Information Security Governance

Information security governance (ISG) is the system by which an organization's security activities are directed, controlled, and held accountable. It answers the question: "Who decides what security measures we implement, and how do we ensure they are effective?" Governance is not the same as management. Governance is about setting direction, establishing policies, and monitoring compliance. Management is about executing those policies day-to-day. On the SY0-701 exam, you will see questions that test your ability to distinguish between governance (board-level, strategic) and management (operational, tactical).

The governance process typically follows a top-down flow:

Each layer provides more detail and enforceability. Governance ensures that these documents are created, reviewed, and updated regularly. It also ensures that compliance is measured through audits and metrics.

Common frameworks that support governance include: - ISO/IEC 27001: International standard for information security management systems (ISMS). Focuses on the process, not specific controls. - NIST SP 800-53: U.S. federal standard with a catalog of security controls. - COBIT: Framework for IT governance and management, often used for audit and compliance. - ITIL: Focuses on IT service management, including security.

Poor governance creates gaps that attackers exploit. For example:

Attackers often target governance gaps by: - Social engineering to bypass policy (e.g., calling IT support to reset a password). - Exploiting lack of baseline (e.g., finding a server that doesn't follow the baseline and is unpatched). - Abusing guideline vs. standard confusion (e.g., a guideline says "consider encryption," but the attacker finds unencrypted data because it wasn't mandatory).

Defenders use governance to create a structured defense: - Policy creation: Draft policies that are approved by legal and senior management. - Training and awareness: Ensure all employees understand policies. - Compliance monitoring: Use tools like SIEM to detect violations (e.g., a user accessing sensitive data from a non-compliant device). - Auditing: Internal or external audits verify that controls are in place and effective. - Metrics: Key performance indicators (KPIs) like percentage of systems patched within 30 days.

While governance is not about specific commands, tools like Group Policy in Windows enforce baselines:

# Example: Apply a security baseline using Group Policy
# This is not a command but a concept: GPO can enforce password policy, audit settings, etc.
# To check effective policy: gpresult /h report.html

For compliance scanning:

# OpenSCAP can scan a system against a baseline (e.g., DISA STIG)
oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig --results results.xml /usr/share/xml/scap/ssg/content/ssg-rhel7-ds.xml

In cloud environments, AWS Config rules can enforce policies:

{
  "ConfigRuleName": "encrypted-volumes",
  "Source": {
    "Owner": "AWS",
    "SourceIdentifier": "ENCRYPTED_VOLUMES"
  }
}

These tools automate governance by checking compliance and reporting violations.

A hospital implements a governance framework to comply with HIPAA. The board sets risk appetite: zero tolerance for PHI exposure. The CISO drafts an Information Security Policy that mandates encryption of all PHI at rest and in transit. The standard specifies AES-256 for data at rest and TLS 1.2 for data in transit. Procedures detail how to encrypt emails containing PHI. The IT team uses a DLP tool to monitor for unencrypted PHI. One day, the DLP alerts that an employee emailed a spreadsheet with PHI without encryption. The incident triggers a policy violation review. The correct response: the employee receives retraining, and the incident is documented. Common mistake: blaming the employee without checking if the policy was communicated. The analyst should verify that the policy and procedure were accessible and that the employee had been trained.

A financial firm uses a governance framework based on SOX and PCI DSS. The internal audit team scans all systems against a baseline (e.g., CIS Level 1). They find that 10% of servers have weak cipher suites enabled (e.g., RC4). The audit report is presented to the board. The CISO is tasked with remediating within 30 days. The correct response: the security team creates a procedure to disable weak ciphers via Group Policy and patches the servers. Common mistake: ignoring the report because the servers are not internet-facing. The baseline applies to all systems. The governance framework requires compliance regardless of exposure.

After a ransomware attack, a company discovers that no policy existed for offline backups. The governance failure allowed critical systems to be unrecoverable. The board then mandates a Backup Policy with a standard requiring daily encrypted backups stored offsite. The procedure specifies using Veeam to backup to AWS S3 with versioning. The correct response: implement the policy and test restoration quarterly. Common mistake: assuming backups existed because IT had a 'best effort' guideline. Without a mandatory standard, enforcement is weak.