Yo Delmar's GRC and Beyond Blog

Risk Framework: Five Easy Steps (yes, you can try this at work)

Last post, we went into what a Risk Ontology is, why we need one and what it contains. In this post, we look at Five Easy (some may say not so easy…) steps to get started. Remember that core to GRC is adopting a coordinated, coherent approach to risk management across the organization, built on a common risk ontology. And, at the core of a risk ontology, is a risk framework.   

Quick review: Risk Frameworks provide risk management programs with better:

• Coordination - Provide a basis for coordinating risk across  many activities in the organization

• Consistency - Since all activities across the organization involve risk, a Risk Framework can be consistently applied to an entire organization, at its many functions, projects and activities

• Visibility – While no single definition of risk exists, adoption of consistent concepts within a comprehensive framework can help the organization improve visibility into the true risk profile

• Governance – Risk Frameworks can help the organization establish governance and manage risk more effectively, efficiently and coherently both internally and externally with 3rd parties

• Flexibility – A Risk Framework, probably designed, can support variations of approaches, definition of threats and risk criteria across internal organization functions, partners and customers

• GRC Technology Platform Value – Risk Frameworks are essential for driving value out of GRC technology platforms and enabling tools; they are only as good as the underlying frameworks, processes and procedures that define their use.

What’s in a Risk Framework?

Here is main things you want to get defined in a risk framework - this is a subset of the GRC Ontology; the core or ‘engine’ of risk management.

1)       Risk hierarchy; which includes Class and Type
2)       Mitigating Controls (and procedures)
3)       Risk Scores, and
4)       Metrics. 

Risks Scores (inherent and residual) will come as a by-product of assessments and can change.  

What are the key steps to follow in building a Risk Framework?

The diagram below shows five easy :-) steps to follow in building a risk framework. Step 1 is pre-work – you need to get a skeleton defined of risk classes and types, and gather as much as you can from stakeholders. The holes in the hierarchy should become apparent during step 1.  In steps 2-4, work with key stakeholders to further develop the hierarchy, and associate risks with policies and mitigating controls, risk scores and metrics if you can. At the end of the process you should have a reasonably good ‘tree’ and eliminated overlapping or redundant risk and controls. Top tier risks, those with High ratings, will surface to the top of the hierarchy. You can use those to recalibrate metrics to ensure you are focusing on the right things. Active risks in the framework become part of your organization’s risk register.  Most all GRC technology platforms automate this process, and the mappings between essential elements (shameless plug: RSA Archer’s Risk Management solution does this well)

Next post, we’ll show a best practice governance process flow for updating content in a Risk Framework. 

 

GRC Forcing Function: The Digital Universe

EMC has been sponsoring the annual IDC Digital Universe Study for five years – and we’ve been saying the horrendous growth in information is one of the main Five Forcing Functions driving growth and adoption of GRC. The 2011 Digital universe Study is in – and the numbers will shock you. Here's a taste:

• Digital information in the world is doubling every two years.
• In 2011, the amount of information created and replicated will surpass 1.8 zettabytes (1.8 trillion gigabytes) - growing by a factor of 9 in just five years.
• Growth is not keeping pace with staffing - by 2020 we will have only 1.5 times the number of IT staff we have today.

Trust, which is really shorthand for GRC, is a big factor here.  The amount of information that needs to be secured is growing faster than our ability to secure it. When we consider the ‘digital shadow’ – how personal information is expanded through mobile device apps and social networking – not to mention corporate information that is stored, replicated, and transformed - it is even more difficult to manage privacy and protect sensitive information – we simply don’t know where it all is.  At the same time, online data collection is on the rise as we move into a world where analytics and big data can be the difference between knowing your customer, or not.

 What to do?

• First of all, read the study.
• Second, get started with Information Governance and Classification policies and schema and build this as a foundation of your GRC program. Understand what information, structured or unstructured, is sensitive, and build automatic or user driven classification into your information landscape as much as possible.
• Third, conduct an Information Risk Assessment leveraging technologies that scan for information by keywords and see where it resides, and where it is moving. You’ll be surprised by what you find.
• Fourth, start enforcing policies at the point of use with technologies for data loss protection, blocking sites and other “Information taming” technologies that drive down the cost of creating, capturing, managing and storing information.
• Fifth, build Information Governance and Assessments into the operating fabric of your organization – regulators, employees and customers are beginning to demand that you demonstrate you are in control of corporate and personal information privacy and protection.

Digital Information is going to continue to grow. As an industry, although we’ve come a distance in driving down the cost of creating, capturing, managing and storing information—one-sixth the cost in 2011 versus 2005 – we have a very long way to go.

 

Privacy and GRC – What the New Ponemon Study and the GAPP is Telling Us

Many organizations get their first taste of the promise and power of a GRC program when they begin to implement a Privacy Program. Why? Because privacy is an enterprise issue that spans legal, IT, compliance and business operations. Privacy regulations vary by jurisdiction, and at times may be in conflict.  In fact, privacy regulations are expected to get tougher, with additional breach notification requirements. With the increase in cloud computing, mobile devices and social networking, we are seeing growing demands from individuals and governments that organizations proactively build in ‘Privacy by Design’.  Privacy is a core GRC use case that is broad in its application, constantly evolving, delivered through many channels, and as a result needs to be managed as a program. 

Ponemon Survey on eGRC and Privacy

Surveying one of the largest eGRC practitioner communities at the RSA Archer eGRC Summit recently, a new Ponemon study reveals that “as eGRC continues to emerge as a top C-Suite priority, only 20% of large organizations have a clearly defined eGRC strategy that pertains to the entire enterprise and 33% admit they have no clearly defined eGRC strategy at all. Regardless of their industry, all organizations report that managing privacy regulations by geography and in accordance with country or state laws are a driving factor in their organization’s move to an integrated program that supports IT, Legal, Operations and Finance.  Respondents identified their top two privacy challenges as 1) ensuring data shared with third parties will remain safe and secure and 2) complying with all appropriate regulations.”

 If you want to see more about this, read RSA’s press release on the topic here.

Managing Privacy as a part of a GRC Program

Privacy programs have multiple facets, all of which fall into fundamental processes in GRC. Building common processes such as policy management, incident management and risk assessments to support not only privacy, but your other GRC challenges, make sense, creates efficiencies and provides an integrated foundation for managing risk across the enterprise. Here are some of the basic elements of a Privacy Program – all of these can be shared with similar programs such as security, regulatory compliance or controls testing.

• Policy Management from life cycle management, through communication to personnel and third parties
• Personal Information identification and classification
• Risk Assessments, to identify real exposures
• Privacy incident and breach management
• Training and Awareness of privacy policy and controls
• Choice and Consent in the collection of privacy information
• Use of private information for an identified purpose
• Retention and disposal of privacy information
• Access to, physical and virtual, and protection of privacy information
• Monitoring and Enforcement of privacy policies and controls

What can you do now?
If you are finding this a bit overwhelming, know that there is quite a bit you can do now to get started on building a strong, integrated Privacy Program. If you want to get some insight into the maturity state of your privacy processes, check out the Generally Accepted Privacy Principles (GAPP) from the IACPA here. 

What you are likely to discover is that beyond the program itself, you will need technology to help you manage such a broad spectrum of requirements. Yes, you’ll probably need an open GRC platform that can manage the collaboration privacy policy development, dissemination and attestation requires, and the automation of controls testing – through continuous controls monitoring or questionnaires.  Privacy management is supported by most GRC platforms (see RSA Archer here as an example) that do a great deal to help monitor risk and compliance related to the use of personal information.

What is for sure is that privacy challenges are NOT going away. They are only getting more intense. Time to get moving! If you are one of the two-thirds that are in need an enterprise GRC strategy - use privacy as your first use case. It’s bound to move you up the curve quickly and provide real value to your organization.

 

 

Japan Disaster: Reminding us why we need GRC that integrates Business Resilience, Risk and Incident Management

Japan's devastating earthquake, subsequent tsunami and current power plant threats remind us that we live in a world where the combination and cascading effect of threats raises risks beyond what we consider a reasonable threshold.  It is these apparent ‘black swan’ events that really set us back.  In times like this we see clearly the tight relationship between business resilience, risk and crisis management.

 As we watch the Japan disaster unfold, GRC and Business Continuity professionals the world over are abuzz with what this means back home.  Many organizations will take this an opportunity to look at their own best practices to understand their real exposures and plans to protect people and critical processes in the event of a disaster.

Centralizing approaches to business continuity, disaster recovery, risk and crisis management is a pure GRC use case.  And increasingly an urgent one. It seems impossible, and actually is, without a strong GRC program and good solid technology platform that cover the basics:

• End-to-end risk management process with a common nomenclature and processes for assessing risk on a near-real time basis
• Consensus between the business and IT on risk appetite
• Complete understanding of business process criticality, RTOs  and RPOs
• Visibility into the technology eco-system internally, and across the hybrid cloud - and how it supports the business
• Online access to business continuity and disaster recovery plans in the event of a crisis or business disruption.
• Centralized reporting and management of crisis events that impact employees, customers, stakeholders and mission-critical operations.

I have seen few platforms that can do all of this – but they are emerging.  RSA Archer Business Continuity is one, and there will be more entering the market in the short to medium term. It’s worth looking into these unified approaches –taking a proactive approach could save your organization in ways you can’t even imagine today. Who would have predicted we’d been looking at what we are now in Japan?  It is people, processes and technology, orchestrated in a way that is trulyresponsive, that in the end, makes all the difference.

GRC in the Cloud - Control + Visibility = Trust – Some examples from VmWare and RSA

Here’s the basic problem:  Information in the cloud is constantly on the move – that’s the side effect of cloud’s basic benefits of resource utilization and service availability.  This mobility, of course, is what drives security and GRC people crazy because it implies we don’t have visibility into where our information is, or control over where it goes, how it is used or who accesses it. 

At EMC we’ve netted out the cloud trust challenge in a simple equation: Control+ Visibility = Trust.  (See Chuck Hollis’s blog for more on this and the EMC Cloud Trust Vision Paper that describes it.)

We believe it can be that simple and here’s a few examples that show you why.

Assertion:  Hybrid cloud GRC platforms can gain unprecedented levels of visibility and control by harvesting from monitoring systems to ensure that the hybrid cloud infrastructure conforms to security specifications, and that information is controlled in compliance with policies and regulations.  

Proof:  Let’s look at how virtualization facilitates dynamic GRC at the infrastructure level.  Take Vmware’s vSphere™ platform - VMware vShield security suite includes virtual firewalls, logical zoning and edge network security and new capabilities are being integrated to enhance information security.  

Example # 1 Information-centric visibility and control:

RSA and VMware are integrating policy libraries from RSA DLP into the VMware vShield solution to discover sensitive or regulated data and create information-centric zones of secure IT resources designed to comply with the most exacting security and compliance standards.  This is key: now we have embedded intelligence to manage and monitor the most heavily regulated data types, including personally identifiable information, payment card information and patient health information. This approach uses secure zones to automate the control and monitoring of sensitive, valuable information – which means that organizations can now safely move mission-critical business processes to a more efficient cloud model.

Example #2 Secure multi-tenancy:

Now let’s look at the oft-discussed multi-tenant risk – how can we ensure secure partitions so that one tenant’s information in keep private and protected from another tenant’s?  The hypervisor-level firewall in the VMware vShield platform is engineered to enforce proper segmentation and trust zones for applications. In private clouds, this means organizations can set up virtual firewalls so that applications with different security requirements – for example, production and testing, finance and sales – can be hosted in the same virtual datacenter. In a cloud service provider environment, VMware vShield solutions enable different tenants to share IT resources safely by creating logical security boundaries that provide complete port group isolation.  This means that organizations can safely process mission-critical information in multi-tenant environments.

The Future: Adaptive Analytics

So, virtualization is giving us a new level of continuous controls monitoring.  Many of us believe that we will see adaptive analytics employed in these systems will manage information risk in a highly adaptive way.  With these examples we are already seeing the focus in cloud trust a shift more and more to information and identities – as we manage some of the highest profile risks – ensuring that information is protected in accordance with its sensitivity, and that only authorized identities, machines and people, can gain access to it.  

So, the Call to Action: learn more about hybrid cloud architectures and how virtualization can provide the level of trust your organization needs to make the move to cloud computing.   Talk to your IT architects and CSPs - and keep asking the fundamental questions around the basic equation:  how can you show me that Control+ Visibility = Trust?

Why the Hybrid Cloud will Accelerate GRC Platform Adoption

For years GRC advocates have been focused on one message: we can lower risk and gain efficiencies by managing common processes in governance, risk, compliance (and security) across the silos within the business with a common program supporting people, process and technology. The mantra is some variation of test once, analyze across, report many.  People are getting it. Yet the work of it has barely begun in even the most advanced of organizations – GRC, while gaining momentum, is still very much in its infancy. 

The drivers for GRC are many; I’ve blogged about the Five Forcing Functions of GRC previously.  Summarized they are:  exploding digital universe, avalanche of regulations, hyper-extended enterprise, virtualization and cloud computing and perhaps the most important: heightened need for visibility from executive and a wide variety of stakeholders. 

After this week at the RSA Conference I’m convinced more than ever that one of the five forcing functions – virtualization and cloud computing- in particular, the hybrid cloud - is going to give GRC a majorly big push this year – driving the need for more standardization,  visibility and control that GRC can provide.

Hybrid Cloud makes GRC all that more vital. Why?  Think of the hybrid cloud as meta-silos – now we aren’t just dealing with the need to integrate GRC across the internal organization – but now across the entire extended enterprise.  Yes, we’ve been doing it for years, it’s true, managing dozens, and sometimes hundreds or thousands of 3^rd party relationships – but hybrid cloud puts a new twist on the hyper-extended enterprise.

As organizations adopt more cloud computing models, from a wider variety of workloads, managing identity, and information across virtualized and physical infrastructures – we will see the evolution of hybrid cloud management systems. And with this, and perhaps, even in advance of these new cloud management systems – will be specialized solutions that specifically address cloud trust.  In effect, we are reaching a point of convergence between GRC and cloud computing.

At the center of this convergence is the hybrid cloud – which is driving the emergence of new platforms that manage GRC across all external and internal systems, whether it is the dozens of cloud service providers that are embedded in your business process, or the internal processes that live within the increasingly porous boundaries of your organization. 

RSA’s Cloud Trust Authority is one example of a hybrid cloud GRC platform that leverages the RSA Archer GRC platform, along with RSA envision and DLP – and there will be more.  Some will come from the cloud service providers themselves and others from vendors like vmware, EMC and RSA that are taking Cloud trust very seriously. 

The push for wider-scale adoption will ultimately come from large organizations that will demand visibility into their providers’ environments.  Eventually there will be a tipping point where standardized processes - facilitated by the unprecedented granularity of introspection and controls monitoring that are built-in and automated within virtualized environments - will bring this vision of the hybrid cloud GRC platform to fruition.  

So, the Call to Action: take a good look at what your organization is really doing with cloud computing – and imagine what the program and technology architecture will need to be to manage GRC across all of those relationships.  Talk to your CSPs and vendors –delve deep leveraging the Cloud Security Alliance Consensus Questionnaire and CSA Cloud Controls Matrix- and explore the possibility that hybrid cloud computing can actually improve your GRC.

Cloud Assessments – Try the Cloud Security Alliance Consensus Questionnaire

I’ve blogged previously about the Cloud Security Alliance (CSA) and Cloud Audit – this group is doing ALOT to promote the use of best practices for providing security assurance within cloud computing –and has grown to over 15,000 members in a short period of time. CSA working groups are tackling the tough challenges like cloud assessment, identity in the cloud, and security-as-a-service - in an open, collaborative way.

One of CSA’s main accomplishments has been advancing the adoption of the Cloud Controls Matrix into international standards communities.  An important new development is the Consensus Assessments Initiative (CAI) Questionnaire – a spreadsheet that cloud consumers and assessors can use to understand what security controls Cloud Service Providers (CSPs) have implemented in their IaaS, PaaS, and SaaS offerings. The Questionnaire is a companion to the CSA Guidance and the CSA Cloud Controls Matrix.   Use it with CSPs you are considering – test it and give feedback to on what works and what doesn’t to the CSA working groups.

Fyi, if you haven’t heard, CSA is holding a half day summit co-located with the RSA Conference 2011, San Francisco, Feb 14.  Keynote speaker will be Marc Benioff, CEO Salesforce.com. 

As a footnote ENISA – the European Network and Security Agency - has just released a new 146 report on Risk and Resiliency in the Cloud for governments and health care agencies, leveraging work of the Cloud Security Alliance (CSA), among others.  This is another landmark in a series of international standards organizations adopting CSA work. Pages 13-20 describe a scenario which covers the challenges in conversational language. Interesting reading if you don’t want to read about controls J

For all of you attending the RSA Conference, see you there! I will be at the CSA Summit on Monday am and hanging at the RSA and EMC booths throughout the Expo hours.

 

Cloud Trust – Are you keeping up with your organization’s plans for monetizing the cloud?

Many enterprises are now embracing cloud computing – especially as a model to quickly launch new products and services. As GRC professionals, we are not always privy to these plans until they are well underway and can find ourselves in the position where we are trying to assure governance and security controls are in place in hosted environments – after the fact.

Gartner estimates that cloud computing services market will grow to over $150b by 2013. Your own organization may be part of this growth - leveraging private cloud, public cloud or hybrid models.  To provide value to your organization on issues of cloud trust, you will need to distinguish among cloud types and their respective trust characteristics. For example in the public cloud, you are less likely to be able to maintain traditional control over your organizations’ information assets, and in the private cloud, you can do much more. In fact, properly implemented, a private cloud deployment can prove more trustworthy than what you have internally in place today.

Most importantly, you will need to evaluate specifically what business processes and information, applications, and other assets would be moving to the cloud. This will require a pretty thorough evaluation that will lead to what type of cloud deployment model is the best destination for what you are trying to achieve. At EMC, we have been doing work on this by looking at each asset and its potential migration to the cloud through three “filters” – economic, functional, and trust. The real danger lies in moving assets to the cloud without applying all three.  More about that work coming in a later post.

In the interim, you might start having conversations with your business colleagues and management to understand more about how they are trying to improve customer experience, business processes and services – and how cloud computing may be leveraged to improve agility and lower costs through better resource utilization. Become familiar with what public cloud providers really offer in terms of security and assurance. Understand what communication service providers (that you may be using now or in the future) are planning to launch as cloud service offerings to support their very diverse and growing customer base – consumers as well as enterprises. (For a quick review of how CSPs can/are exploiting cloud opportunities - read this EMC Consulting Perspective here). 

The cloud computing market is evolving rapidly with new capabilities being offered almost daily that many organizations can’t afford to ignore. It is our responsibility as GRC professionals to stay ahead of this curve and keep our organizations and IT groups moving safely along the journey to the cloud.   

Here’s a brief review of cloud types – more coming next week on how to evaluate the trust profiles of each.

Public Cloud: Resources are owned and managed by the provider and shared across customers. Scale economies can be high and costs low, but for the enterprise customer both transparency and control can be low. A variation is the community cloud, a multi-company members-only version of a public cloud, usually centered on a common business process (e.g., for use by a purchasing consortium).

Private Cloud: Resources are owned and managed by the enterprise and shared across it. The enterprise has scale economies and cost advantages (though not on a par with the public cloud) together with more transparency and control. Private cloud resources are usually on premise; however, an external private cloud can be operated by an outside service and still offer the level of transparency and control (including over asset location and segregation) needed by the enterprise.

Hybrid Cloud: A mix of public and private clouds. Each application and its data may reside in isolation in one cloud or the other. In more complex configurations, selected data moves back and forth, for example when a public cloud CRM application shares data with financial applications in a private cloud. Sometimes a public cloud service is an on-demand extension of computing and storage infrastructure to handle peak loads. Hybrid cloud is the more complex configuration, but can offer greater flexibility and benefit.

 

Cloud Security -Certification of Cloud Security Knowledge

For all of you certification junkies - and in our field there are many :-)  - there is a good certification now available online (for $195 through Dec 2010) at the Cloud Security Alliance. Launched this month, it is a 50 question, multiple choice test that must be completed in 60 minutes - but don't worry - there is a study guide available at CCSK Study Guide.  The questions cover the information you will find in one overview document I mentioned in my last post - Cloud Security Alliance Guidance Version 2.1– Security Guidance for Critical Areas of Focus in Cloud Computing and another ENISA – Cloud Computing Risk Assessment.

The CSA is planning updates to this body of knowledge and will have a road map for certifications next year. In the meantime, it's a good idea to do the prep and take the exam. 

This certification isn't a substitute for current certifications such as CISM or CISSP. It is based on knowledge specific to cloud computing - so, you can't use any of your other certifications to grandfather you in!  

Since it is on-demand, it should fairly straightforward to set aside an afternoon  to review the material and then take the exam.  

Cloud Audit – Paving the Way to the GRC Enabled Cloud

I’ve just joined one of the Cloud Audit working groups – focused on developing controls for cloud computing.  Over 400 other keen GRC and Security professionals are part of this growing group. Don’t know about Cloud Audit? Let me share with you a bit about this and why it is important. First of all, governance, risk, security  and compliance management is becoming increasingly critical in the cloud – I’ve blogged on this previously.  What has been holding us back are consistent and standardized frameworks, open standards and interfaces that address not only controls but also easy to implement processes to provide assurances on levels of GRC and security in cloud environments.  Enter Cloud Audit, designed to smash down the roadblocks and getting us flying in the cloud.

 

Cloud Audit began in January of this year, driven by Christopher Hoff (CISCO), and others from many organizations including Telus, CSC, VMware, Microsoft, EMC, Unisy and  Terremark. It is a volunteer cross-industry effort from the best minds and talent in Cloud, networking, security, audit, assurance and architecture backgrounds – specifically focused on developing and providing a common interface that allows Cloud providers to automate Cloud Audits.

 

Central to the groups’ work is something called A6 – which stands for Automated Audit, Assertion, Assessment, and Assurance API.  The idea is that cloud providers and consumers of their services should be able to leverage an open, extensible and secure set of interfaces for Cloud GRC and Security. 

 

The mantra of the group is to: 

• Keep it simple, lightweight and easy to implement; offer primitive definitions & language structure using HTTP(S)
• Allow for extension and elaboration by providers and choice of trusted assertion validation sources, checklist definitions, etc.
• Not require adoption of other platform-specific APIs
• Provide interfaces to Cloud naming and registry services

You can get involved in these working groups or simply follow the discussions held every Monday at 1 pm est. Join the Google group for Cloud Audit here.

Cloud Audit of course is not the only group looking at the Cloud Security and GRC -

Many of you may know about the Cloud Security Alliance (focused on best practices and education in cloud computing), the Trusted Cloud Initiative(focused on certification for various cloud environments) and the European Network and Information Security Agency (ENISA)’s work on this topic – there have been some important documents produced over the past 6 months that are worth diving into.

 

We’ll have more about these orgs in future posts, but for now  - two good overview documents are Cloud Security Alliance – Security Guidance for Critical Areas of Focus in Cloud Computing and ENISA – Cloud Computing Information Assurance Framework.

If you haven't dug into cloud GRC - now is the time to do it. It's important for career and good for your company - there aren't many organizations today that don't see their future apps portfolio moving more and more into the cloud.