Posts RSS
Subscribe via Email
Auditors, Frameworks, and Philosophy
Posted August 4th, 2010 by rybolov
Now I’ve been reasonably impressed with GovInfoSecurity.com and Eric Chabrow’s articles but this one supporting 20 CSC doesn’t make sense to me. On one hand, you don’t have to treat your auditor’s word as gospel but on the other hand if we feed them what to say then suddenly it has merit?
Or is it just that all the security management frameworks suck and auditors remind us of that on a daily basis. =)
However, it seems that there are 3 ways that people approach frameworks:
- From the Top–starting at the organization mission and working down the stack through policy, procedures, and then technology. This is the approach taken by holistic frameworks like the NIST Risk Management Framework and ISO 27001/27002. I think that if we start solely from this angle, then we end up with a massive case of analysis paralysis and policy created in a vacuum that is about as effective as it might sound.
- From the Bottom–starting with technology, then building procedures and policy where you need to. This is the approach of the 20 Critical Security Controls. When we start with this, we go all crazy buying bling and in 6 months it all implodes because it’s just not sustainable–you have no way to justify additional money or staff to operate the gear.
- And Then There’s Reality–what I really need is both approaches at the same time and I need it done a year ago. *sigh*
Similar Posts:
Posted in FISMA, Rants | 
3 Comments »
Tags: 20csc • auditor • catalogofcontrols • fisma • government • infosec • management • security
August 4th, 2010 at 3:35 pm
[…] This post was mentioned on Twitter by novainfosec, alex knorr. alex knorr said: Auditors, Frameworks, and Philosophy: Now I’ve been reasonably impressed with GovInfoSecurity.com and Eric Chabrow… http://bit.ly/bqB7AR […]
August 5th, 2010 at 3:34 pm
I don’t know if I totally understand the way you’ve classified the 20 CSC as “from the bottom.”
Actually, I think the central issue I’m having is with the juxtaposition you’ve set up in general. It’s apples and oranges, isn’t it? Things like the RMF are frameworks for addressing security considerations. Things like the CSC (of which I count NIST 800-53 among them) are just limited security control sets. These two concepts augment each other (one of the first steps in the RMF is control tailoring afterall, and CSC could very well be considered a sort of tailoring), but they do not (nor can they) supplant each other.
Or am I just way off here?
<3 this blog, btw. Keep up the good work!
August 10th, 2010 at 2:00 am
Top heavy squashes everything below before it gets a chance to live; bottom heavy never gets off the ground.
But most of the time I see it as a corporate maturity problem, rather than approach problem. Immature companies get that “oh sh!t” feeling and [b]something must be done[/b] right then right there. Rather that take an approach commensurate with their ability to embrace and enable changes they go for the end-goal in one shot and die mid-way.
Mature organisations know how much they can take on in one go and what is a priority and what isn’t. They get mature by surviving continuous trial and error. 😉
Now if only there was a way to tell lucky companies from mature companies.