Chief Information Security Officer as a Service
Whether you are a company seeking
to augment your current Information Security function, or you are looking to
build an Information Security organization from scratch, the Contract Chief
Information Security Officer (CISO) is an option that provides the necessary
expertise and structure. Designed to
supplement current information security activities, provide security
leadership, and implement architectural structure, the CISO arrives with a full
set of tools to perform the task, without the commitment of creating a
full-time position. In fact, the
position of CISO can be satisfied by a part-time contract subject matter
expert, backed by a team of specialists, to provide a comprehensive security
program.
Compliance
One of the immediate needs of any
organization is to validate their compliance with identified rules, regulations
and practices mandated by their specific industry or regulatory
organization. The contract CISO can
provide policy and standards services that are customized to the requirements
of the organization. Ranging from
acceptable use to information classification, every organization needs to have
its information security policy in place.
Business Continuity
Years in business teaches us that
the unexpected is going to happen. The
contract CISO can Initiate, Coordinate, Document and Test the whole scope of
Business Continuity from Continuity of Operations to Disaster Recovery. These essential processes are often
overlooked, but left unconsidered, they can have a devastating impact on your organization. The service provides subject matter experts
at every phase of the Business continuity process to enable smooth, documented,
and practiced transition in difficult situations.
Security Education
Most people will do the right
thing, once they know what the right thing is.
The Contract CISO can provide information security education services,
by live or online instruction. Both
general security training, and industry specific education is available through
the CISO team. Annual security training,
event specific training, and specialized information handling training is
available.
Security Analysis
In information technology, what you
don’t know can hurt you! The contract
CISO can design, implement and analyze vulnerability testing, as well as regular
scanning and monitoring. This can be
carried forward into risk analysis, penetration testing, phishing scans, and
other tests; both internal and external.
The CISO can then make use of this information to recommend
infrastructure, process, training, or policy changes.
Audit Response
Depending on industry and
regulatory environment, audit findings are an inevitable part of doing
business. The CISO can craft responses
to auditors, establish plans of action and milestones (POAM,) and develop mitigation
plans to satisfy findings. Audit
pre-work is used to prevent “finding surprises” and minimize the impacts of
findings on the organization.
Business Processes and Architecture
Information that is well managed is
easier to secure. The extensive experience
of the contract CISO and the team of experts can provide assistance in Change
and Problem Management, Design Review and, Software Standards. Other business functions can be included with
appropriate expertise availability.
Processes for equipment issuance and inventory, software control, and
privilege management are within scope of service. These can be applied in both the tactical and
in the strategic planning phases.
Executive Training
In time, many organizations will
benefit from their own CISO and local Information Security Officers. The contract CISO team will train permanent
staff to satisfy the requirements of the organization for Information Security.
General “Traditional” Information Security
The team approach to the contract
CISO provides opportunities for the evaluation, implementation and operation of
tradition security controls, including:
·
Firewalls
·
Host security software
·
Identity Management
·
Network segmentation
·
Anti-virus
·
Defense in Depth implementations
·
IDS/IPS
This is just a brief list of the
tools that can be brought to bear by the CISO.
Process of Acquisition
Every organization has unique
needs, but common practices include the establishment of a policy base,
training and analysis. The presence of
an experienced and certified CISO helps to speed and improve the implementation
of a security program. To this end, the
CISO service can be purchased by the hour (minimum 40 hours,) or for up to 5
years. Work can be performed on-site, or
remotely, depending on the organizations needs and culture.
This purchasing model enables a
business to purchase as much or as little CISO time as they need, from as
little as 4 hours a week, to full time.
