Is your organization’s information security program stuck in the era of perimeter firewalls and anti-virus software? Are you a Chief Information Security Officer or IT Manager stuck with the unenviable task of bringing your information security program into the 21st Century? Why not start the ball rolling with a business impact analysis (BIA)? It will provide you with a wealth of useful information, and it takes some of the weight from your shoulders by involving every business department in the organization.
BIA is traditionally seen as part of the business continuity process. It helps organizations recognize and prioritize which information, hardware and personnel assets are crucial to the business so that proper planning for contingency situations can be undertaken. This is very useful in and of itself, and is indeed crucial for proper business continuity and disaster recovery planning. But what other information security tasks can it help you with?
When MSI does a BIA, the first thing we do in issue a questionnaire to every business department and management function in the organization. These questionnaires are completed by the “power users” of the organization who are typically the most experienced and knowledgeable personnel in the business. This means that not only do you get the most reliable information possible, but that one person or one small group is not burdened with doing all of the information gathering. Typical responses include (but are not limited to):
- A list of every business function each department undertakes
- All of the hardware assets needed to perform each business function
- All of the software assets needed to perform each business function
- Inputs needed to perform each business function and where they come from
- Outputs of each business function and where they are sent
- Personnel needed to perform each business function
- Knowledge and skills needed to perform each business function
So how does this knowledge help jumpstart your information security program as a whole? First, in order to properly protect information assets, you must know what you have and how it moves. In the Top 20 Critical Controls for Effective Cyber Defense, the first control is an inventory of devices and the second control is an inventory of software. The BIA lists all of the hardware and software assets needed to perform each business function. So in effect you have your starting inventories. This not only tells you what you need, but is useful in exposing assets wasting time and effort on your network that are not necessary; if it’s not on the critical lists, you probably don’t need it.
In MSI’s own 80/20 Rule of Information Security, the first requirement is not only producing inventories of software and hardware assets, but mapping of data flows and trust relationships. The inputs and outputs listed by each business department include these data flows and trust relationships. All you have to do is compile them and put them into a graphical map. And I can tell you from experience; this is a great savings in time and effort. If you have ever tried to map data flows and trust relationships as a stand-alone task, you know what I mean!
Another security control a BIA can help you implement is network segmentation and enclaving. The MSI 80/20 Rule has network enclaving as their #6 control and the Top 20 controls include secure network engineering as their #19 control. The information from a good BIA makes it easy to see how assets are naturally grouped, and therefore the best places to segment the network.
How about egress filtering? Egress filtering is widely recognized as one of the most effect security controls in preventing large scale data loss, and the most effective type of egress filtering employs white listing. White listing is typically much harder to tune and implement than black listing, but is very much more effective. With the information a BIA provides you, it is much easier to construct a useful white list; you have what each department needs to perform each business function at your fingertips.
Then there is skill and security training. The BIA tells you what information users need to know to perform their jobs, so that helps you make sure that personnel are trained correctly and in enough depth to deal with contingency situations. Also, knowing where all your critical assets lie and how they move helps you make sure you provide the right people with the right kind of security training.
And there are other crucial information security mechanisms that a BIA can help you with. What about access control? Wouldn’t knowing the relative importance of assets and their nexus points help you structure AD more effectively? And there is physical security. Knowing where the most crucial information lies and what departments process it would help you set up internal secure areas, wouldn’t it? What other information useful to setting up an effective information security program can you think of that is included in a proper BIA?
Thanks to John Davis for writing this post.
