" A NEW APPROACH TO TEACHING, A NEW STYLE, A NEW EFFORT "

CHAPTER 9
DRAFTING OF IS SECURITY POLICY, AUDIT POLICY

STORY

There was a bank named ISSP(Information system security policy – chapter link). The present auditors of the bank were not good and they didnt even know what is IS Audit . 
The ISPs adopted by the present auditors were not proper. The bank officials planned to appoint new auditor The new auditor was super star Abhishek Bachan. The Branch Manager ranged up Ahishek.  The manager explanied to Ahishek the ISSUES IN ISP & said there are so many SENSITIVE INFORMATION. 
Abhishek went to meet Br. Manager the very next day in his brand new car & Abhishek explained the PURPOSE & SCOPE OF IS AUDIT... The manager nodded his head with curiosity and said hmmm hmmm tell me more Mr. Abhishek. Abhishek Continued with confidence and showed the CONTENTS OF HIS PREVIOUS AUDIT REPORT(though unethical)explaining  4 RULES & TYPES OF PROTECTION required for IP. 
With the consent of Br. Manager , Abhishek framed SECURITY OBJECTIVES & appointed new MANAGEMENT OF ISP & formed a beautiful HIERARCHY.

Abhishek shaked his hands with newly elected members and explained various TYPES OF ISP & AUDIT WP's & DOCUMENTATION to be maintained.

At last, after overcoming all these hurdles Abhishek convinced manager the POINTS TO BE CO NSIDERED FOR IP & COMPONENTS of IS. 
After hearing all these... tears came from the eyes of Br. Manager and gave a BIG HUG to BACHAN and said what an idea SIR JI  :)

QUESTION 1   ISSUES IN INFORMATION SECURITY POLICY

The information security policy of an organisation has been defined and documented as given below - 
"Our organisation is committed to ensure IS through established goals and principles, Responsibilities of implementing every aspect of specific applicable proprietary and general principles standards and compliance requirements have been defined. This is reviewed af least once a year for continued suitablility wrt cost and technologies "

ANSWER
The security policy is a set of LRP (not MRP) Law , Rules and Practices that regulate how assets including Sensitive Information are MPD(Managed, Protectede and distrubuted) within the organisation.
ISP address various issues such as AID ( Availabilty, Disclosure and Integrity), who may access what information and in what manner, basis on which decision is made, who controls and who owns information

Issues to Address :-
ISP clearly states the committment of senior management to IS and ISP address the following issues - 
•	Definition of Information Security
•	Definition of all relevant information security responsibilities
•	Why IS is important to the Organisation
•	Brief explanation of security PPS ( Policies, Principles and Standards)
•	Reference to supporting documentation

ROLE OF AUDITOR
•	Ensure that the policy is readily accessible to all employees
•	Ensure that all employees are aware of its existence and understand its contents
•	Ensure the IS policy has an owner who is reponsible for its maintenance
•	Ensure the ISP is updated as per changing risk scenerio

QUESTION 2   SENSITIVE INFORMATION  

What information is Sensitive??

ANSWER - Page 9.3 in Module

MANTRA TO REMEMBER - BSF(Border Security Force) information are always SENSITIVE INFORMATION

B - Business Operations  - Business operation consists of an organizations process and procedures, most of which are deemed to be proprietary. As such, they provide a market advantage to the organization. This is the case when one company can provide a service profitably at a lower price than the competition.

S -Strategic Plans - Most organizations readily acknowledge that strategic plans are crucial to the success of a company. But most of the companies fail to really make an effort to protect these plans. Eg : A competitor learns that a company is testing a new product line in a specific geogrtaphic locatgion. The competitor removes its product from that location, creating an illusionary demand for the product. When the positive results of the marketing test are provided to the companys executives, they decide to roll the product out nationwide. Only then did the company discover that in  all other geographic regions the competition for their prodcut was intense. The result : the company lost several million, dollars as its prodcut sales faltered.

F - Finances - Financial information, such as salaries and wages are very sensitive and should not be made public. While general salary ranges are known within industry sectors, precise salary information can provide a competitive edge. When a competitor knows specific information about a companys wages, the competitor may be able to price its products accordingly. When competitors costs are lower, they can either under price the market or increase profits. In either case, the damage to an organization my be significant.

QUESTION 3    PURPOSE AND SCOPE OF AUDIT

Describe the role of Informatino systems audit policy in ensuring information security with respect to -
1) Purpose of IS Audit
2) Scope of IS Audit

ANSWER

PURPOSE OF IS AUDIT

Purpose of IS Audit is to provide guidelines to the audit team wrt to audit of IT based infrastructure system. IS Audit is conduted to protect the entire system from threat and to ensure ICA ( Integrity, Confidentiality and Availabily)

Purpose of conducting IS Audit is for the following reasons

MANTRA TO REMEMBER – Purpose for conducting IS Audit - Maitain System Compliance ----- MS3C

•	M - Maintain Data Integrity
•	S - System efficency is to be ensured
•	S - System effectiveness is to be maintained 
•	S - Information System Assets/ Resourses is to be safeguarded. 
•	C - Comply with organisational policies

SCOPE OF IS AUDIT

•	To assess the effectiveness of Internal Control in system and quality of performance by the Information System
•	IS Audit provides a reasonable assurance that the business objective have achieved

SCOPE OF IS AUDIT INCLUDES -

MANTRA TO REMEMBER - DRAFT of IS Audit explains the scope of IS AUDIT

•	D - Data Security Control
•	R - Reliable people (or) organisation structure control
•	A - Application Systems Control
•	F - Facilities Control
•	T - Technology Control

ITEMS to be EXAMINED in IS Audit inclues :-

MANTRA TO REMEMBER - PRIME SUBject for examination of items COMPLIANCE

•	P - Performance of suppliers are to be monitored
•	R - Risk Asst. & Risk Mgmt. Process
•	I - Impact of external influences
•	M - Monitoring performance of SLA(service level agreements)
•	E - Examining mission statement, goals & obectives

•	S - Strategic plans of IT has to be examined
•	U - Usage & protection polices of IT has to be examined
•	B - Budgets of IT & variations has to be examined

•	C - Compliance with legal requirements

QUESTION - 4     CONTENTS OF AUDIT REPORT

State and briefly explain the contents of a standard IS Audit Report

ANSWER

•	COVER & TITLE PAGE - A/R should use a standard cover with a window showing the title "IS Audit (or) Data Audit". The title page may also indicate the names of audit team.
•	TABLES OF CONTENTS - Lists of sub sections & page numbers
•	EXECUTIVE SUMMARY - Concise representation of major audit finding should not normally exceed 3 pages
•	INTRODUCTION -  CM's Private Secretary(Context, Methodology, Purpose, Scope)
•	FINDINGS - Core part of A/R
•	OPINION - Express an Audit opinion
•	APPENDICES - It can be used for better understanding the report

Cover & Title Page undaavum, Cover-te akathu kure contents undavum,  contents-te summary undaavum... contents-te introducation.... FINDINGS-um athinte kurichulla Opinion-um last is A ie, Appendices

QUESTION - 5   RULES

What are the 4 rules that should be analysed before applying various types of protection?

ANSWER

RULE # 1 ----- Oraganisation should know ----- What the information is & where it is located

RULE # 2------ Organisation whould know------- Value of information & difficulty in RECREATING if it is lost

RULE # 3-------Organisation should know------- Who is AUTHORISED TO ACCESS the info. & what they are permitted to do with the info.

RULE # 4------- Organisation should know------Time taken to RECOVER the info. once it is lost

QUESTION - 6   TYPES OF PROTECTION

Explain the basic types of Information Protection that an organisation can use in information system

ANSWER

MANTRA TO REMEMBER - PRotection

1)     P - PREVENTATIVE INFORMATION PROTECTION -- PIP is related to the use of security control ( see for explanation)

There are 3 types of controls in PIP 
 
MANTRA TO REMEMBER - LAP

•	L - Logical Controls -- deals with password, power protection system, file permission, etc ...
•	A - Admistrative controls --- Security awareness & policies
•	P - Physical Controls --- Deals with Doors, Locks, guards, floppy, disk access locks, CCTV, Fire suppression system etc...

2)    R - RESTORATIVE INFORMATION PROTECTION

 Organisation will suffer loss if the org. fails to revover critical information system within a acceptable time. The key requirement of RIP is to recover information within limited time. Programs to backup datas cannot be reliable, it has so many problems

The RIP program must address the following
•	Whether recovery process evaluated & tested recently
•	Time taken for restoration
•	time needed to input data changes since last backup
•	Quantum of loss
•	Strict adherence of plan

QUESTION - 7   SECURITY OBJECTIVES 

Explain security objective and mention the universally accepted attributes of security objective

ANSWER

The objective of IS Security is the protection of interest of those relying on information & the IS from harm resulting from failure of ICA(Integrity, Confidentiality & Availability)

For any org. security objectives comprises of 3 universally accepted Attributes(characteristics) :-   

MANTRA TO REMEMBER - ICA
•	I - Integrity -- Preventionn of unauthorised modification
•	C - Confidentiality -- Prevention of unauthorised disclosure
•	A - Availability -- Prevention of unauthorised withholding of information

QUESTION - 8   MANAGEMENT OF ISP  (not important)

Describe various groups of management, comprised by security policy

ANSWER

Security policy broadly comprises of the following 3 groups of management

1) Management membres WHO HAVE budget & policy authority 
2) Technical group WHO KNOWS what can & what cannot be supported
3) Legal Ex
QUESTION -  9  HIERARCHY (****IMP****)

What is the Hierarchy of Information Security Policy
ANSWER

                      I                  INFORMATION SECURITY POLICY	I
I                  
	U		C
USER SP                    Organisation SP      o          CONDITION OF CONNECTION
U
	o  	I
USER SP  ACCEPTABLE USAGE SP	  ORGANISAITONAL INFO SP     INFO CLASSIFICATION POLICY
                                                Network &syst SP

MEMORISE IT AS .. LEFT – I  U  U( I you You ) …. MIDDLE – I O O … RIGHT – I C I ( I see I )
Acceptable usage and network are exceptions
 
QUESTION - 10   TYPES OF ISP (****IMP****) 

Discuss various types of Information security policies

ANSWER

Security means protection of valuable assets against loss, disclosure ( or) damage

Securing valuable Assets can be of 2 types

Physical safeguards                                                Logical (or) technical safeguards
suchas lock, Doors, insurance, 
floppy disc, Access locks                                     Identifiers, passwords, firewalls etc

NOT UNDERSTOOD VERYWELL                         ARE WELL UNDERSTOOD & IMPLEMENTED   
	BY ORGANISATION

Various types of ISP's are :_ see the chart in question 9 for easy understanding

•	INFORMATION SECURITY POLICY -- provides definition of information security, its overall objective and the importance applies to all users
•	USER SECURITY POLICY -- This policy sets out the reponsibilities and requirements for all IT system users. It provides security terms of reference for users, Line Managers and System Owners.
•	ACCEPTABLE USAGE POLICY -- This sets out the policy for acceptable use of email and internet services.
•	ORGANISATIONAL INFORMATION SECURITY POLICY - sets out the Group policy for the security of its information assets and the Information Technology systems
•	NETWORK & SYSTEM SECURITY POLICY --  This policy sets out detailed policy for system and network security and applies to IT department users
•	INFORMATION CLASSIFICATION POLICY -- This policy sets out the policy for the classification of information
•	CONDITIONS OF CONNECTION - sets out goup policy for Connecting to their network. it applies to all organisations connecting to the Group.

QUESTION - 11  AUDIT WP's & DOCUMENTATION

You have been asked to conduct an IS Audit for a bank (i) How will you develop a documented audit program?? (ii) What kind of WP's and documentation you will prepare?

ANSWER

MANTRA TO REMEMBER - ISP2 – O 

•	I - Identification of technical Aspects
•	S - Scope, nature & degree of testing required to achieve audit objectives
•	P - Procedures for collecting, analysing , interpreting audit evidence
•	P- Procedures for audit will be prepared prior to commencement of Audit work and midified during the course of Audit, if necessary.

•	O - Objectives of an Audit

AUDIT WORKING PAPERS AND DOCUMENTATION

AUDIT WORKING PAPERS

Audit working papers should -
•	Record the Audit Plan
•	NTE of Audit procedures performed
•	Conclusions drawn from audit evidence

The form & content of WP's are affected by matters such as - MANTRA TO REMEMBER - NNNF
•	Nature of engagement
•	Nature  & complexity of clients business &
•	Nature & condition of clients records 
•	Form of A/R

In Recurring audit , WP's are classified into PAF ( Permanent Audit File) and CAF(Current Audit File) -- [ u my write about recurring audit if need, not necessary]

PERMANENT AUDIT FILE - PAF is updated currently with information of continuing importance to succeeding audits

MANTRA TO REMEMBER - Sir, may i know where is PAF??? Dear Article, PAF is in my CABIN

PAF includes -
•	C - Copies of A/R & Observations of earlier years
•	A - Auditors study of Internal Control
•	B - Background of the IT in the org.
•	I - IS policies
•	N - Number of COPIES OF MGMT LETTERS ISSUED BY AUDITOR

CURRENT AUDIT FILE

Current Audit File contains information relating to a single audit
MANTRA TO REMEMBER - Dear article, you may please take PAF but after that please CLEAN the CAF its full of dust

CAF includes

•	C - Copies of notes discussed with client on IC
•	L - Letter of representation & confirmation
•	E - Evidence of Audit plan & program
•	A - A record of NTE of Audit procedures
•	N - Number of CONCLUSIONS REACHED BY THE AUDITOR

Working Papers are the property of the auditor . WP's should be properly secured and retained for a period of time to meet legal requirements

DOCUMENTATION INVOLVES 4 STEPS

MANTRA TO REMEMBER -  GOLF

•	G - Gathering Information
•	O - Organising information
•	L- Legibly WRITING THE DOCUMENTATION RULES
•	F - Fanalising Documents

QUESTION - 12  POINTS TO BE CONSIDERED FOR INFORMATION PROTECTION

What are the points to be considered for information protection?

ANSWER

BSF are the various types of sensitive information every business holds. Protecting this information is crucial to the overall success or failure of a company. Businesses hold such a vast array of data, what steps do they need to take to keep all of their critical information proteted?

These points may be considered :-

MANTRA TO REMEMBER - VK - DRP - Value to data - KNOW the data resides - DEVELP access - REVIEW output - PROTECT information

•	V - Value of all data are not same - Organisations must determine the value of the different types of information in their environment before they can plan for the appropriate levels of protection
•	K -KNOW where the critical data resides - In thodays business environment, this is normally the companys information systems infrastructure. Because each piece of information may require different levels of protection, identigyin where each is located enables an organizhation to establish an integrated security solution. This approach also provides significant cost benefits, as the compnay does not  need to spend more on protecting data than the data itself is worth. Protection solutions must be based on the most valuable information assets.
•	D - DEVELOP an access control methodology - Information does not have to be removed to cause damage or to have financial impact. Information that is inadvertently damaged disclosed or copied without the knowledge of the owner may render the data useless. To guard against this, organisations must establish some type of access control methodology.
•	R - REVIEW harcopy output - The hardcopy output of employees daily work should also be reviewed. Although strategic plans in their final forms may be adequately protected, what measures are used to safeguard all drafts and working papers? what information is regularly placed in the recycle or trash contrainers without thought to  its value?
•	P - PROTECT information stored on media - Employees can cause considerable damage by walking out the door with information on floppy disks/ CD - ROMS. In addition, companies should control magnetic media to reduce the loss of softwares. And finally, when migrating from one platform to another, the status of all hard drives and the associated data, should be controlled

QUESTION - 13  COMPONENTS 

What are the components of the Security Policy???

ANSWER

MANTRA TO REMEMBER - Aiswarya Rai is the new ASP for security policy and do you know she is IPS holder. Abhishek had a party with Br.Mgr in a bar and was having liquor. Aiswarya came to know about this. As a result of this, she ordered to close all the BARs in the city as a measure of Security Policy in her family.(NB : Abhishek and Aiswarya are the main characters in this chapter)

KEY WORDS... "A"  "SP" "IPS" "BAR" or ASP is  IPS holder , she closed all BARs

•	A - Asset classification & security classification
•	S - Security organisational structure(SOS)
•	P - Purpose & Scope - of the document & intented audience
•	I - Incident handling
•	P - Physical & environmental Security
•	S - System Development & Maintenance Control
•	B - Business Continuity mgmt
•	A - Access Control
•	R - Responsibility Allocation

A - Asset classification & security classification

MANTRA - DAM - DAM .. oh my God DAM is going to break... run run runnnn... Abhishek is screaming ...call for security... Aiswaria our assets are goinG to get demolished  DAM DAM run runnn :(

•	D - Data exchange b/w oranganisations must be controlled
•	A - Access to data classified as CONFIDENTIAL should be RESTRICTED
•	M - Maintain inventory of assets

•	D - Data classification should be carried out as per direction of the owner
•	A - Appropriate procedure for info.handling must be put in to practice
•	M - Media must be disposed off appropriately

S - Security  organisational Structure ( NOT IMPORTANT)

MANTRA - there was leakage in the dam.. Organisation structure was bad. SFI made a procession and loads of GIRLS pariticipated in that procession. It was proved that bribe was PAID  to constructors for evading cash

SFI - GIRLS - PAID

S -  System owners - Overall responsibility for infor security
F - Facilitates Management Security Officer ( FMSO) - all security matters relating to facilities
I -  INformation security forum(ISF) - to ensure clear direction and visible mgmt. support

G -Group security officer
I - IT management
R - Responsible IT security officer
L - Line managers - compliance with aims and objectives of this policy
S - System security officer

P - Personnel security officer (PSO) - all security matters relating to personnel
A - Asst. Group security officer - across the group
I - Installation security officer - all security matters relating to system
D - Divisional system security officer - business aspects of security

P - Purpose & Scope - Primary objective of policy is ICA ( Integrity, COnfidentiality and Availabiliy)

I - Incident Handling

•	It ensures that incidents are recorded & recurrence is analysed to identify weakness
•	Procedures for collection of evidence relating to security incidents should be standardised
•	All staff must be made aware of the process

P - Physical & environmental security

MANTRA - The news about the leakage spread across the nation in a great PACE - E. Leaders said environmental security should be given importance.

P - Physical security should be maintained across the organisation & IT infrasturcture
A - Access to specified areas must be limited to authorised staff only
C - Confidential and valuable info. must be securely locked when not in use
E - EIS ( Equipment, info. (or) S/W) must not be taken offsite without proper authorisation
E - Environmental controls should be in place.

S - System Development & Maintenance Control

B - Business Continuity Management

A - Access Control

MANTRA - PAUSE  MAP. 

•	P - Passwords must be kept confidential & never disclosed to others
•	A - Access rights must be deleted for individuals who leave org.
•	U - Unattended PC should automatically locked
•	S - System owners should maintain the records of person who has access to a particular system
•	E - Each user will be provided with a unique ID

•	M - Mobile Computing - while using mobile computing facilities, it should be ensured that business info is not compromised
•	A - Access must be granted only in reponse to a business requirement
•	P - Prevent unauthorised access to IS

if required write this also... Another person user ID must not be used for access

R - Responsibility Allocation

MANTRA - TRACE the responsibility of SON  . He is weak in responsibility allocation   OR ... STONE - CAR

•	T - Tasks have been completed successfully 
•	R - Risk asst. for all 3rd party access to info. assets must be carried out
•	A - Access by 3rd party to IT infrastructure must be controlled
•	C - COntract of Org's should be maintainted
•	E -Entire ourtsourcing contracts must be detailed

•	S - Staff should be aware of the need of IS and about  their responsibilities
•	O - Owner would be appointed for each info. asset
•	N - New network communication links must be approved