Downloaded 111 times
![ISM in the ILM (Information Lifecycle Security Management) Barry Caplin Chief Information Security Officer Minnesota Department of Human Services [email_address] May 18, 2006 10:00-11:00 a.m. Secure360](https://image.slidesharecdn.com/security-lifecycle-management-852/85/Security-Lifecycle-Management-1-320.jpg)
![ISM in the ILM (Information Lifecycle Security Management) Barry Caplin Chief Information Security Officer Minnesota Department of Human Services [email_address] May 18, 2006 10:00-11:00 a.m. Secure360](https://image.slidesharecdn.com/security-lifecycle-management-852/75/Security-Lifecycle-Management-1-2048.jpg)
Uploaded byBarry Caplin
Security Lifecycle Management
The document discusses information lifecycle security management (ILSM) and outlines the key steps in the process. It begins with an overview of the Minnesota Department of Human Services (DHS) and its mission to help citizens meet basic needs. It then describes the DHS enterprise security strategy and emphasizes building security into systems from the beginning. Finally, it details the ILSM process which incorporates security activities at each stage of the system development lifecycle from concept through disposal.
More Related Content
Similar to Security Lifecycle Management
Security Lifecycle Management
- 1. ISM in theILM (Information Lifecycle Security Management) Barry Caplin Chief Information Security Officer Minnesota Department of Human Services [email_address] May 18, 2006 10:00-11:00 a.m. Secure360
- 2.
- 3. Agenda DHS OverviewEnterprise Security Strategy Build Security In? Information Lifecycle Security Management
- 4. MN DHS Mission- helps people meet their basic needs so they can live in dignity and achieve their highest potential Consumers include: seniors who need help paying for hospital and nursing home bills or who need home-delivered meals families with children in a financial crisis parents who need child support enforcement or child care money people with physical or developmental disabilities who need assistance to live as independently as possible
- 5. MN DHS Directservice through: DHHS – Deaf and Hard of Hearing Services SOS – State Operated Services includes RTC’s – Regional Treatment Centers, including St. Peter, Moose Lake Forensics – St. Peter, Moose Lake, METO (MN Extended Treatment Options) State-run group homes New community-based treatment centers State-run nursing home – Ah-Gwah-Ching
- 6. MN DHS Administrations(Divisions): CFS – Children and Family Services – Child Support Enforcement, Endangerment, Social Services, Medical/Welfare Eligibility Chemical and Mental Health Services– including SOS Health Care Administration and Operations Continuing Care FMO – Finance and Management Operations – including Information Security, IT
- 7. MN DHS Programsare state-administered, county-delivered Including MinnesotaCare, Medical Assistance, General Assistance Medical Care, mental health services, alternative care services, chemical dependency services and regional treatment center services One of the largest state agencies 2500 CO, 5000 SOS distributed staff State and Federal funding
- 8.
- 9. Security Strategy -The 10000 Foot View Information Security Governance Framework (COBIT Security Baseline) People Organization Awareness Technology Operations Architecture Enterprise High-Level Functions Information Risk Management Information Policy Information Lifecycle Management Process
- 10. Security Strategy Governanceorganization operations architecture awareness people technology IRM Policy ILM Processes
- 11. Security Strategy 4C’s Confidence Credibility Communication Compliance Governance organization operations architecture awareness people technology IRM Policy ILM Processes
- 12.
- 13. Build Security InWhat do we mean by this? Everyone says it… but how? https://buildsecurityin.us-cert.gov/portal/
- 14.
- 15.
- 16. Cost – “measuretwice, cut once” Efficiency – build it “right” the first time Time – fixing problems later will likely delay production use Why Build Security In?
- 17. SDLC SEI-CMMI (formerlyCMM) ( http:// www.sei.cmu.edu/cmmi / ) IEEE and ISO 12207 standards ( http://www.acm.org/tsc/lifecycle.html ). Extreme Programming ( http://www.xprogramming.com/ , http://www.extremeprogramming.org/ ) On Wikipedia ( http:// en.wikipedia.org/wiki/Software_development_life_cycle )
- 18. Information Lifecycle Security Management
- 19. Information Lifecycle SecurityManagement
- 20. Operate Major ReleaseSoftware Development Lifecycle (SDLC) Maintenance Lifecycle Dispose Information Lifecycle Security Management Deploy Develop Design Analysis Concept
- 21. Operate Major ReleaseDeploy Develop Design Analysis Concept Information Lifecycle Security Management Preliminary Risk Analysis Business Impact Analysis Privacy and Security Requirements BCP/ COOP Privacy and Security Mitigation Plans Incident Response Plans Security Test Plans BCP/COOP Testing & Maintenance IT Audit Business Requirements Security Sign off Security Sign off
- 22. Business Requirements Astatement of the business problem or challenge the business area needs to solve Should not include recommended technical solutions Constraints/Assumptions Concept Business Requirements
- 23. Preliminary Risk AnalysisSecurity Questionnaire Preliminary Privacy Analysis Preliminary Security Risk Analysis Risk Briefing Concept Risk of not doing Preliminary Risk Analysis
- 24. Privacy and SecurityRequirements Preliminary Privacy Assessment Preliminary Security Risk Assessment Privacy Requirements Security Requirements Preliminary Design Requirements Analysis Words To Live By: “ Minimum Necessary” Privacy and Security Requirements
- 25. Business Impact AnalysisBusiness/System Impact Analysis Analysis Business Impact Analysis
- 26. Security Sign-Off Keys:Business Requirements received Requirements understood (by business area) Risks acknowledged Security Sign off
- 27. Privacy and SecurityRequirements Vendor Security Questionnaire Security Architecture Assessment Information Policy Analysis Risk Assessment (OCTAVE) HIPAA Assessment Detailed Design Requirements Project Security Roadmap & Required Doc List Design Privacy and Security Requirements
- 28. Detailed Security ArchitectureDesign Design Review Security Risk Mitigation Plans Action Plan for compliance design Design Privacy and Security Mitigation Plans Privacy and Security Mitigation Plans
- 29. Business Continuity/Disaster RecoveryBusiness Continuity Planning Disaster Recovery Planning Preliminary COOP (Continuity Of Operations Plan) Document Design BCP/ COOP
- 30. Security Test PlansTest Data Plans Security Testing Plan Security Testing Use/Abuse Cases Code Review Tools Vulnerability Assessment Develop Security Test Plans
- 31. Incident Response PlansIncident Response Plans Final COOP Develop Incident Response Plans
- 32. Security Sign-Off Keys:Identified issues mitigated Assessments completed Security Requirements met Documentation completed BCP/COOP completed Security Sign off
- 33. Deploy Change ManagementMonitoring Deploy
- 34. IT Audit SecurityPolicy Compliance Review (COBIT Audit Guideline) Operate IT Audit
- 35. BCP/COOP Testing &Maintenance Plan Testing Plan Updates & Review BIA Updates Operate BCP/COOP Testing & Maintenance
- 36. Major Release Whatis a Major Release? Significant new functionality Code rewrites Significant architecture or design changes Site Dependent May require any/all ILSM steps Major Release
- 37. Information Disposal Measuresbased on: Business type Data classification Regulatory issues: PHI FTI Others… Dispose
- 38. Operate Major ReleaseDeploy Develop Design Analysis Concept Information Lifecycle Security Management Preliminary Risk Analysis Business Impact Analysis Privacy and Security Requirements BCP/ COOP Privacy and Security Mitigation Plans Incident Response Plans Security Test Plans BCP/COOP Testing & Maintenance IT Audit Business Requirements Security Sign off Security Sign off
- 39. Final Thoughts SMTbuy in is critical Be consistent Advertise, advertise, advertise
- 40.