s likely the security requirements will be extremely diverse. Even
as they handle day-to-day security operations, such organizations' InfoSec
departments tend to develop and restructure internal teams to tackle long-term
problems (Whitman&
Mattord, 2018). Call Centers deal with
very sensitive customer data such as personally identifiable information
including social security numbers, bank financial records such as credit card
details, and the like. The top priority is keeping that data protected. This
means for each of these categories the organization will create a team
dedicated to handling each. There will be teams dedicated to ensuring proper
procedures and practices take place in handling customer information to
complete risk assessment. The same can be said for systems testing, incident
response teams, disaster recovery, and many more. Each of these will likely
have a dedicated group to manage risk within the organization. Before we begin
creating an RMP for use throughout the organizations we need to assess what
sort of risk exists.
Attackers
can vary from internal to external, as information provided by customers is
input into systems by employees. The first apparent risk is the employee
itself, trusting that they will follow procedure and properly input personally
identifiable information. Another risk to consider is user access, are IT teams
properly managing the access to customer data and ensuring that proper people
with proper permissions can access only what is needed for their role.
Furthermore, we identify another risk as each employee is responsible for
maintaining their login information such as username and password. They’re responsible
for making sure these credentials are secure and cannot be easily accessed by
any means.
Infosec teams
should be prepared to fend off the likes of unwanted phishers or fraudsters.
These are bad people who impersonate customers using stolen information to
commit malicious acts. This includes stealing customer PII, credit card
information, or attempting to hijack their services. Additionally, infosec
teams should be prepared to implement systems that prevent specific information
from being released in error that could put the company at risk for legal
action. For example, a fraudster may call into a call center and get an
employee to release the PII of a customer. If the customer were to be notified
and decide to take legal action, the organization would be responsible for the
legal proceedings. These are just a few
examples of common threats call centers face.
The
main purpose of this process is to identify relevant risks for future
assessment. The risk identification process often produces many risk scenarios
where some are more severe than others. The assessment team then subjects the
identified scenarios to a vetting process where the primary output is the risk
scenarios the assessment teams find realistic (Wangen, et al; 2018). In the
textbook, Management of information security, Whitman and Mattord explain, one
recommended approach is to separate the functions into four areas. Functions
performed by non-technology business units outside the IT area of management
control. Functions performed by IT groups outside the InfoSec area of
management control. Functions performed within the InfoSec department as a customer
service to the organization and its external partners. Lastly, we have
functions performed within the InfoSec department as a customer service to the
organization and its external partners. Below I’ve utilized the recommended
plan layout for a large organization. For a better understanding, I’ve left the
definition of each function as is and expanded on the responsibilities of IT
teams in the comments section to the right.
Functions Needed to Implement the InfoSec Program
|
Function |
Description |
Comments |
|
Risk assessment |
Identifies and evaluates the risk
present in IT initiatives and/or systems Example: Employee login credentials or Evaluation
of customer PII |
What’s at Risk? -
Customer information -
Billing information -
Internal
Documentation -
Employee information |
|
Risk management |
Implements or oversees the use of
controls to reduce risk |
Control examples include: -
Password requirements -
Masked customer
information until proper verification -
User Access Control /
Role-based Permissions |
|
Systems testing |
Evaluates patches used to close
software vulnerabilities and acceptance testing of new systems to assure
compliance with policy and effectiveness |
Information Breaches result in what’s
known as incident response. -
Review of current
systems to ensure their working properly, for example: By masking PII
information, IT teams should be aware whenever these types of securities or
on or offline. |
|
Policy |
Maintains and promotes InfoSec policy
across the organization |
This function must be coordinated with
organization-wide policy processes. -
IT teams can review
existing training materials and HR resources to ensure their policies are
aligned and up to date. |
|
Legal assessment |
Maintains awareness of planned and
actual laws and their impact, and coordinates with outside legal counsel and
law enforcement agencies |
This function is almost always external
to the InfoSec and IT departments. Senior leadership should be working with
Infosec teams to ensure all systems in place prevent an employee from legal
mishaps, and more importantly manage information in a way that prevents legal
risks to the company. |
|
Incident response |
Handles the initial response to
potential incidents, manages escalation of actual incidents, and coordinates
the earliest responses to incidents and disasters |
A procedure or service to identify the
data breach's root cause. A plan detailing how to securely lock down the
affected systems while preserving evidence. In the event this occurs, Infosec
teams will work to locate the impacted account, make a copy of its original
state, and then proceed to create a backup and identify the problem, once a
resolution is in place it can be tested and then rolled out to the live
environment account. This will allow IT, teams, to investigate the root cause
without pulling the employee from active work. |
|
Planning |
Researches, creates, maintains, and
promotes InfoSec plans; often takes a project management approach to planning
as contrasted with strategic planning for the whole organization |
This function must coordinate with
organization-wide policy processes. |
|
Measurement |
Uses existing control systems (and
perhaps specialized data collection systems) to measure all aspects of the
InfoSec environment |
Managers rely on timely and accurate
statistics to make informed decisions. In a call center, this can include
using information such as customer callbacks to identify risk. Example: A
fraudster will make multiple attempts to gather information from a customer
account. Infosec teams can spot an increase in contact rate or review memo’s
left behind from employees to identify risky behavior. |
|
Compliance |
Verifies that system and network
administrators repair identified vulnerabilities promptly and correctly |
Do employees have the proper legal
disclosure to ensure customers and employees are legally compliant. -
Is the software being
used within the organization legally compliant? -
Are the
changes/updates to systems keeping within compliance |
|
Centralized authentication |
Manages the granting and revocation of
network and system credentials for all members of the organization |
This function is often delegated to the
help desk or staffed in conjunction (and collocated) with the help desk
function. |
|
Systems security administration |
Administers the configuration of
computer systems, which are often organized into groups by the operating
system they run |
Many organizations may have originally
assigned some security functions to these groups outside of the InfoSec
function. This can be a source of conflict when organizations update their
InfoSec programs. |
|
Training |
Trains general staff in InfoSec topics,
IT staff in specialized technical controls, and internal InfoSec staff in
specialized areas of InfoSec, including both technical and managerial topics |
Some or all this function may be
carried out in conjunction with the corporate training department. |
|
Network security administration |
Administers configuration of computer
networks; often organized into groups by logical network area (i.e., WAN,
LAN, DMZ) or geographic location |
Many organizations may have originally
assigned some security functions to groups outside of the InfoSec function,
which may require close coordination or reassignment. |
|
Vulnerability assessment (VA) |
Locates exposure within information
assets so these vulnerabilities can be repaired before weaknesses are
exploited |
VA is sometimes performed by a
penetration testing team or ethical hacking unit. This function is often
outsourced to specialists hired as consultants that test systems control to
find weak spots. They are sometimes known as “red teams” or “tiger teams.” |
An
example structure for a large organization Infosec team could be: A Chief of
Information Security responsible for establishing and maintaining the
enterprise vision, strategy, and program to ensure information assets and
technologies are adequately protected. A technical security team fleeted by 1-2
full-time security managers. A Risk management and policy team headed by 3 to 4
security administrators and two separate teams for perimeter security and serve
protection each with 10-12 security administrators or technicians. The main
purpose of having a mixture of system admins and technicians is to have a team
that is responsible for the upkeep, configuration, and reliable operation of
computer systems, especially multi-user computers, such as servers. Again, this
is just an example model that would work effectively for a large call center
organization. According to NuHarbor
Security “From a sample of 250 companies in different industries, a general
rule is your security staff should be between 5-10% of your IT staff. The
actual percentage of security staffing is going to vary. Sometimes you'll be
closer to 5% when growing the IT team, and closer to 10% when staffing security
(2019).
In
order to effectively address the risk that’s been assessed and identified, we
want to create a business continuity plan that focuses on how to keep the
organization afloat during risk of threat scenarios. Above the writing I’ve created an example plan to address
the risks identified in a large organization call center
Overall,
we can see the importance of having a well-constructed risk management plan and
why it’s critical to assess risk. We establish a final analysis and then
determine what sort of risk can be tolerated within the business and then build
a framework that supports the organizational goals and mitigate risk whenever
present. With the additional use of a business continuity plan, we can evaluate
what type of action needs to be taken in the event of an incident or disaster
and deploy existing plans to maintain operations and reduce additional threats
to the business. In closing, a risk management plan helps ensure
confidentiality, integrity, and the availability of an organization's assets
can remain in place and should be considered a staple of every large
organization’s infosec strategy.
References
Cyber Security
Risk Management plans. SecurityRI. (2015, March 20). Retrieved January 17, 2022,
from https://www.securityri.com/cyber-security-risk-management-plans/
Information Security
Staffing Guide. NuHarbor Security. (2019, March 15). Retrieved February 8,
2022, from https://www.nuharborsecurity.com/information-security-staffing-guide
Wangen, G.,
Snekkenes, E., & Hallstensen, C. (2018). A framework for estimating
information security risk assessment method completeness. International Journal of Information Security, 17(6), 681–699.
https://doi.org/10.1007/s10207-017-0382-0
Whitman, M. E., & Mattord, H. J. (2018). Management
of information security (6th ed.). Cengage Learning.
Comments
Post a Comment