Zachtgroen 172718 GM Zoetermeerinfo@unifiedvision.nlwww.unifiedvision.nlT +31 (0)79 3604268

Lean Security 2

Doing the right things, the right way!

Version 0.3 - 12th June, 2012

INTRODUCTION .................................................................................................................................................... 3 ABOUT THIS DOCUMENT.....................................................................................................................................................3COPYRIGHT......................................................................................................................................................................3ABOUT THE AUTHOR..........................................................................................................................................................3INTENDED AUDIENCE..........................................................................................................................................................3THE NEED FOR SPEED.........................................................................................................................................................4

THE BASICS ............................................................................................................................................................ 5 LEAN PRINCIPLES...............................................................................................................................................................5SIX SIGMA PRINCIPLES........................................................................................................................................................5LEAN SIX SIGMA PRINCIPLES................................................................................................................................................6SECURITY MANAGEMENT PRINCIPLES.....................................................................................................................................6SECURITY OPERATIONS PRINCIPLES........................................................................................................................................6

LEAN SECURITY MANAGEMENT SYSTEM .................................................................................................. 7 LEAN SECURITY MANAGEMENT DEFINITIONS...........................................................................................................................7ESTABLISHING A LEAN SECURITY MANAGEMENT SYSTEM...........................................................................................................9INITIATE AND EXECUTE THE PLAN PHASE.................................................................................................................................9INITIATE AND EXECUTE THE DO PHASE...................................................................................................................................9INITIATE AND EXECUTE THE CHECK PHASE...............................................................................................................................9INITIATE AND EXECUTE THE ACT PHASE...................................................................................................................................9INITIATE AND EXECUTE THE MANAGEMENT REVIEW..................................................................................................................9

SECURITY OPERATIONS .................................................................................................................................. 10 ALWAYS BE PREPARED FOR MISHAPS...................................................................................................................................10SIX SIGMA IN SECURITY CONTROL DESIGN............................................................................................................................10FROM “A TICK IN THE BOX” TO “OPERATIONAL EXCELLENCE”.....................................................................................................10EFFECTIVE SECURITY BASED ON MEASUREMENTS....................................................................................................................10PROACTIVE MANAGEMENT OF SECURITY CONTROLS.................................................................................................................10

Lean Security 3

IntroductionAbout this documentThis document aims to point out benefits from applying business process improvement techniques “Lean” and “Six Sigma” to Security Management and Security Operations, in order to make Security more efficient and effective, to increase the contribution of security to business objectives and to facilitate a better alignment of the business and security.

CopyrightThis whitepaper is exempt from the general Unified Vision copyright and made freely available, yet attributable to Lean Security @ Unified Vision under a Creative Commons Attribution-ShareAlike 3.0 Unported License.

About the authorJohan Bakker has a background of over 20 years in IT and Security & Continuity, a master's degree in Information and Knowledge Technology and is a CISSP and ISSAP certified security professional. Johan started in IT in the late eighties and worked his way through operations, programming, design, project management and architecture and from 1999 onwards performed R&D of middleware, agent technology and service platforms at KPN Research. In 2001 Johan discovered the Information Security discipline and has been hooked on this challenging topic ever since. From early 2008 until late 2011 Johan was Chief Information Security Officer of Royal Dutch Telecom (KPN), being responsible for the Security and Continuity policy, its governance and compliance reporting to the board of directors. Johan left KPN early 2012 to start up his own company, Unified Vision, which, together with a number of partners and associates, provides ad interim and project management, consultancy, advice, training and coaching services to organizations that are making the step from an ad-hoc approach to a controlled embedding of Security and Continuity in their business processes.

Intended audienceThe intended audience for this document are security executives, managers and officers that are looking at ways to improve the effectiveness of what is it that they do, whilst putting less strain on the organization they do it in and increase their contribution to the organization’s business objectives. The other way around, the document is as well intended for Lean Six Sigma belts and champions that are aiming to apply their business process improvement skills to security. This document therefore explains the very basics of both worlds in short, with the risk of shortcomings on either end, but with the intention to bring together experts from two worlds that combined can achieve great benefits for their organizations.

Lean Security 4

The need for speedSome Security organizations still have a hard time getting the business (and sometimes even IT) on board and create buy-in for what it is that they do. Instead of explaining security to the business once more, we’ve tried that approach, the time has come to reflect on ourselves; what we do, why we do it, how we do it and how we communicate about it with the rest of the organization.

Doing business is all about taking risk; an amount of business capital is deliberately put at risk in a business endeavor aiming to make a profit. Without business risk, there will not be a profit and the money may as well safely reside in a bank account. We security people claim we support the business by helping them to manage the information risk they run as part of their business. But do we always? Or are we sometimes obstructing business by being naturally more risk averse than the business we aim to support? Are we not sometimes trying to convince the business that information risk is “bad risk” that must be mitigated? Do we understand risk the way the business understands risk and can we accept well enough that the business accepts certain risk as a part of doing business?

Apart from the communication, perception and buy-in challenge, the work we do is not always as effective as we would like it to be. Despite the amount of time we spend on governance, policy, risk assessments, steering committees, compliance reporting, audits, i.e. the stuff that we do a lot, practice shows this alone doesn’t provide solid guarantees that all the servers were timely patched with the latest fixes, the applications were developed securely, the web portals are all up to standard, proper and industry-standard crypto has been applied, security has been properly tested, etc, etc, i.e. the stuff that really matters!

High profile incidents in the media from the recent past show that, despite all good intentions and a lot of hard work, security is not always providing a proper return of investment. In the end it all comes down to details and getting all the details right, all the time, every time, were an attacker only needs to get it right once and is usually a step ahead of us. This requires operational excellence based on sound procedures, measurements and facts, not just a tick in the box for compliance reasons.

So, what if we found a way to really make security contribute to the business objectives of the organization? What if the business owners would perceive us as a business partner? What if we deployed effective security measures and were able to proof it, making the money spent on security worthwhile?

This document explores such an approach and aims to help you achieve all this.

Lean Security 5

The basicsThis chapter aims to merely introduce the various related disciplines and heavily draws on definitions and descriptions for these given in Wikipedia. In each section the relevant link to the full Wikipedia article is provided as well for further reading.

Lean principlesLean is a practice that considers the expenditure of resources for any goal other than the creation of value for the end customer to be wasteful, and thus a target for elimination. Lean distinguishes the following types of waste; defects, overproduction, transportation, waiting, inventory, motion and over-processing. Working from the perspective of the customer who consumes a product or service, "value" is defined as any action or process that a customer would be willing to pay for. The main steps and goals in applying Lean are:

– Define “value” from the “customer” perspective, in terms of both what the customer wants and when

– Determine what steps in the process or “value stream” add such “value” and remove or avoid all others that are “waste”

– Base production on customer “pull”, i.e. produce only on request and prevent inventory

– Create “flow” and eliminate delays by aligning the process steps

– Continually and incrementally “improve” the process

In order to apply Lean to Security Management, we need to come up with a meaningful use of minimally the terms customer, value and waste in the context of security. These are provided in the first section of the Lean Security Management chapter.

For further reading is referred to http://en.wikipedia.org/wiki/Lean_manufacturing

Six Sigma principlesSix Sigma is a practice that seeks to improve the quality of process outputs by identifying and removing the causes of defects (errors) and minimizing variability in both manufacturing and business processes. It uses a set of quality management methods, including statistical methods, and creates a special infrastructure of people within the organization ("Black Belts", "Green Belts", etc.) who are experts in these methods. The term Six Sigma originated from terminology associated with statistical modeling. Six Sigma applies the “DMAIC” project methodology that has five distinct phases:

– Define the problem, the voice of the customer, and the project goals, specifically

– Measure key aspects of the current process and collect relevant data

– Analyze the data to investigate, verify cause-and-effect relationships and seek out root cause of the defect under investigation

– Improve or optimize the current process based upon data analysis using various defined techniques

– Control the future state process to ensure that any deviations from target are corrected before they result in defects

Six Sigma is investigated in this document in the Lean Security Operations chapter for use of its fact-based approach and statistical modeling, in order to improve the effectiveness of security controls and allow for early detection and pro-active corrective action in the case of deviating or defective security controls.

Lean Security 6

For further reading is referred to http://en.wikipedia.org/wiki/Six_sigma

Lean Six Sigma principlesLean Six Sigma is a synergized approach of both the Lean and Six Sigma practice. Lean Six Sigma utilizes phases similar to that of Six Sigma and comprises both the Lean's waste elimination approach as well as the Six Sigma fact-based, statistical approach.

For further reading is referred to http://en.wikipedia.org/wiki/Lean_Six_Sigma

Security management principlesThe governing principle behind Information Security Management, or just Security Management as this document refers to it, is that an organization should design, implement and maintain a coherent set of policies, processes and systems to manage risks to its information assets, thus ensuring acceptable levels of information security risk. The Security Management System central to these activities is a process that consists of the following activities, of which the PDCA part are the cyclic core:

– Establish - determine goal, policy and scope of the Security Management System and implement the cyclic PDCA process

• Plan - Determine risks to the information assets in scope and decide on the management of these risks

• Do - Implement the planned risk mitigation measures, i.e. the security controls

• Check - Evaluate the design, existence and effectiveness of security controls

• Act - Correct any evaluation findings

– Review – Periodically perform a Management Review of the Security Management System as a whole

A Security Management System should aim for a set of efficient, measureable, user friendly and effective security controls that, as a cohesive system, adequately manage the risk of breaching the confidentiality, integrity and availability of information assets.

For further reading is referred to http://en.wikipedia.org/wiki/Information_security_management_system

Security operations principlesConscious of the fact that the term Security Operations may be used differently in other contexts, for the purpose of this document Security Operations is defined as the use and operation of security controls that were implemented in the organization as a result or outcome of the Security Management System. Security controls may be of preventive, detective or corrective nature, each entailing different operational characteristics.

Lean Security 7

Lean Security Management SystemLean Security Management definitionsIn order to apply Lean principles to security management, we need to define what we believe a Lean Security Management System should be and what the Lean terms “customer”, “value” and “waste” mean in the context of security.

Proposed definition of a Lean Security Management System

Who is the “Customer” of Security?

The customers of security are, depending on the nature of the organization and the products or services it provides, typically not the commercial customer of the organization directly, but more often the business owners and the employees of the organization that in turn provide products and/or services to the commercial customer. Therefore, it is up the business owner to translate commercial customer requirements into security requirements, as much as it is up to Security Management to understand the security needs of the business for being commercially successful and achieve its business objectives. This situation is depicted in the figure hereunder:

Figure 1 – the customer of security

The business owner may have to comply with certain security related legislation or regulation as well. If a regulator is looking after compliance, this regulator may be considered an indirect “customer” of security as well, since the regulatory requirements will also influence the business requirements for security.

“A Lean Security Management system is an agile, integrated, effective and efficient process that, based on various contextual inputs and a solid understanding of assets, threats & vulnerabilities and existing controls, results in adequately managed security risk by means of necessary, adequate, usable, efficient and measurable security controls, that are contributing to achieving business objectives.”

Lean Security 8

What is “Value” of Security Management?

In Lean Security Management “Value” has a variable part, depending on specific needs and expectations of the organization, the commercial customers and regulators, as well as a more generic part valid for every organization. In our opinion a Security Management System provides optimal value to the organization if it:

actively supports achieving the business and compliance objectives of the organization (the variable part) is an efficient, agile and integrated process, capable of dealing with a dynamic threat environment consumes minimal time and resources results in adequately managed security risk, in line with the risk appetite of the organization provides only the necessary, yet adequate, user friendly, efficient and measurable security controls

What is “Waste” in Security Management?

In the table hereunder, seven types of “waste” are proposed that should be removed or avoided when implementing Lean Security Management. The types of waste presented here were modeled along the lines of Lean, Lean IT and Lean Services and altered and amended to fit Security Management. For each of the types of waste various arbitrary examples are provided for clarification purposes, as well as the negative outcome for the business if they are not avoided or removed.

Type of Waste Some examples Business Outcome

Overproduction Unnecessary security controls due to lacking risk appetite, blame culture or mindless following of standards. Over collection of system logs.

Unnecessary high cost and waste of resources

Defects Unmonitored or poorly configured controls,Inadequate paper controls to survive audits,Too low a threshold in the deviation process

False sense of confidence under high costs

Unclear communication Reports that are not read or are not fit for purpose, Poor security control requirements,Misunderstood or misinterpreted KPI's

Miscommunication leading to unnecessary high cost and waste of resources

Non-value added processing Elaborate theoretical risk assessment models,Inefficient or duplicate audit & reporting processes,Lacking proper tooling leading to manual labor

Unnecessary high cost and overhead

Employee knowledge (unused) Policy misaligned with operational reality,Control design neglects operational knowledge,Employees spend time on inadequate controls

Increased cost and overhead, increased level of risk, talent leaving the company

Waiting Lacking agility of the control framework, long cycles, Long throughput times for authorizations,Inefficient process for on/off-boarding of staff

Reduced flexibility, reduced productivity, unnecessary high cost, increased level of risk due to circumventions

Inaccuracy Over-, underestimating risk resulting ininadequate or expensive controls,Applying wrong or inappropriate standards

Unnecessary high cost and/or overhead, false sense of confidence

Lean Security 9

Establishing a Lean Security Management SystemInitiate and execute the Plan phaseInitiate and execute the Do phaseInitiate and execute the Check phaseInitiate and execute the Act phaseInitiate and execute the Management review

Lean Security 10

Security operationsAlways be prepared for mishapsSix Sigma in Security Control designFrom “a tick in the box” to “operational excellence”Effective Security based on MeasurementsProactive management of Security controls