Client: Organization A (classification: an agency under the Ministry of Science, ICT and Future Planning)
Project period: four months in 2015
Project Background and Topic
Compared with other organizations, the client introduced an integrated security monitoring system based on an ESM system at a relatively early point, in 2003. Over about 13 years of security monitoring operations, there were issues such as advancement and upgrades of the security monitoring system and relocation of the workplace to a regional area. About 29 kinds of security systems had been introduced under various security policies and guides, and the need to establish an efficient operating approach for them was raised.
The client also came to consider a future strategic direction from various perspectives, including technical and managerial ones, in order to overcome the limits of the existing intrusion-detection approach. The need was also raised for a comprehensive, forward-looking direction that could respond to changes in security monitoring technology, including big data, artificial intelligence, and machine learning, which have been widely discussed recently.
IT and Information Security Environment
Business and IT Environment
The client is an agency under the Ministry of Science, ICT and Future Planning, and its main business consists of financial services, postal services, and office administration. As both a public institution and a financial institution, it had the business characteristic that every related law and regulation applicable in that dual capacity had to be applied. The client is divided into a headquarters responsible for overall and comprehensive policy and planning for information security and personal information protection, and a security monitoring center responsible for security monitoring and operations.
Because the subject of this consulting engagement is the cyber security center, the environment also requires compliance with the National Cyber Security Management Regulation and the related regulations of the parent organization. Securing in-house professional staff for the information security function remains a difficult challenge because the workplace was relocated to a regional area several years earlier. Major IT services are outsourced as system management (SM) work, and the security monitoring center is also operated under a long-term consignment of two or three years to a specialized security monitoring company. Periodic vulnerability assessments are regularly outsourced for work designated as critical information and communications infrastructure and for non-infrastructure systems.
Main Consulting Topics
Aiming to prepare an efficient and systematic security monitoring approach, including consolidation of heterogeneous information protection systems, to strengthen security monitoring by applying the latest technologies such as big data, and to prepare measures to strengthen the information protection organization, the client selected the three main topics below and presented a total of nine detailed requirements.
- Prepare an efficient operating approach, including functional improvement (or restructuring) of information protection systems
– Analysis of leading cases in the operation of information protection systems and a strategic direction
– Analysis of the current state of information protection systems and a restructuring plan
– An efficient operating approach for maintenance of information protection systems - Prepare a forward-looking security monitoring operating strategy
– Current status and trend analysis of security monitoring technology in the public sector and the private sector (finance)
– Trend analysis of forward-looking security monitoring technology and an adoption plan - Prepare an efficient operating approach for the information protection framework, organization, and workforce
– A plan for information security work, organization, and staffing in line with carrying out tasks 1 and 2 above
Main Consulting Process and Notable Points
Information security ISP consulting engagements generally share several characteristics, and this engagement also had to take those common points into account.
- The current state and problems must be identified on a clear basis
– The current state and problems recognized by the client are generally not grounded in accurate data.
– A problem that has been identified may not be a problem depending on interests within the organization, so problems need to be raised on the basis of accurate data analysis.
– There is also the issue that long-term historical information covering three or five years must be analyzed as a time series in order to derive accurate data that stakeholders can accept.
– In particular, for the current state and initiatives related to the information protection budget and organizational realignment, the justification needs to be presented through long-term data analysis and the application of related laws and regulations.
– For issues where accurate data is difficult to prepare, validity also needs to be presented through leading cases, cases of similar organizations, or ROI analysis. - The positions of stakeholders need to be aligned
– Identifying the current state and deriving improvement tasks from the views of the consultant alone, or from only part of the client (for example, the information security operations organization), can easily fall into a dispute among stakeholders whose interests differ.
– Positions among stakeholders can also differ in the issues derived from the current-state analysis and in the selection of improvement tasks, so interviews or surveys across those stakeholders are essential. - The decision-maker’s comprehensive, overall views need to be understood
– Understanding what the decision-maker cares about plays an important role in designing the future strategy from the standpoint of comprehensive organizational management and mid- to long-term strategy.
– For an issue on which the decision-maker has expressed no view, it is also effective to use the result of aligning stakeholder positions or the result of analyzing outside experts’ opinions.
Based on these common points, the procedure for this consulting engagement was carried out in the four stages below.
| Execution Stage | Main Work Performed |
|---|---|
| Stage-1 Domestic and overseas environment analysis (trend and case analysis) | – How are the policies and technologies of the surrounding environment changing? – How are other organizations responding? |
| Stage-2 Internal current-state analysis | – What issues and problems exist in the current operation of information protection systems? – What issues and problems exist in the current operation of security monitoring? |
| Stage-3 SWOT analysis and derivation of improvement directions | – As a result of analyzing the environment and the current state, what tasks should be improved? – What is the basic strategy for deriving improvement measures? |
| Stage-4 Establishment of an implementation plan for improvement tasks | – What are the mid- to long-term improvement tasks by area? – What are the detailed tasks for carrying out the improvement tasks? |
Key Points by Execution Stage
- Key points of the domestic and overseas environment analysis stage
The following issues and implications were identified in domestic and overseas policy trends.
– Environmental change in which recent security incident cases and types related to the client’s business are changing
– Environmental change following amendments to the Cyber Security Center Operating Regulation of the parent organization, the Ministry of Science, ICT and Future Planning, the Personal Information Protection Act, and similar rules
– Several noteworthy cases were identified in the information security strategies of advanced countries, including the United States, the United Kingdom, and Japan.
– Visits were made to big-data-based security monitoring technologies already introduced at major domestic cyber security centers, and hidden difficulties and problems were identified.
– Cases were confirmed in which open source such as ELK, Spark, Kibana, and Logstash had been applied as technical elements of an SOC based on big data technology.
– CISCO OpenSOC and similar projects were identified as representative open source for implementing a big-data-based SOC, and as cases that can resolve problems that can arise from dependence on a particular vendor.
– As a technology strategy for avoiding the trap of big data, cases that applied AI technology, artificial intelligence technology, and machine learning technology to the SOC were also surveyed.
– From the results of this environment analysis, implications related to the issues of this engagement were derived and shared. - Key points of the internal current-state analysis stage
In the client’s internal environment analysis stage, the current state was analyzed in three areas (security monitoring, information protection system operations, and management and operations areas such as organization).
– In the security monitoring area, the targets and the status of security monitoring work were identified, and detailed operating records for the most recent three years were reviewed from the perspectives of cost, workforce operations, outsourcing, applied technology, and the cyber response system, in order to identify the current state and the problems.
– In the information protection system operations area, the current state and the problems were identified for system operating status, system performance, system architecture, and comparison with leading cases.
– In the operations management area, including organization, issues were identified from three years of data on the security organization, including the security monitoring center, and on policy and process. - Key points of the SWOT analysis and improvement-direction stage
Through SWOT analysis, the basic principles (Key Direction) for formulating strategy were derived, and the issues and problems identified in the domestic and overseas environment and the internal current state analyzed earlier were redefined into three areas.
– Using SWOT analysis, a general technique for formulating strategy, internal strengths and weaknesses were derived and external threats and opportunities were identified, and the basic principles for formulating strategy were established.
– These basic principles played an important role in establishing and selecting detailed initiatives and in setting purpose and direction.
– At this stage, a candidate list of initiatives was derived, summary definition documents were prepared, and they were refined through several rounds of discussion with stakeholders. - Key points of the improvement-task implementation planning stage
The initiatives selected through discussion with stakeholders in the previous stage were prioritized according to their attributes, taking cost-effectiveness, urgency, and the relationships among detailed tasks into account, and they were arranged into short-term, mid-term, and long-term groups.
– The initiatives selected through discussion with stakeholders were defined as 3 groups, 7 initiatives, and 28 detailed tasks.
– The selected detailed tasks were scored for cost-effectiveness and urgency on a five-point scale, relationships among the tasks were identified, and short-term, mid-term, and long-term initiatives were distinguished by priority.
– For each detailed task, a TO-BE design was prepared and the required budget was surveyed so that the total budget required at each stage could be calculated and reflected in the information protection budget.
– Some short-term tasks were ordered when this engagement was completed, reflecting the proposed initiatives.