{"id":109,"date":"2017-11-26T16:20:00","date_gmt":"2017-11-26T16:20:00","guid":{"rendered":"https:\/\/www.7sec.com\/blog\/?p=109"},"modified":"2021-06-10T13:09:34","modified_gmt":"2021-06-10T13:09:34","slug":"team-development-internal-audit-and-control-101","status":"publish","type":"post","link":"https:\/\/www.7sec.com\/blog\/team-development-internal-audit-and-control-101\/","title":{"rendered":"Team Development, Internal Audit & Control 101"},"content":{"rendered":"\r\n
The development of a company\u2019s employees is of major importance. Ultimately, progress and growth are what everyone\u2019s after, but in order for that to happen, processes, workflow, and ethnicity must be all under control.<\/p>\r\n
In order to create a secure operations environment, an organization needs to build its structure and staff it in line with the proper approach to the\u00a0human factor in Information Security. Failing to do so usually results in a lack of direction, misplaced responsibility, and ultimately, operational disruptions.<\/p>\r\n
\r\n\r\n<\/p>\r\n
THE TOP-DOWN APPROACH<\/h4>\r\n
Information Security is never built from the bottom up. Do not assume that everyone in the organization is tuned in to what (and how) needs to be done regarding Information Security. The major roles are usually defined as:<\/p>\r\n
\r\n\r\n<\/p>\r\n
Senior Management \u2013 creates information security program and ensures proper and adequate staffing and funding and has organizational priority. Responsible for ensuring organizational assets are protected.<\/p>\r\n
\r\n\r\n<\/p>\r\n
Data Owner (aka information owner or business owner) \u2013 a management employee responsible for ensuring the protection of specific data. Data classification, sensitivity labels, and the frequency of data backup are determined by this role.<\/p>\r\n
\r\n\r\n<\/p>\r\n
Custodian \u2013 a role responsible for the actual protection of assets, performing tasks such as data backups and restoration, patch systems, etc., under detailed orders \u2013 Custodians do not make critical decisions on how data is protected.<\/p>\r\n
\r\n\r\n<\/p>\r\n
User \u2013 the largest in number, yet major information security role. Users follow rules. For Users, it is mandatory to comply with policies, procedures, standards, etc. Working to raise awareness you can tell people how to do the right things at times when their behavior can make a difference in the security of the company.<\/p>\r\n
\r\n\r\n<\/p>\r\n
ADMINISTRATIVE PERSONNEL CONTROLS<\/h4>\r\n
\r\n\r\n<\/p>\r\n
These are fundamental operational security concepts that should be observed when organizing and structuring the staff of a company. These concepts are important because they do not only deal with personnel but permeate through multiple Information Security domains:<\/p>\r\n
\r\n\r\n<\/p>\r\n
\r\n
Least Privilege (aka Minimum Necessary Access) \u2013 dictates that all persons\u2019 access is strictly bound to the minimum access required so they can perform their duties. This is the one, single, most important principle that administrative security controls revolve around.<\/li>\r\n
Split-knowledge \u2013 a process in which certain portions of data have split access over multiple people, individually sharing no knowledge of the data in its entirety. Thus data can be subsequently inputted into, or output from, by the separate people to the extent they access to and can be combined to recreate the data in its entirety only by a person with access that would allow such actions.<\/li>\r\n
Separation of duties \u2013 prescribes that multiple people are required to complete critical or sensitive transactions. The goal of separation of duties is to ensure that in order for someone to be able to abuse access to sensitive data or transactions, that person must convince another party to act in concert.<\/li>\r\n
Rotation of duties\/job rotation \u2013 a process in which staff members are required to perform the same duties interchangeably on a rotation schedule. By doing so, the company is more protected due to having varying people perform and review the work of their peers, who did the same job in the previous rotation. Rotation of duties helps mitigate a collision, where two or more people are in alliance to subvert the security of a system.<\/li>\r\n
Mandatory leave\/forced vacation \u2013 an additional operational control, closely related to a rotation of duties, with the primary security considerations being similar: reducing or detecting personnel single points of failure and the detection and deterrence of fraud. Forcing all employees to take leave can identify areas where the depth of coverage is lacking or can help reveal fraudulent or suspicious behavior.<\/li>\r\n<\/ul>\r\n
\r\n\r\n<\/p>\r\n
TYPICAL STRUCTURE AND INTERACTIONS<\/h4>\r\n
\r\n\r\n<\/p>\r\n
\r\n<\/figure>\r\n<\/div>\r\n
\r\n\r\n<\/p>\r\n
<\/p>\r\n
\r\n\r\n<\/p>\r\n
While the diagram above provides a generic structure to illustrate how Information Security and Internal Audit are related both functionally and in terms of subordination and dependency, it is not to be applied blindly. When building one\u2019s own structure, one should take into account the nature of the organization\u2019s business, its existing structure as well as resource considerations. The\u00a0Information Security Manager\u00a0usually referred to as the\u00a0Chief Information Security Officer (CISO)\u00a0and their unit play a distinct role, which should not be confused with that of the\u00a0Audit Committee (AKA The Internal Audit and Control Unit)\u00a0as is further detailed below.<\/p>\r\n
\r\n\r\n<\/p>\r\n
The CISO<\/strong><\/p>\r\n
\r\n\r\n<\/p>\r\n
The Chief Information Security Officer (CISO) is the highest-ranking executive responsible for the establishment and maintaining the fundamental business concept, the company\u2019s strategy, and programs to ensure assets and information technology appropriately protected.<\/p>\r\n
\r\n\r\n<\/p>\r\n
The CISO directs staff in the identification, development, implementation, and maintenance of processes across the organization to reduce the information and information technology (IT) risks.<\/p>\r\n
\r\n\r\n<\/p>\r\n
The CISO, and its staff, respond to incidents, establish appropriate standards and controls, manage security technologies, and guide the development and implementation of policies and procedures.<\/p>\r\n
\r\n\r\n<\/p>\r\n
The CISO is also usually responsible for compliance related to company information.<\/p>\r\n
\r\n\r\n<\/p>\r\n
The Internal Audit & Control Unit<\/strong><\/p>\r\n
\r\n\r\n<\/p>\r\n
The Internal Audit & Control Unit holds an inextricably independent function. Otherwise, it can become dysfunctional with sub-standard performance. There are many degrees in the level of independence and effectiveness, so a clear understanding of the business needs and circumstances is required.<\/p>\r\n
\r\n\r\n<\/p>\r\n
The unit\u2019s function is to provide a third level of control in the organization, which should be independent of the control of the first level \u2013 that of the top management of the company and of other units, such as legal, human resources, financial control, etc.<\/p>\r\n
\r\n\r\n<\/p>\r\n
The unit establishes appropriate policies and procedures to guide the internal audit function, and ensure the quality of the assurance services delivered \u2013 all aligned and are consistent with the company\u2019s objectives and governance policies.<\/p>\r\n
![\"\"](\"https:\/\/www.7sec.com\/blog\/wp-content\/uploads\/2018\/04\/team.png\")
<\/figure>\r\n<\/div>\r\n