Richard A. Caralli, Julia H. Allen, David W. White. CERT Resilience Management Model

Подождите немного. Документ загружается.

AM:GG2.GP5 TRAIN PEOPLE

Train the people performing or supp orting the access management process as needed.

Refer to the Organizational Training and Awareness process area for more information about

training the people performing or supporting the process.

Refer to the Human Resource Management process area for more information about invento-

rying skill sets, establishing a skill set baseline, identifying required skill sets, and measuring

and addressing skill deficiencies.

Subpractices

1. Identify process skill needs.

Elaboration:

Skill needs relative to AM:GG2.GP5 subpractice 1 do not include the implementation

and management of access controls, which may require extensive skill levels.

These skill needs are addressed in the process areas relative to each of the asset

types as specified in AM:GG2.GP4 subpractice 1.

2. Identify process skill gaps based on available resources and their current skill levels.

3. Identify training opportunities to address skill gaps.

Elaboration:

4. Provide training and review the training needs as necessary.

These are examples of training topics:

• understanding service desk procedures for handling access requests

• documenting, processing, routing, reviewing, and approving access requests

• ensuring access privileges are properly associated with roles, rights, responsibili-

ties, and identities

• managing and controlling changes to access privileges and supporting databases

• deprovisioning access privileges

• supporting asset owners and custodians in understanding the process and their

roles and responsibilities with respect to its activities

These are examples of skills required in the access management process:

• knowledge of the tools, techniques, and methods necessary to manage access

privileges, including those necessary to perform the process using the selected

methods, techniques, and tools identified in AM:GG2.GP3 subpractice 3

• knowledge unique to each type of asset that is required to establish and maintain

privileges for each type

• knowledge necessary to work effectively with asset owners and custodians

• knowledge necessary to elicit and prioritize stakeholder requirements and needs and

interpret them to develop effective requirements, plans, and programs for the process

Access Management 167

AM:GG2.GP6 MANAGE WORK PRODUCT CONFIGURATIONS

Place designated work products of the access management process under appropriate

levels of control.

Elaboration:

AM:SG1.SP2 addresses the change control process over access privileges.

However, other work products of the access management process (such as

access requests and access policy acknowledgments) must also be managed

and controlled.

To ol s, te ch ni q ue s , a nd me t ho ds sh ou ld be e mp lo ye d t o s u pp ort t he in it ia -

tion, approval, and acceptance of access requests and corresponding access

privileges. Access privileges are operationalized using access control mecha-

nisms. For example, an access privilege allowing modification of information

may be represented by an entry in a file’s access control list. Thus, managing

work products such as access privileges may necessarily involve management

of the access controls themselves, even though access controls are not within

the scope of AM:GG2.GP6.

AM:GG2.GP7 IDENTIFY AND INVOLVE RELEVANT STAKEHOLDERS

Identify and involve the relevant stakeholders of the access management process as

planned.

Elaboration:

Several AM-specific practices address the involvement of asset owners and cus-

todians as key stakeholders in the access management process. For example,

These are examples of access management work products placed under control:

• access control policy and acknowledgments from users that they understand and

will abide by the policy

• access requests and approvals

• access rights and responsibilities

• change management processes for access control systems

• access privilege change criteria and authorizations for change

• access privilege database

• list of excessive or inappropriate access privileges

• list of access privileges to be deprovisioned

• process plan

• policies and procedures

• contracts with external entities

168 PART THREE CERT-RMM PROCESS AREAS

AM:SG1.SP1 describes the role of asset owners in assigning, approving, and

revoking access privileges and the role of asset custodians in implementing

access requests. AM:SG1.SP2 and AM:SG1.SP3 provide guidance on the role of

asset owners in initiating, reviewing, and approving changes to access privi-

leges and the role of asset custodians in maintaining access controls.

Subpractices

1. Identify process stakeholders and their appropriate involvement.

Elaboration:

Stakeholders of the plan include organizational staff who request, grant, or

support the provision of access privileges to organizational assets.

2. Identify these stakeholders to planners and those responsible for process performance.

3. Involve relevant stakeholders in the process as planned.

AM:GG2.GP8 MONITOR AND CONTROL THE PROCESS

Monitor and control the access management process against the plan for performing the

process and take appropriate corrective action.

Stakeholders are involved in various tasks in the access management process, such as

• planning for the process

• reviewing, initiating, approving, and revoking access requests and privileges

• translating access requests/privileges to access controls

• reconciling access privileges with roles, responsibilities, and identities

• identifying and correcting inappropriate levels of access privileges

• reviewing and appraising the effectiveness of process activities

• resolving issues in the process

These are examples of stakeholders of the access management process:

• asset owners and custodians

• service owners

• organizational unit and line of business managers responsible for assets

• owners and sponsors of identities requiring access

• staff responsible for developing, implementing, and managing an internal control

system for assets

• external entities responsible for making access requests and managing access to

assets

• human resources and legal departments as advisors on changes to access privileges

• internal and external auditors

Access Management 169

Refer to the Monitoring process area for more information about the collection,

organization, and distribution of data that may be useful for monitoring and controlling

processes.

Refer to the Measurement and Analysis process area for more information about establishing

process metrics and measurement.

Refer to the Enterprise Focus process area for more information about providing process

information to managers, identifying issues, and determining appropriate corrective

actions.

Subpractices

1. Measure actual performance against the plan for performing the process.

2. Review accomplishments and results of the process against the plan for performing

the process.

Elaboration:

These are examples of metrics for the access management process:

• percentage of access requests that adhere to the process policy

• percentage of access requests approved (based on policy)

• percentage of access requests denied (based on policy)

• percentage of policy acknowledgment forms that have been fully executed

• number of duplicate access requests

• percentage of unapproved access requests that result in allowing access

privileges

• percentage of access requests that are inappropriate given the requestor’s role or

job responsibilities

• percentage of access privileges incorrectly approved based on user’s role or job

responsibilities

• rate of requests to change current access privileges

• percentage of unapproved changes to access privileges

• the mean and median time frames between a change in access privileges requir-

ing deprovisioning and the actual deprovisioning

• number of risks related to inappropriate or excessive levels of access privileges

that have been referred to the risk management process; number of such risks

where corrective action is still pending (by risk rank)

• level of adherence to process policies; number of policy violations; number of

policy exceptions requested and number approved

• number of process activities that are on track per plan

• rate of change of resource needs to support the process

• rate of change of costs to support the process

170 PART THREE CERT-RMM PROCESS AREAS

3. Review activities, status, and results of the process with the immediate level of

managers responsible for the process and identify issues.

Elaboration:

4. Identify and evaluate the effects of significant deviations from the plan for

performing the process.

Elaboration:

Deviations from the access management plan may occur when access requestors

and asset owners fail to follow organizational policies regarding access request

and approval. Significant deviations typically occur when changes in the opera-

tional environment and user community are not reflected in the current level of

access privileges permitted. These deviations may permit unauthorized or inad-

vertent access to assets that can affect operational resilience.

5. Identify problems in the plan for performing and executing the process.

6. Take corrective action when requirements and objectives are not being satisfied,

when issues are identified, or when progress differs significantly from the plan for

performing the process.

7. Track cor re ctive ac tion to closure.

Periodic reviews of the access management process are needed to ensure that

• policies are in place for managing access privileges

• ownership and custodianship over assets and access privileges for assets are

established and documented access requests are submitted and approved

according to policy

• change control processes are operating appropriately to ensure changes to access

privileges are made and documented in a timely manner

• access privileges are periodically reconciled with roles, responsibilities, and identities

• access privilege inconsistencies are identified and corrected in a timely manner

• access privileges are deprovisioned when they are no longer valid or necessary

• status reports are provided to appropriate stakeholders in a timely manner

• unresolved issues surrounding inappropriate or excessive access privileges are

referred to the risk management process when necessary

• actions requiring management involvement are elevated in a timely manner

• the performance of process activities is being monitored and regularly reported

• key measures are within acceptable ranges as demonstrated in governance dash-

boards or scorecards and financial reports

• administrative, technical, and physical controls are operating as intended

• internal controls are meeting the stated intent of the resilience requirements

• actions resulting from internal and external audits are being closed in a timely

manner

Access Management 171

AM:GG2.GP9 OBJECTIVELY EVALUATE ADHERENCE

Objectively evaluate adherence of the access management process against its process

description, standards, and procedures, and address non-compliance.

Elaboration:

AM:GG2.GP10 REVIEW STATUS WITH HIGHER-LEVEL MANAGERS

Review the activities, status, and results of the access management process with

higher-level managers and resolve issues.

Refer to the Enterprise Focus process area for more information about providing sponsorship

and oversight to the operational resilience management system.

These are examples of work products to be reviewed:

• access control policy and policy exceptions and waivers

• access privilege requests

• access privilege database

• access privilege change criteria

• action plans (for addressing inconsistencies)

• process plan and policies

• access privilege issues that have been referred to the risk management process

• process methods, techniques, and tools

• metrics for the process (Refer to AM:GG2.GP8 subpractice 2.)

• contracts with external entities

These are examples of activities to be reviewed:

• access request and approval process

• making changes to existing access privileges

• the alignment of stakeholder requirements with process plans

• assignment of responsibility, accountability, and authority for process activities

• determining the adequacy of process reports and reviews in informing decision

makers regarding the performance of operational resilience management activi-

ties and the need to take corrective action, if any

• verification of process controls, including identifying and correcting excessive or

inappropriate levels of access

• use of process work products for improving strategies to protect and sustain

assets and services

172 PART THREE CERT-RMM PROCESS AREAS

AM:GG3 INSTITUTIONALIZE A DEFINED PROCESS

Access management is institutionalized as a defined process.

AM:GG3.GP1 ESTABLISH A DEFINED PROCESS

Establish and maintain the description of a defined access management process.

Establishing and tailoring process assets, including standard processes, are addressed in the

Organizational Process Definition process area.

Establishing process needs and objectives and selecting, improving, and deploying process

assets, including standard processes, are addressed in the Organizational Process Focus

process area.

Subpractices

1. Select from the organization’s set of standard processes those processes that cover

the access management process and best meet the needs of the organizational

unit or line of business.

2. Establish the defined process by tailoring the selected processes according to the

organization’s tailoring guidelines.

3. Ensure that the organization’s process objectives are appropriately addressed in

the defined process, and ensure that process governance extends to the tailored

processes.

4. Document the defined process and the records of the tailoring.

5. Revise the description of the defined process as necessary.

AM:GG3.GP2 COLLECT IMPROVEMENT INFORMATION

Collect access management work products, measures, measurement results, and improve-

ment information derived from planning and performing the process to support future use

and improvement of the organization’s processes and process assets.

Elaboration:

These are examples of improvement work products and information:

• access requests

• approval of access requests

• issues related to change control on access privileges

• inconsistencies in levels of access privileges

• exceptions and waivers permitted to process policies

Access Management 173

Establishing the measurement repository and process asset library is addressed in the

Organizational Process Definition process area. Updating the measurement repository and

process asset library as part of process improvement and deployment is addressed in the

Organizational Process Focus process area.

Subpractices

1. Store process and work product measures in the organization’s measurement

repository.

2. Submit documentation for inclusion in the organization’s process asset library.

3. Document lessons learned from the process for inclusion in the organization’s

process asset library.

4. Propose improvements to the organizational process assets.

• metrics and measurements of the viability of the process (Refer to AM:GG2.GP8

subpractice 2.)

• changes and trends in operating conditions, risk conditions, and the risk environ-

ment that affect process results

• lessons learned in post-event review of incidents and disruptions in continuity

• process lessons learned that can be applied to improve operational resilience

management performance, such as excessive or inappropriate access privileges

and difficulties in assigning and executing asset ownership and custodianship

responsibilities

• the level to which the status of the asset privileges by asset type, asset owner, or

other meaningful categorization schemes is current

• reports on the effectiveness and weaknesses of controls

• asset privilege corrective action plans that are not executed and the risks associ-

ated with them

• resilience requirements that are not being satisfied or are being exceeded

174 PART THREE CERT-RMM PROCESS AREAS

175

COMMUNICATIONS

Enterprise

Purpose

The purpose of Communications is to develop, deploy, and manage internal and

external communications to support resilience activities and processes.

Introductory Notes

Communication is a basic organizational activity and competency. From a

resilience perspective, communication is an essential function, tying together

disparate parts of the organization that collectively have a vested interest in pro-

tecting high-value assets and services and sustaining assets and services during

and after a disruptive event.

Internally, communications processes are embedded in operational resilience

management processes such as incident management, governance, and compli-

ance, and support the development and execution of plans for sustaining the

required level of resilience; externally, communications processes provide much-

needed information to relevant stakeholders on the capability of the organization

to protect and sustain assets and services, handle disruptions, and preserve cus-

tomer confidence in unsettled and stressful times. Most important, communica-

tions are a critical success factor in ensuring the successful execution of service

continuity plans and decision making, particularly during a crisis or disaster.

The Communications process area seeks to capture the communications

activities that support and enable effective management of operational resilience.

This requires foundational processes for basic and ongoing communications

needs as well as more flexible ones for supporting the communications demands

of managing events and executing service continuity plans. In the Communica-

tions process area, the organization establishes communications requirements

that reflect the needs of stakeholders that are important to managing operational

resilience. Communications guidelines and standards are developed to ensure the

consistency and accuracy of messages and communications methods across all

resilience processes. The communications infrastructure is established and man-

aged to ensure effective and continuous communications flow when needed.

COMM

The organization also regularly assesses its communications abilities, particularly

after an event, incident, or crisis, to revise communications requirements and to

make improvements in the type and media of communications and the commu-

nications infrastructure.

The Communications process area focuses on communications processes that

directly support the management of operational resilience. These processes are

likely to be part of a larger (and in some cases, enterprise-wide) communications

process in the organization. Thus, the Communications process area is not con-

sidered a substitute for this larger process.

Related Process Areas

The definition of the resilience program and the development of program objectives are

established in the Enterprise Focus process area.

The data and information that the organization needs to provide governance and control over

the operational resilience management system are established in the Monitoring process area

and used in the Enterprise Focus process area.

The guidelines and standards for communicating about events, incidents, and crises are

addressed in the Incident Management and Control process area.

The guidelines and standards for communicating with external entities to coordinate manage-

ment of events are addressed in the External Dependencies Management process area.

Specific communications activities relevant to service continuity plans are developed and

implemented in the Service Continuity process area.

Awareness communications relative to operational resilience management are addressed in

the Organizational Training and Awareness process area.

Summary of Specific Goals and Practices

COMM:SG1 Prepare for Resilience Communications

COMM:SG1.SP1 Identify Relevant Stakeholders

COMM:SG1.SP2 Identify Communications Requirements

COMM:SG1.SP3 Establish Communications Guidelines and Standards

COMM:SG2 Prepare for Communications Management

COMM:SG2.SP1 Establish a Resilience Communications Plan

COMM:SG2.SP2 Establish a Resilience Communications Program

COMM:SG2.SP3 Identify and Assign Plan Staff

COMM:SG3 Deliver Resilience Communications

COMM:SG3.SP1 Identify Communications Methods and Channels

COMM:SG3.SP2 Establish and Maintain Communications Infrastructure

COMM:SG4 Improve Communications

COMM:SG4.SP1 Assess Communications Effectiveness

COMM:SG4.SP2 Improve Communications

176 PART THREE CERT-RMM PROCESS AREAS