Click here to close now.

Welcome!

Microservices Journal Authors: Carmen Gonzalez, Yeshim Deniz, Jayaram Krishnaswamy, XebiaLabs Blog, Roger Strukhoff

Related Topics: Security, Microservices Journal, Cloud Expo

Security: Article

Information Security from a Business Perspective

It must be designed and implemented as a core ingredient of the business strategy

As enterprises struggle to remain profitable in an ever-changing risk environment, the current economic crisis has elevated the need for effective business risk management. Information security is a key parameter that affects business risk. The academic definition of information security is the "preservation of confidentiality, integrity and availability of information." [1] Confidentiality is the preservation of secrecy of information (e.g., business reports, technical designs or financial projections) by ensuring that viewing is conducted solely by authorized people. Integrity is ensuring that information is accurate and consistent and has not been manipulated. Availability ensures that information is accessible to authorized people when needed.

Historically, information security has been addressed primarily as a technical issue. Preventive controls, such as firewalls, user access control mechanisms, encryption of data and communications, digital signatures, data backup systems, and detective controls, such as intrusion detection systems or security monitoring platforms, have formed the basic components of security architecture. Often, the technical controls are complemented by a set of security policies, procedures and guidelines aimed at controlling the actions of personnel.

This approach, though, has proven to be insufficient. Security incidents continue to rise and security problems remain unsolved while information security experts have been challenged to effectively communicate the value of information security to enterprise management. The root cause of these problems may be the definition of information security itself. There is a lack of consistency as each sector, industry and even enterprise has had to define information security uniquely, based on very specific business needs. This lack of consistency has contributed to a lack of understanding and a lack of appreciation for the value of information security.

Information Security Defined
To define information security in an organisation, one must understand its business objectives, identify stakeholders and link them to information protection attributes. Organisations have to be trusted to achieve customer acquisition and retention, which directly affect their revenue. This trust is a key success factor that is directly related to:

  • Business integrity-Each business decision is conducted as described in its official literature. It is fair to the customer and inspires trust. Information integrity (avoiding data manipulation) is a key information security component related to customer trust.
  • Customer asset protection-Customers need to be confident that their money, credit card numbers and bank account numbers are safe, especially in online transactions, where their funds are essentially electronic. Customers need to trust an organisation to secure their financial assets; confidentiality, integrity and availability are crucial security parameters.
  • Customer privacy-Customers provide their personally identifiable information (PII) to a whole host of ‘trusted' sources. As in customer asset protection, trust in the business is important for making them feel comfortable with sharing such information. Trust is particularly important when dealing with large amounts of money because customers have to feel safe and also that their personal data have been protected.

Providing services to the public also has societal and political facets. Businesses must adhere to a governmental regulatory and legal framework. The provision of secure and fair outlets to citizens is a matter of social responsibility. Moreover, the government is a shareholder of business (directly or indirectly through taxing); thus, business success affects the corresponding governmental revenue.

The aforementioned facts are clarified in relation to information security when the drivers of shareholders' trust are studied in more detail. For example:

  • Each licensed business has to comply with rules and terms of the license, which in turn have general or more detailed information protection requirements. These vary from general statements for fairness, antifraud rules and service availability requirements to more detailed technical controls such as network security rules, operating security policies or certification requirements. Shareholders need to be confident that a business complies with the license obligations and, more generally, the legal and regulatory framework, since this is a main corporate viability factor.
  • In competitive business environments, information security acts as a competitive advantage that, in turn, ensures customer acquisition. Shareholders trust a business if it operates as a competitive corporation, and due to the importance of protecting its information from breaches, information security becomes a competitive parameter.

In relation to the business role of information security, drivers should be:

-Shareholders' trust:

. Corporate viability, which is driven by compliance of license terms

. Competitive advantage, which ensures customer acquisition

. Brand name value preservation, which ensures customer retention

. Legal and regulatory compliance (e.g., the integrity of financial records and PII protection)

- Customers' trust:

. Business integrity

. Service availability

. Protection of the confidentiality of customers' sensitive information

Using this definition of information security for the business sector, a holistic approach is required for addressing the information security requirements of each unique organisation. This requires a detailed business analysis for embedding information security into the specific business processes and also for addressing the human factor and minimizing the uncertainty it introduces.  International security standards provide a solid base for information security from a business perspective.

THE INFORMATION SECURITY STANDARDS LANDSCAPE
In 2006, the Security and Risk Management Committee of the World Lottery Association (WLA)2 published the most recent version of its Security Control Standard (SCS). This standard describes a number of information security controls (technical and procedural) tailored to the lottery sector. Indicatively, it includes rules regarding the management of lottery draws and protection of prize money and Internet gaming systems.

The Security Control Standard (SCS) is an extension of the globally recognized information security standard ISO 27001 of the International Organization for Standardization (ISO), which is related to the establishment of information security management systems (ISMSs). Such systems provide the framework for managing information security from planning to implementation, monitoring and improvement.

ISACA has published a set of information technology (IT) auditing standards and the Risk IT:  Based on COBIT framework, which provides a set of guiding principles for effective management of IT risk. Risk IT complements COBIT, a comprehensive framework developed by ISACA for the governance and control of business-driven, IT-based solutions and services. In 2009, ISACA published An Introduction to the Business Model for Information Security, the first publication  released under the Business Model for Information Security (BMIS), which addresses information security from a business perspective, and in 2010, the full model was published as The Business Model for Information Security.

Other standards include the Payment Card Industry Data Security Standard (PCI DSS), a set of requirements for enhancing payment account data security, and the Special Publications (800 series) of the US National Institute of Standards and Technology (NIST), which are documents of general interest to the computer security community. The aforementioned standards provide an indicative view of the information security standards landscape. Other standardization bodies and associations provide their own guidelines in the field. In addition, technical security best practices of system vendors provide additional guidelines.

The modern business sector has to select the information security standards to use as a basis for its security architecture, and it must customize this selection according to its specific business needs.

 

Case Example from the World Lottery Association
In this particular example the ‘customer', so defined by the business model, is identified as the ‘player'. In this situation the definition of information security, specific to the lottery model, also becomes altered. ‘Business integrity' becomes ‘game integrity', ‘customer asset protection' becomes ‘player asset protection', and ‘customer privacy' is therefore ‘player privacy'. In terms of security the needs of a customer and player are much the same; however, due to the proactive nature of a ‘player', whose object is to win prizes rather than conduct typical transactions, the model of risk management must be appropriately tailored. Trust is again the key factor. When a member of the public makes the transition from ordinary citizen to ‘player' on a gaming site, it is vital to ensure that they are aware of the official rules of the specific game. Payouts and prizes, and the procedure for claiming them, must fully conform to the official literature set out by the gaming site. There should be no cases of ambiguity as this is a sure-fire way of discrediting a brand and losing player trust and thus, their custom.

To become an online participant in lotteries and other gaming sites an individual must disclose their sensitive details; this is very often the only means by which one can become a ‘player'. Being able to trust a lottery or gaming site with sensitive details should, therefore, be the foremost concern of a player as there is little point in worrying about payout procedure when compromised details could mean a bigger loss than any potential gain.

The WLA's Security Control Standard takes the above factors into consideration- perfectly illustrating how the security of data can be adapted to a unique business situation.

BASIC PROCESSES
Studying the information security standards horizontally, a number of basic processes/steps that lead to the identification of information security requirements are:

  • Step 1: Business impact analysis-Each business process is recorded and analyzed in terms of business impact from the realization of a possible security threat.

The business must answer a number of questions to calculate the impact of security breaches, including:

- How much would this cost the business in monetary terms?

- What would be the indirect costs (e.g., from reputation loss) if information is sold?

- What would the legal implications be?

Business processes are then prioritized based on an impact scale that identifies the most critical issues.

  • Step 2: Risk analysis-During this process, the possibility for the occurrence of a security incident is calculated, based on a database of security weaknesses. The risk analysis takes into account technical and procedural parameters, such as:

- Are there technical controls in place to safeguard customer data?

- Do procedures exist to complement the technical security controls?

  • Step 3: Risk management-The result of the risk analysis is a prioritization of risk in relation to the impact level (the result of the business impact analysis) and the identification of possible security measures for addressing the risk. The risk management process-the selection of appropriate security measures for addressing the risk or for risk transferring or acceptance-is determined by the management of the organisation.
  • Step 4: ISMS implementation-After the controls have been selected, they should be correlated under a common information security management system (ISMS). This correlation requires deep understanding of the operation of the organisation; consideration of human, cultural, technical, business and external factors; and continuous improvements.

Business Model for Information Security
One of the most recent information security frameworks that addresses information security from a business point of view is ISACA's BMIS.

The following definitions of the BMIS elements (derived from An Introduction to the Business Model for Information Security) are necessary for understanding how BMIS works:

  • Organization design and strategy-An organization is a network of people, assets and processes interacting with each other in defined roles and working toward a common goal.
  • People-The people element represents the human resources and the security issues that surround them. It defines who implements (through design) each part of the strategy. It represents a human collective and must take into account values, behaviors and biases.
  • Process-Process includes formal and informal mechanisms (large and small, simple and complex) to get things done.
  • Technology-The technology element is composed of all of the tools, applications and infrastructure that make processes more efficient.

To understand the operation of BMIS in practice, it is important to study the links connecting organization design and strategy, people, process, and technology.

CONCLUSION
Information security will be understood, provide added value and effectively contribute to the operation of an organization only if it is designed and implemented as a core ingredient of the business strategy. Stakeholder, shareholder and customer trust are the key ingredients of information security; organizations from all sectors should identify such key ingredients in order to provide a business definition to information security.

More Stories By Christos K. Dimitriadis

Christos K. Dimitriadis, Ph.D., CISA, CISM, is international vice president of ISACA and head of information security at INTRALOT S.A, a Greece-based multinational supplier of integrated gaming and transaction processing systems.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@MicroservicesExpo Stories
Public Cloud IaaS started it's life in the developer and startup communities and has grown rapidly to a $20B+ industry, but it still pales in comparison to how much is spent worldwide on IT: $3.6 trillion. In fact, there are 8.6 million data centers worldwide, the reality is many small and medium sized business have server closets and colocation footprints filled with servers and storage gear. While on-premise environment virtualization may have peaked at 75%, the Public Cloud has lagged in ado...
Dave will share his insights on how Internet of Things for Enterprises are transforming and making more productive and efficient operations and maintenance (O&M) procedures in the cleantech industry and beyond. Speaker Bio: Dave Landa is chief operating officer of Cybozu Corp (kintone US). Based in the San Francisco Bay Area, Dave has been on the forefront of the Cloud revolution driving strategic business development on the executive teams of multiple leading Software as a Services (SaaS) ap...
Microsoft is releasing in the near future Azure Service Fabric as a preview beta. Azure Service Fabric is built to run microservices - a complex application consisting of smaller, interlocked components that enables updating components without disrupting service. Microsoft has used this over the past few years internally for many of its own applications and the new release is for general use, a new product. OSIsoft is an early adopter of this system and run with it to expand into the explo...
ProfitBricks, the provider of painless cloud infrastructure IaaS, today released its SDK for Ruby, written against the company's new RESTful API. The new SDK joins ProfitBricks' previously announced support for the popular multi-cloud open-source Fog project. This new Ruby SDK, which exposes advanced functionality to take advantage of ProfitBricks' simplicity and productivity, aligns with ProfitBricks' mission to provide a painless way to automate infrastructure in the cloud. Ruby is a genera...
ProfitBricks, the provider of painless cloud infrastructure for IaaS, today announced the release of a Node.js SDK written against its recently launched REST API. This new JavaScript based library provides coverage for all existing ProfitBricks REST API functions. With additional libraries set to release this month, ProfitBricks continues to prove its dedication to the DevOps community and commitment to making cloud migrations and cloud management painless. Node.js is an open source, cross-pl...
ProfitBricks has launched its new DevOps Central and REST API, along with support for three multi-cloud libraries and a Python SDK. This, combined with its already existing SOAP API and its new RESTful API, moves ProfitBricks into a position to better serve the DevOps community and provide the ability to automate cloud infrastructure in a multi-cloud world. Following this momentum, ProfitBricks has also introduced several libraries that enable developers to use their favorite language to code ...
ProfitBricks, the provider of painless cloud infrastructure IaaS, announced the launch of its new DevOps Central and REST API, along with support for three multi-cloud libraries and a Python SDK. This, combined with its already existing SOAP API and its new RESTful API, moves ProfitBricks into a position to better serve the DevOps community and provide the ability to automate cloud infrastructure in a multi-cloud world. Following this momentum, ProfitBricks is also today introducing several l...
What exactly is a cognitive application? In her session at 16th Cloud Expo, Ashley Hathaway, Product Manager at IBM Watson, will look at the services being offered by the IBM Watson Developer Cloud and what that means for developers and Big Data. She'll explore how IBM Watson and its partnerships will continue to grow and help define what it means to be a cognitive service, as well as take a look at the offerings on Bluemix. She will also check out how Watson and the Alchemy API team up to off...
The 17th International Cloud Expo has announced that its Call for Papers is open. 17th International Cloud Expo, to be held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, brings together Cloud Computing, APM, APIs, Microservices, Security, Big Data, Internet of Things, DevOps and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding bu...
The 5th International DevOps Summit, co-located with 17th International Cloud Expo – being held November 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA – announces that its Call for Papers is open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the...
SYS-CON Events announced today the DevOps Foundation Certification Course, being held June ?, 2015, in conjunction with DevOps Summit and 16th Cloud Expo at the Javits Center in New York City, NY. This sixteen (16) hour course provides an introduction to DevOps – the cultural and professional movement that stresses communication, collaboration, integration and automation in order to improve the flow of work between software developers and IT operations professionals. Improved workflows will res...
So I guess we’ve officially entered a new era of lean and mean. I say this with the announcement of Ubuntu Snappy Core, “designed for lightweight cloud container hosts running Docker and for smart devices,” according to Canonical. “Snappy Ubuntu Core is the smallest Ubuntu available, designed for security and efficiency in devices or on the cloud.” This first version of Snappy Ubuntu Core features secure app containment and Docker 1.6 (1.5 in main release), is available on public clouds, ...
There is no quick way to learn Jython API but to experiment with it. The easiest way is to start with Jytutor extension for XL Deploy. Now you can also use the code snippet for exposing jython/python context in XL Deploy environment by running it directly in Jytutor Here’s how you can go ahead with that Download the Jytutor extension referring to the Jytutor Blog or from the following link https://github.com/xebialabs-community/xld-jytutor-plugin/releases Shutdown your XL Deploy server...
79% of new products miss their launch date. That was the conclusion of a CGT/Sopheon Survey in which the impact of such market misses were also explored. What it didn't dig into was the reason why so many products and projects miss their launch date. When we start digging into the details with respect to applications, we can find at least one causal factor in the delivery process, specifically that portion which focuses on the actual move into production, from which consumers (internal and...
Security is one the more prominent of the application service categories, likely due to its high profile impact. After all, if security fails, we all hear about it. The entire Internet. Forever. So when one conducts a survey on the state of application delivery (which is implemented using application services) you kinda have to include security. Which of course, we did.
The world's leading Cloud event, Cloud Expo has launched Microservices Journal on the SYS-CON.com portal, featuring over 19,000 original articles, news stories, features, and blog entries. DevOps Journal is focused on this critical enterprise IT topic in the world of cloud computing. Microservices Journal offers top articles, news stories, and blog posts from the world's well-known experts and guarantees better exposure for its authors than any other publication. Follow new article posts on T...
The concept and subsequent adoption of 'Containerization'' is growing at a rapid speed with the support of almost every other major player in the industry. This concept is much more efficient than the Virtualization which has been a major option for Infrastructure optimization in the past decade. The following factors distinguish a Container from a Virtual Machine. Containers contain Only the Application Specific libraries and binaries. They do not include a guest operating system. Rather ...
Chef and Canonical announced a partnership to integrate and distribute Chef with Ubuntu. Canonical is integrating the Chef automation platform with Canonical's Machine-As-A-Service (MAAS), enabling users to automate the provisioning, configuration and deployment of bare metal compute resources in the data center. Canonical is packaging Chef 12 server in upcoming distributions of its Ubuntu open source operating system and will provide commercial support for Chef within its user base.
In 2015, 4.9 billion connected "things" will be in use. By 2020, Gartner forecasts this amount to be 25 billion, a 410 percent increase in just five years. How will businesses handle this rapid growth of data? Hadoop will continue to improve its technology to meet business demands, by enabling businesses to access/analyze data in real time, when and where they need it. Cloudera's Chief Technologist, Eli Collins, will discuss how Big Data is keeping up with today's data demands and how in t...
Choosing between BIG-IP and LineRate isn't as difficult as it seems.... Our recent announcement of the availability of LineRate Point raised the same question over and over: isn't this just a software-version of BIG-IP? How do I know when to choose LineRate Point instead of BIG-IP VE (Virtual Edition)? Aren't they the same?? No, no they aren't. LineRate Point (and really Line Rate Precision, too) is more akin to an app proxy while BIG-IP VE remains, of course, an ADC (Application Delivery ...