Importance of Efficient Operations and Effective Governance in Cyber Security

Authored by: Manoj Kumar Shrivastava, Chief Information Security Officer, Future Generali India Insurance Company Limited.

Information security is hot potato in current era. Security controls and solutions are also undergoing through transformation. In the age of vibrant and quickly evolving security technology, businesses must protect sensitive information of their clients, employees, partners, internal operations and more. But with the growing sophistication of cybercriminals and hacking software, this protection has become an increasingly challenging task for everybody.

If we look into few of the cyber-attacks in past, it is evident that there were gaps in compliance of existing/ implemented control. The ransomware attack on 13^th May 2017 is one of the evident incident where Microsoft had released patch (MS17-010) for critical vulnerability. Wannacry attack took place because of the critical patch released in the month of March 2017 was not deployed for next two months. This strikes big question on patch management of the organizations’ and above that the governance and compliance too.

In addition of implementing new and complex security controls, I strongly believe in and insist for the following measures;

1. Effectiveness of controls – there must be a mechanism in place to measure effectiveness of implemented security controls on periodic basis, this should include Patch management dashboard, Network device firmware updates, User access review, Firewall and IPS rule base review, DB access logs review, antivirus compliance, SOC triggered offences, implementation of relevant advisories and many more. This also helps to comply with PDCA (Plan Do Check Act). On top of it, this should be reviewed by CISO/CIO on monthly basis or as and when required.
2. Efficient operations–it is an important area to ensure implementation of intends of organization. Efficient operations ensure deployment and subsequent improvement of controls. Minimum business disruption/downtime should be aimed to implement. E.g.  in case of patch deployment in critical server, approach should be tried first on UAT environment, then on DR. Before deploying patches on DC, services may be shifted to DR and then deployment has to happen in DC environment. It will give confidence before business owners and approach for deployment will have least downtime, smooth approvals. 
3. Effective governance – Again, needless to mention importance of efficient governance. It ensures 2^nd line of defense is functioning as intended. Collaborative approach, thorough discussion among stakeholders and proper management reports should be taken care under it. Proactive advises have to be put before stakeholders and management to ensure cyber security is aligned to business goals.

These all together helps us to have consolidated security posture of organization and also helps us to define priorities of security investment. These indicate areas to focus on. Historical trend analysis of security MIS helps to understand the achieved compliances were by chance or by effort. Micro management again helps to ensure identifying efforts to maintain consistency of compliance and a consistent improvement thereafter by proper planning in delivery. Peaks and valley in compliance of security controls, sometimes, become more vulnerable to organizations. Efficient operations and governance will only be effective.