Richard A. Caralli, Julia H. Allen, David W. White. CERT Resilience Management Model

Подождите немного. Документ загружается.

ACKNOWLEDGMENTS

This book is the culmination of many years of hard work by many talented peo-

ple dedicated to the belief that security, continuity, and IT operations manage-

ment processes can be improved, and operational resilience can be actively

directed, controlled, and measured. These people have spent countless hours

poring over codes of practice, interviewing senior personnel in organizations

with high-performance resilience programs, applying and field testing the con-

cepts in this book, and codifying the 26 most common process areas that com-

pose a convergent view of operational resilience.

CERT-RMM is a major component of this book. Early models were created by

Richard Caralli, working with members of the Financial Services Technology

Consortium over a four-year period from 2004 through 2008. The model was sig-

nificantly enhanced as additional model team members joined our efforts. The

resulting model included in this book (CERT-RMM v1.1) is the work of the

CERT-RMM Model Team, which includes Richard Caralli, David White, Julia Allen,

Lisa Young, and Pamela Curtis.

CERT-RMM v1.1 was refined and recalibrated through benchmarking activities

performed over a period of two years by security and continuity professionals at

prominent financial institutions. The model team is forever indebted to the following

people who participated in that effort (listed here with the companies at which

they worked during the benchmarking effort):

• Ameriprise Financial: Barry Gorelick

• Capital Group: Michael Gifford and Bo Trowbridge

• Citi: Andrew McCruden, Patrick Keenan, Victor Zhu, and Joan Land

xxi

xxii Acknowledgments

• Discover Financial Services: Rick Webb, Kent Anderson, Kevin Novak, and

Ric Robinson

• JPMorgan Chase & Co.: Judith Zosh, Greg Pinchbeck, and Kathryn Wakeman

• Marshall & Ilsley Corporation: Gary Daniels and Matthew Meyer

• MasterCard Worldwide: Randall Till

• PNC Financial Services: Jeffery Gerlach and Louise Hritz

• U.S. Bank: Jeff Pinckard, Mike Rattigan, Michael Stickney, and Nancy Hofer

• Wachovia: Brian Clodfelter

In addition, we are grateful for the contributions of people from organizations

that bravely performed early appraisal pilots using the model, including Johnny

E. Davis, Kimberly A. Farmer, William Gill, Mark Hubbard, Walter Dove,

Leonard Chertoff, Deb Singer, Deborah Williams, Bill Sabbagh, Jody Zeugner,

Tim Thorpe, and the many other participants from the Environmental Protection

Agency; and Nader Mehravari, Joan Weszka, Michael Freeman, Doug Stopper,

Eric Jones, and many other talented people from Lockheed Martin Corporation.

Last, but certainly not least, we owe much of the momentum that created this

model to Charles Wallen from American Express. In 2005, as the Executive

Director of the Business Continuity Standing Committee for the Financial Ser-

vices Technology Consortium, Charles came to the CERT Program at the Soft-

ware Engineering Institute with a desire to create a resiliency maturity model

based on work being performed at CERT. Five years later (which is only four

years and 46 weeks longer than we hoped it would take!), we have a functional

model.

We would also like to thank those who supported this effort at the Software

Engineering Institute and CERT.

We thank Rich Pethia, Director–CERT Program, for his support, patience,

encouragement, and direction during the development and piloting of the model.

We have special thanks for William Wilson, Deputy Director–CERT Program,

and especially Barbara Laswell, Director–CERT Enterprise Workforce Develop-

ment Directorate, for their day-to-day direction and assistance in helping us

build a community of believers and helping us navigate through all of the chal-

lenges inherent in a long, arduous effort. In particular, Barbara has been an inter-

nal champion from the beginning and an ardent source of encouragement in the

most trying times of the development of this model.

A special thanks goes to all of those who contributed essays in Chapter 7.

Your in s ight h as been invalu able in helpin g us understand how the c ommunity

can make use of this important work.

Finally, special thanks to our Addison-Wesley partners, especially Peter Gordon,

for their guidance and assistance with the design, editing, and final production of

this book.

Acknowledgments xxiii

From Richard Caralli

I owe the completion of this book to so many SEI and CERT people. Lisa Young

worked tirelessly to do much of the basic research for this work and to create

many interim deliverables. Her knowledge of security and continuity codes of

practice is astonishing. No matter what request we made of her, she was always

willing to jump in and help. David White single-handedly led the charge to make

organizations aware of CERT-RMM. He devoted countless hours to getting the

message out, no matter where that journey took him. It turned out in the process

that he also had significant knowledge of the subject matter and taught us a few

things! This book would not be possible without him. Julia Allen saved the day.

When Lisa, David, and I were struggling with too many commitments, Julia

seamlessly swooped in and single-handedly completed a significant portion of

the model. I can never thank her enough for her contributions and her willing-

ness to put her own important research aside and become a part of our team. And

if you ever have the fortune to work with Julia, you also get the side benefits of

knowing a genuinely kind, collaborative, and intelligent person who gives every-

thing unconditionally. This also reminds me of my friend Pamela Curtis. Pamela

has contributed tirelessly to the development effort of CERT-RMM and in making

us all look good with her constant polishing and refinement of the model. To call

her a technical editor does not adequately characterize the impact she has had on

this book. Her quick comprehension of the subject matter redefined forever what

we will expect technical editors to do. She has truly raised the bar.

From Julia Allen

I thank my two coauthors, Rich and David; Rich for his vision and leadership of

CERT’s operational resilience work over many years, particularly when there

were many doubters of its value, and David for his commitment, insight, and

fieldwork to validate the model. They have both been my mentors and teachers.

I thank Lisa Young for leading our efforts in appraisal and assessment and for

valuable lessons learned in applying CERT-RMM to meet customer needs. I bene-

fited significantly from Pamela Curtis’s steady hand, challenging comments, and

unique ability to connect the dots across all CERT-RMM process areas. I greatly

appreciate Barbara Laswell’s recognition of the power in integrating CERT’s enter-

prise security governance guidance with CERT-RMM, which was the catalyzing

event for my joining the CERT-RMM development team. I will be forever grateful

for the opportunity she offered me to contribute to this body of work, and for

Rich’s and the team’s warm welcome. I would be remiss if I did not recognize and

thank two SEI colleagues who helped form, shape, and influence my thinking

regarding how to adapt process maturity concepts and practices for application to

the operational and software security domains. Eileen Forrester and I worked on

this over many years; she is one of the most capable thinkers in this space with

xxiv Acknowledgments

whom I’ve had the good fortune to work. And Suzie Garcia, the queen of CMMI,

codified process maturity and capability modeling concepts. I would like to

thank Gene Kim, CTO of Tripwire, for articulating and advocating the numerous

connections between information security, IT operations, audit, and risk manage-

ment, and for introducing the SEI to some of the most experienced and compe-

tent leaders in this field, including all of the participants in our joint Best in Class

Security and Operations Round Table, held in October 2003. I am incredibly

blessed and fortunate to be able to contribute every day to a profession I love, in

collaboration with smart, talented, passionate, and committed colleagues.

From David White

My contributions to this work and this book would not have been possible with-

out the support, encouragement, and leadership of Rich Caralli and Bill Wilson.

They were both champions for changes in my career trajectory that led to my

involvement and success in this work; I am forever grateful. Rich’s knowledge of

the subject matter and vision for the model were ever present and provided the

necessary guidance for me and the team to reach this point. Julia Allen, my friend

and coauthor, was a very welcome addition to the team. I thank her for sharing

her knowledge and for being a source of inspiration, a sounding board, and a

really hard worker. I am thankful to Lisa Young for always being available when I

needed to talk through an issue with the model, for sharing her encyclopedic

knowledge of practice bodies, for partnering with me on the first appraisal, and

for her constant friendship and support. Pamela Curtis has been exacting and

thorough in helping us with language consistency, in finding and resolving loose

ends, and in working hard to drive this model to completion; thank you, Pamela.

Charles Wallen’s vision and tireless advocacy for this work and its importance to

the financial sector were critically important to our early outreach activities and

to engaging the first users of the model. At the U.S. Environmental Protection

Agency, Johnny Davis provided the leadership and vision that enabled our suc-

cessful first RMM appraisal. The appraisal team was tireless and tenacious in pro-

ducing sound and beneficial results; I thank my fellow appraisal team members

Kimberly Farmer, Steve Masters, and Lisa Young. Lockheed Martin Corporation

supported an RMM pilot to evaluate the model for its use. The pilot and its suc-

cess were made possible by the leadership and vision of Nader Mehravari, the

tenacity and support of Joan Weszka, the appraisal process knowledge and skills

of Michael Freeman, the site knowledge and hard work of Eric Jones, and the

exacting and thorough preparation by Doug Stopper. I also thank Nader and his

team for sharing their brilliant insights about the model and its use in a large

organization. There are many other people who could be named here; I am fortu-

nate to have worked with many great people in pursuit of this work.

PART ONE

About the CERT Resilience

Management Model

2 PART ONE ABOUT THE CERT RESILIENCE MANAGEMENT MODEL

Organizations in every sector—industry, government, and academia—face increasingly

complex business and operational environments. They are constantly bombarded

with conditions and events that can introduce stress and uncertainty that may disrupt

the effective operation of the organization.

Stress related to managing operational resilience—the ability of the organization

to achieve its mission even under degraded circumstances—can come from many

sources. For example:

• Technological advances are helping organizations to automate business processes and

make them more effective at achieving their missions. But the cost to organizations is

that the technology often introduces complexities, takes specialized support and

resources, and creates an environment that is rife with vulnerabilities and risks.

• Organizations increasingly depend on partnerships to achieve their mission. Exter-

nal partners provide essential skills and functions, with the aim of increasing pro-

ductivity and reducing costs. As a result, the organization must expose itself to new

risk environments. By employing a chain of partners to execute a business process,

the organization cedes control of mission assurance in exchange for cost savings.

• The increasing globalization of organizations and their supply chains poses a prob-

lem for management in that governance and oversight must cross organizational

and geographical lines like never before. And it must be acknowledged that the

emerging worldwide sociopolitical environment is forcing organizations to consider

threats and risks that have previously not been on their radar screens. Recent

well-publicized events have changed the view of what is feasible and has

expanded the range of outcomes that an organization must attempt to prevent

and from which it must be prepared to recover.

All of these new demands conspire to force organizations to rethink how they

perform operational risk management and how they address the resilience of

high-value business services and processes. The traditional, and typically com-

partmentalized, disciplines of security, business continuity, and information tech-

nology (IT) operations must be expanded to provide protection and continuity

strategies for high-value services and supporting assets that are commensurate

with these new operating complexities.

In addition, organizations lack a reliable means to answer the question, “How

resilient am I?” They also lack the ability to assess and measure their capability for

managing operational resilience (“Am I resilient enough?”) as they have no credi-

ble yardstick against which to measure. Typically, capability is measured by the

way that an organization has performed during an event or is described in vague

terms that cannot be measured. For example, when organizations are asked to

describe how well they are managing resilience, they typically characterize success

in terms of what hasn’t happened: “We haven’t been attacked, so we must be doing

everything right.” Because there will always be new and emerging threats, knowing

PART ONE ABOUT THE CERT RESILIENCE MANAGEMENT MODEL 3

how well the organization performs today is necessary but not sufficient; it is

more important to be able to predict how it will perform in the future when the

risk environment changes.

CERT recognizes that organizations face challenges in managing operational

resilience in complex environments. The solution to addressing these challenges

must have several dimensions. First and foremost, it must consider that the man-

agement activities for security, business continuity, and IT operations—typical

operational risk management activities—are converging toward a continuum of

practices that are focused on managing operational resilience. Second, the solu-

tion must address the issues of measurement and metrics, providing a reliable and

objective means for assessing capability and a basis for improving processes. And

finally, the solution must help organizations improve deficient processes—to reli-

ably close gaps that ultimately translate into weaknesses that diminish operational

resilience and impact an organization’s ability to achieve its strategic objectives.

As a process improvement model, the CERT Resilience Management Model seeks

to allow organizations to use a process definition as a benchmark for identifying the

current level of organizational capability, setting an appropriate and attainable desired

target for performance, measuring the gap between current performance and targeted

performance, and developing action plans to close the gap. By using the model’s

process definition as a foundation, the organization can obtain an objective character-

ization of performance not only against a base set of functional practices but also

against practices that indicate successively increasing levels of capability.

Do You Need CERT-RMM?

The use of models for process improvement is common throughout the world.

Models for improving manufacturing processes are typically the most recogniza-

ble, but models such as CMMI are widely adopted across a range of industries.

All organizations have some type of operational element—they may produce

software or cars or deliver consulting services, but they all share the need to carry

out functions that directly and indirectly support their mission on a daily basis.

Regardless of what is being produced or what service is being delivered, manag-

ing operations that are critical for day-to-day and long-term success is what many

people in organizations are charged to do. What makes this so challenging?

Do You Have These Common Problems?

Many organizations accept that with operations comes operational risk. They see

it as an unpleasant by-product of doing business, and perhaps as something they

can’t do anything about. But according to Towers Perrin, operational risk has

been identified as the most important category of risk facing executives today

[van Opstal 2007].

4 PART ONE ABOUT THE CERT RESILIENCE MANAGEMENT MODEL

For security and continuity professionals, operational risk is our playing field.

Much of what we do on a daily basis is directly focused on avoiding or mitigating

operational risk even though the tasks we perform might not appear at first

glance to be risk management activities.

The way that security and continuity management has evolved in organiza-

tions has resulted in inefficiencies that have become commonly acceptable limi-

tations on success. For example, do any of the following conditions exist in your

organization?

• Security and continuity activities are compartmentalized and lack coordination

toward common goals.

• Budgets for security and continuity activities are typically held by IT.

• There is no governance over the security and continuity activities.

• Risk appetite of higher-level management is not considered in security and

continuity activities.

• Processes for security and continuity management are not defined and

managed.

• Technology drives security and continuity management solutions rather than

a layered approach of people, procedures, tools, and technologies.

• Work related to security and continuity management is not planned or tracked.

• Performance of staff during times of disruption depends on conditions and the

heroic efforts of smart people, or the ability to repeat effective behaviors is

questionable.

• The impact of a disruption on the organization is difficult to predict based on past

performance.

• Many codes of practice are used, but the effectiveness of these practices is not

measured, nor is redundancy in these practices identified and eliminated.

• Compliance activities take an inordinate amount of staff time and resources

but do not advance the state of the organization’s security and continuity

practice.

The list can go on and on. However, all of these conditions indicate the lack of

a systematic approach to managing operational risk that is typically characterized

by silos, lack of coordination and collaboration, ad hoc processes, unknown

and unpredictable outcomes, and heroics: working longer and harder, lowering

expectations, throwing more resources at problems, cutting corners, and

depending on the right people to be available at the right time. Unfortunately,

disruption doesn’t really adapt to our management shortcomings; instead, it

exploits them.

PART ONE ABOUT THE CERT RESILIENCE MANAGEMENT MODEL 5

How Does CERT-RMM Help You Solve These Problems and Benefit

Your Organization?

While the intention of developing CERT-RMM was initially to produce a model

in the likeness of CMMI that could be used for model-based process improve-

ment, there is a broad range of uses for the model that address many of the chal-

lenges listed above.

CERT-RMM helps you manage your way through changing risk conditions by

focusing on stabilizing operational resilience processes and meeting resilience

objectives. It uses a process orientation as a way to “glue together” people, proce-

dures and methods, and tools, equipment, and technology—all important ele-

ments in managing operational resilience. And CERT-RMM’s focus on continuous

process improvement supports an organizational reality: operational resilience is

never achieved—it must be continually managed.

Whether you use CERT-RMM as a process improvement model or just as a

starting point for renovating and rejuvenating your resilience program, you may

find many side benefits:

• You can realize the benefits of a convergent view. When operational risk is man-

aged in organizational silos, the benefits to the organization are suboptimal. Silos

allow for different (and sometimes divergent) risk processes, risk definitions, and

risk measurement criteria, all of which can dramatically reduce the organization’s

overall ability to identify and address operational risks. Convergence ensures that

all operational risk management activities are coordinated, aligned with organiza-

tional drivers, and free from the artificial constraints that impact effectiveness (in

other words, optimal).

• You can make your security and continuity practices work better. CERT-RMM

doesn’t replace your administrative, technical, or physical security and sustain-

ment practices. Instead, it provides a framework that the organization can use to

ensure that these practices are producing results, are efficient, and support

operational resilience objectives.

• You can measure progress. Because CERT-RMM is a process improvement model, a

new world of measurement capabilities is provided to security and continuity practi-

tioners. Processes such as incident management can be measured directly to know

when they are working, when they are failing, and what gaps should be closed. In

addition, the process orientation of the model provides opportunities to measure

performance so that an organization can determine that it is getting benefits from its

investment in security and continuity activities.

• You can more confidently characterize your operational resilience management

posture. In our complex world, it is no longer acceptable to characterize

6 PART ONE ABOUT THE CERT RESILIENCE MANAGEMENT MODEL

operational resilience in terms of events and outcomes that haven’t happened.

An organization needs to be able to understand its capability for managing

operational resilience so that it has some degree of predictability about how it

will perform during times of stress. The capability levels in CERT-RMM give an

organization a way to characterize their competency and their ability to sustain

good behaviors in bad times.

• You can determine where to allocate your limited resources. Legacy budgeting

processes simply aren’t effective for addressing the allocation of resources to

operational resilience activities. These processes tend to be tied to organizational

structures (such as IT controlling the “security” budget) that artificially limit the

ability to fund and account for all of the organization’s activities that are involved

in managing operational resilience. CERT-RMM provides not only a process for

formalizing resilience budgeting and accounting but also a broad view of all of the

operational resilience capabilities that need resources.

• You can convert from a compliance mind-set to an improvement mind-set.

Compliance activities divert the organization’s attention away from its goals and

toward the act of complying. However, the ability to comply with various laws,

regulations, and obligations should be an outcome of effective operational

resilience management processes. In addition, the act of compliance can often give

the organization a false sense of capability—many organizations are “in compli-

ance” with a code of practice or an industry regulation yet have a significantly

diminished ability to manage during stressful times. An improvement mind-set

focuses on ensuring the work products of operational resilience management

processes are being created through planned and executed work. These work

products can typically be used to satisfy the range of compliance requests and

concurrently improve the organization’s ability to be operationally resilient.