Client: Central Administrative Agency A (category: administrative agency)
Project Period: Performed over 3 months in 2014
Project Background and Topic
The client is a central administrative agency with the role and responsibility of supervising security across numerous affiliated and subordinate organizations.
Because it is the representative central administrative agency in its field, it is also subject to the supervision and regulations of various related authorities covering not only security but also personal information protection.
The client therefore commissioned the project primarily to establish a comprehensive master plan for its information security framework, so that it could respond flexibly to various security oversight requirements and related regulations.
The main scope requested by the client falls into the following two areas.
– Establishment of a mid- to long-term information security master plan (environment analysis, definition of the information security strategy and framework, and development of an implementation plan for the strategic initiatives)
– Other requested tasks (development of a status inspection for affiliated and subordinate organizations, development of a security-management status inspection for IT service projects, and establishment of a foundation for Information Security Management System (ISMS) certification)
IT and Information Security Environment
Business and IT Environment
The client is a central administrative agency that moved to the Sejong Government Complex several years ago, and it has the role and responsibility of managing and supervising numerous affiliated and subordinate organizations. Compared with other central government ministries, its dependence on IT is relatively low. From the standpoint of a central government ministry, however, it must also establish policy standards for security issues related to new topics such as mobile administration, the cloud, and big data, and present those standards to its affiliated and subordinate organizations. As with most administrative agencies, critical information systems are operated under contract by the Government Integrated Data Center, and some affiliated and subordinate organizations operate their own citizen-facing services. The IT systems the client operates itself are mainly internal business systems and systems for managing affiliated and subordinate organizations. They are housed in the client’s own computer room and operated under integrated outsourcing.
Information Protection Environment
The information security policy reflects the policies of the National Intelligence Service, which oversees the related functions, and of the central government ministries, and the agency has established and operates its own information security policy. As with most public and administrative agencies, however, parts of it lack practicality and the implementation rate is low, although the agency is continuously reinforcing specialist staff and developing manuals. The information security organization reduces the cost burden by employing contract staff in addition to regular employees, and it has established contact arrangements with other specialist organizations to prepare for emergencies. Under the National Cyber Security Management Regulation, which accounts for the largest share of the information security budget, it maintains a continuous monitoring system through security monitoring services for numerous affiliated and subordinate organizations. The continuous security monitoring system for affiliated and subordinate organizations, the largest task from the standpoint of a central administrative agency, faces the need to expand its targets and scope gradually and to improve two-way communication, and systematization is underway.
Key Consulting Perspectives and Notable Points
- Application of a checklist that consolidates the related supervisory criteria
– As a central administrative agency, the client is subject to various forms of supervision, including status assessments, from the competent administrative agencies responsible for security, including the National Intelligence Service and the Ministry of Security and Public Administration. Many of the detailed requirements overlap.
– A checklist for the current-state analysis was therefore developed by consolidating these supervisory regulations and then applied. It was used both to analyze the current state from multiple perspectives and as a simulation of the effect of carrying out the mid- to long-term initiatives. - Practical current-state analysis through AS-WAS analysis together with AS-IS
– Because an AS-IS analysis alone is inherently limited in capturing the actual environment and current state, the AS-WAS for the most recent three years was analyzed as well.
– Reviewing the security budget, staffing structure, policy structure, and the results of security audits and status assessments of affiliated and subordinate organizations over the most recent three years identified actual capability and the characteristics of the implementation history.
– Understanding the AS-WAS in addition to the AS-IS made it possible, within a short period, to grasp the client’s information security environment and current state more realistically, and that understanding was reflected in more practical countermeasures. - Analysis of the capability and conditions for performing periodic work against the regulations
– Most public and administrative agencies share a common trait: they have guidelines and procedures in place, but those documents are not practical and therefore have limited usefulness.
– The security activities defined in the internal security regulations were therefore classified as work performed periodically, work performed on an ad hoc basis, and work performed when needed, and the degree of implementation was assessed.
– Identifying the implementation rate made it possible to determine why the rate was low, and those causes were reflected in the security countermeasures and the mid- to long-term initiatives. - Establishment of a mid- to long-term information security master plan
– Based on the current-state analysis, a candidate set of future information security initiatives the client should pursue was derived, and the final initiatives were selected after several review meetings with the people concerned.
– Initiative definitions were prepared to elaborate the initiatives, and the R&R, detailed implementation stages, and required budgets for carrying them out were defined.
– Priorities for the finally selected initiatives were set and adjusted through consultation based on importance (impact and urgency) and ease (environmental ease and cost ease).
– According to priority, the implementation roadmap and required budget were organized into short-, mid-, and long-term horizons, and the effects of implementation were simulated so that the security level could be raised step by step. - Performance of the three additional requested tasks
– Together with the mid- to long-term information security implementation plan, the three requested tasks identified current issues through analysis of related materials and interviews with the staff in charge, and solutions were established.
– The tasks of developing a status inspection for affiliated and subordinate organizations and developing a security-management status inspection for IT service projects were requested because of difficulties the staff faced in performing the work. Checklists and guides describing how to use them were produced so that the methods could be applied in day-to-day work as soon as possible.
- Sample deliverables: integrated checklist, phased roadmap and required budget, and simulation of mid- to long-term implementation results
