Finally,
let's take a few moments to look at the management of security operations.
It should be no shock that there are already standards out there from
the ISO world that we will pursue to define what security operations
should look like and how to measure success.
Then,
we will take a moment to log into the AWS Management Console to check out
what monitoring looks like from a cloud perspective.
And finally,
we'll close out the discussion with establishing a
plan for our digital forensics.
The security operation centers standard as specified in ISO/IEC 18788,
noted as the Management System for Private Security Operations,
defines a number of elements for successful operations.
The first is to make sure that you have developed requirements for the
guidance on what your security operations center should be designed for
based upon your organization's risk management process.
What is it that is part of the risk appetite to participate in
and what are things that you're absolutely avoiding that do not
meet up to a risk tolerance level?
You should also be thinking about what the design should be for
facilities that are in spaces that may have additional concerns
beyond your monitoring of security operations.
You need to be able to assess and manage the impact of
problems brought onto the facility and the impact of issues
that it is that you are monitoring.
There needs to be tight integration of what the local law
says as far as your specter of responsibility for the area
that you're operating in,
and we need to make sure that there is some alignment between what's being
monitored and what matches the organizational mission.
A way to make sure that you are growing in your
capability would be to use the PDCA model.
In the four‑step process, it begins with planning,
and it's a cycle also known as the Deming Cycle.
Once you have a plan of what the operation center should
be and the behavior associated with it,
you should carry out a plan in the form of some kind of action.
So there should have been something that predicted the outcome,
but you also are now verifying what the outcome is.
Finally,
you go into an act that is the reconciliation of what you planned and
what you did and whatever discrepancies are addressed so that you can
continually iterate in modifying the plan,
updating the plan,
improving the plan so that your actions in that center are
conforming to your business requirements.
When looking at the security operations management system,
management commitment is always going to be an extremely important part of
any capability that you have within your organization.
Understanding what human rights, not only for your employees,
but for those who are nearby that facility,
understanding that you should have continuous improvement as a way of going
about implementing your security operations management system,
and that management should have defined also what the
available resources are to maintain it.
When it comes to the planning portion,
this means that you would engage in a risk assessment,
both qualitative,
thinking about what the impact would be for lost
services and quantitative as well,
thinking of what the financial loss could be for things that are destroyed,
altered, or otherwise disclosed.
What legal requirements you have to meet based upon the area that you're in.
It is good to remember that you need to follow the laws that you are closest to.
What may serve as policy in one area of the world,
may actually be illegal in another space.
Make sure that you have set up objectives that you want to achieve
within a particular timeframe and that you have measurable ways of
seeing if you are off on meeting those.
Strategic programs that are external to your security operations
management system could be your deployment capabilities,
your release capabilities, your continuous integration,
and continuous delivery capabilities.
Risk management strategies also means taking a step back from the
assessment and seeing what the purpose is of the assessment.
What objective does it meet from a business perspective?
The implementation and the operation of it includes the operational
controls that will be inside of that facility,
resources and roles in a delineation between responsibilities
and the authorities in the organization,
making certain that people have good training and awareness and communication.
Documentation tends to be something that is underutilized,
underrepresented in an organization,
verifying that you have proper documentation and runbooks on when
there are failures inside of these systems.
And then also making sure that prevention is an equal
part of your risk assessment process.
Understanding how well you're doing means that you have to have
continuous monitoring and measuring of your objectives.
So key performance indicators are typically rearview mirror,
something has to have taken place.
But key risk indicators can be predictive of the future as you see
how far off you might be on average based upon a goal that you have
that has yet to be met in the future.
Compliance evaluation is also part of the performance
monitoring to make sure that you are complying with laws and
regulations. That also should be measured,
along with testing to see that the controls are actually effective and
something that takes place if those controls are shown to be ineffective to
correct it and create additional preventive measures.
The nonconformities for corrective measures that come out of testing
would also be exposed by means of internal audits.
The management of the security operations management system would include
effectiveness of the adequate controls that are there,
need for changes for controls that do not work well,
and having this idea of never being satisfied with where you are is essential.
Next, let's take a look at monitoring of the security controls.