Table of Contents

---
section-titles: false
---

# Table of Contents

<!--toc:start-->
- [Table of Contents](#table-of-contents)
- [3. Governance and security strategy](#3-governance-and-security-strategy)
  - [3.1. Governing security](#31-governing-security)
    - [3.1.1. Basics of Information Security Governance](#311-basics-of-information-security-governance)
  - [3.2. Managing information risk](#32-managing-information-risk)
    - [3.2.1. Definitions](#321-definitions)
    - [3.2.2. Management Principles](#322-management-principles)
  - [3.3. Know the risks to control them](#33-know-the-risks-to-control-them)
  - [3.4. Strategic vision of security](#34-strategic-vision-of-security)
    - [3.4.1. Fundamentals](#341-fundamentals)
    - [3.4.2. Security mission](#342-security-mission)
    - [3.4.3. Success conditions](#343-success-conditions)
    - [3.4.4. Pragmatic approach](#344-pragmatic-approach)
    - [3.4.5. Benefits](#345-benefits)
  - [3.5. Define a security policy](#35-define-a-security-policy)
    - [3.5.1. Compromise and common sense](#351-compromise-and-common-sense)
    - [3.5.2. Responsibility](#352-responsibility)
  - [3.6. Organize and lead](#36-organize-and-lead)
    - [3.6.1. Structural organization](#361-structural-organization)
    - [3.6.2. Actors and skills](#362-actors-and-skills)
  - [3.7. Taking legal needs into account](#37-taking-legal-needs-into-account)
    - [3.7.1. Security and suppression of computer crime](#371-security-and-suppression-of-computer-crime)
    - [3.7.2. Offences, responsibilities and obligations of means](#372-offences-responsibilities-and-obligations-of-means)
<!--toc:end-->

# 3. Governance and security strategy

## 3.1. Governing security

Effective cybersecurity requires proper governance, which refers to the framework of rules, processes, and decision-rights that ensure information security is managed effectively within an organization.

### 3.1.1. Basics of Information Security Governance

- **Alignment with Business Goals:** Security strategies should align with the organization's overall business objectives. Striking a balance between security and operational efficiency is crucial.
- **Roles and Responsibilities:** Clearly define roles and responsibilities for security across all levels of the organization. This ensures everyone understands their part in maintaining a secure environment.
- **Accountability:** Establish clear lines of accountability for security performance. Senior management should demonstrate a commitment to cybersecurity.
- **Compliance with Regulations:** Ensure compliance with relevant industry regulations and data privacy laws.

By implementing a robust information security governance framework, organizations can establish a clear direction for their security efforts and ensure everyone is working towards the same goals.

## 3.2. Managing information risk

Information risk refers to the potential for harm to an organization's information assets due to a security incident. Effective information security management involves identifying, assessing, and mitigating these risks.

### 3.2.1. Definitions

- **Threat:** A potential cause of a security incident, such as a malicious actor, software vulnerability, or natural disaster.
- **Vulnerability:** A weakness in a system, network, or process that can be exploited by a threat.
- **Impact:** The potential consequences of a security incident, such as financial loss, reputational damage, or data loss.
- **Risk:** The combination of the likelihood of a threat exploiting a vulnerability and the resulting impact.

### 3.2.2. Management Principles

- **Risk Assessment:** Identify and assess the information security risks faced by the organization. This involves considering the threats, vulnerabilities, and potential impacts.
- **Risk Treatment:** Develop strategies to mitigate identified risks. This might involve implementing security controls, reducing vulnerabilities, or transferring risk through insurance.
- **Risk Acceptance:** Some risks might be unavoidable or too expensive to mitigate completely. Organizations need to decide which risks they are willing to accept and develop appropriate monitoring and response plans.
- **Risk Communication:** Communicate information security risks and mitigation strategies to all relevant stakeholders within the organization.

## 3.3. Know the risks to control them

Understanding the risks an organization faces is the cornerstone of effective security management. By identifying and analyzing potential threats and vulnerabilities, organizations can prioritize their security efforts and allocate resources strategically.

**Risk Identification Techniques:** Several techniques can be used to identify information security risks. These include:

- **Threat modeling:** Identifying potential threats and how they might exploit vulnerabilities in systems or processes.
- **Vulnerability assessments:** Regularly scanning systems and networks to identify weaknesses that could be exploited by attackers.
- **Security audits:** A comprehensive review of an organization's security posture to identify gaps and areas for improvement.
- **Industry best practices:** Learning from security incidents experienced by other organizations in the same industry.

## 3.4. Strategic vision of security

A well-defined security vision sets the overall direction for an organization's security strategy. It should be aligned with the organization's business goals and risk tolerance.

### 3.4.1. Fundamentals

- The security vision should be clear, concise, and easy to understand for all employees.
- It should reflect the organization's risk tolerance and priorities.
- It should be reviewed and updated periodically to reflect changes in the threat landscape and business environment.

### 3.4.2. Security mission

- A security mission statement translates the security vision into a more actionable statement.
- It outlines the specific objectives and goals for achieving the desired security posture.

### 3.4.3. Success conditions

- Define clear metrics to measure the success of the security strategy. These metrics should be measurable, achievable, relevant, and time-bound.
- Examples of success conditions might include reducing the number of security incidents, improving employee security awareness, or achieving compliance with industry regulations.

### 3.4.4. Pragmatic approach

- The security strategy needs to be practical and achievable considering the organization's resources and budget.
- Focusing on high-impact risks and implementing controls that provide the most significant security benefit is crucial.

### 3.4.5. Benefits

A clear security vision and strategy can lead to several benefits, including:

- Reduced risk of security incidents
- Improved compliance with regulations
- Enhanced brand reputation
- Increased employee confidence in the organization's security posture

## 3.5. Define a security policy

A security policy is a formal document that outlines the organization's security requirements and expectations for employees. It serves as a guide for how to handle sensitive information, use IT resources securely, and identify and report suspicious activity.

### 3.5.1. Compromise and common sense

- Security policies should strike a balance between security and usability.
- Overly complex or restrictive policies might lead to employees circumventing them.

### 3.5.2. Responsibility

- The security policy should clearly define the responsibilities of employees at all levels for information security.
- This includes responsibilities for using passwords securely, reporting suspicious activity, and handling sensitive information.

## 3.6. Organize and lead

- **Building a Security Team:** Effective security requires a dedicated team with the skills and expertise to manage information security risks. This team might consist of internal security professionals or outsourced security services.
- **Leadership Commitment:** Senior management plays a crucial role in fostering a culture of security within the organization.

  - Demonstrating a commitment to security by allocating adequate resources and actively participating in security initiatives is essential.

- **Security Awareness and Training:**

  - Regular security awareness training programs can significantly improve employee behavior and reduce the risk of human error-related security incidents.
  - Training should cover topics like password security, phishing scams, social engineering, and best practices for protecting sensitive information.

### 3.6.1. Structural organization

A well-structured security organization ensures clear ownership, accountability, and efficient execution of security strategies.

- **Centralized Security Team:** A dedicated team with specialists in areas like vulnerability management, incident response, and security awareness training. This team sets security direction and oversees implementation across the organization.
- **Decentralized Security Integration:** Integrate security considerations into existing departmental structures. Appoint security champions or officers within departments to raise awareness, implement local security policies, and report security concerns to the central team.
- **Hybrid Approach:** A combination of centralized and decentralized models. The central team provides direction and guidance, while departmental security champions handle day-to-day security tasks within their specific areas.

### 3.6.2. Actors and skills

The effectiveness of your security organization depends on having the right people with the necessary skills.

- **Security Analysts:** Identify and analyze security vulnerabilities, conduct penetration testing, and monitor security systems. Skills: Network security, vulnerability assessment, incident response.
- **Security Engineers:** Design, implement, and manage security controls like firewalls, intrusion detection systems, and encryption. Skills: Network security, system administration, security architecture.
- **Security Awareness Trainers:** Develop and deliver security awareness training programs to educate employees on security best practices. Skills: Adult learning principles, communication, information security.
- **Security Compliance Officers:** Ensure compliance with relevant security regulations and standards. Skills: Regulatory knowledge, auditing, risk management.

## 3.7. Taking legal needs into account

Integrating legal considerations into your security strategy is crucial for staying compliant with relevant laws and regulations.

### 3.7.1. Security and suppression of computer crime

- Implement controls to prevent and detect computer crimes like hacking, data breaches, and malware attacks.
- Develop incident response procedures that comply with legal requirements for reporting and preserving evidence.
- Laws like the Computer Fraud and Abuse Act (CFAA) in the US or the General Data Protection Regulation (GDPR) in the EU may have specific reporting and investigation mandates.

### 3.7.2. Offences, responsibilities and obligations of means

- Define acceptable use policies for IT resources to deter misuse and hold employees accountable.
- Ensure data privacy regulations, such as GDPR, are considered when collecting, storing, and processing personal data.
- Understanding relevant laws regarding data privacy, acceptable use, and computer crime helps establish a secure and legally compliant environment.