Client: Evaluation Institute A (Business type: public institution)
Project period: Carried out for one year in 2013
Project background and subject
Most public institutions are in a position of being supervised by multiple higher-level agencies, and they also have difficulty securing information security budgets. The client, Evaluation Institute A, is likewise supervised by the National Intelligence Service and multiple higher-level agencies, and various guidelines related to information security are issued to it from time to time. In particular, the National Intelligence Service’s regular information security status inspections also affect the evaluation of the head of the institution, so from the institution’s standpoint those evaluation results are one of the major issues.
In this environment, Evaluation Institute A came to outsource information security activities such as regular security vulnerability assessments, penetration testing, quarterly information security and personal information protection training, and the enactment and amendment of policy guidelines.
IT and Information Security Environment
Business and IT environment
The client, first established in 1987, contributes to the advancement of science and technology by supporting the investigation, analysis, evaluation, coordination, and allocation of national research and development programs, enhancing improvement measures, and efficiently carrying out work related to international cooperation.
Most of the information systems operated by Evaluation Institute A are operated in its own computer room because of internal circumstances. Some systems are operated under consignment at the Government Integrated Data Center, and, because of limits on hiring in-house staff, part of IT operations is outsourced as a whole, with dedicated personnel stationed on site to support operations.
Information protection environment
Information security at Evaluation Institute A is organized as a standard public-institution information security structure. An Information Security Committee centered on the president and a working-level council are in place to approve and consult on information security budgets and to consult on and approve policies. However, meeting minutes can be confirmed only about once a year, and the dedicated information security staff, who serve concurrently in that role, report considerable difficulty even in carrying out only basic information security activities.
Most of the basic security solutions that a public institution should have are in place, but issues exist with several security solutions because of aging equipment and similar factors.
Project CSF
- Compare the before-and-after results of repeated penetration tests and vulnerability assessments, identify vulnerabilities that are found repeatedly, and prepare fundamental improvement measures
- Appropriate level management of evaluation results from higher supervisory agencies
- Improve the effectiveness of training by managing the history and training topics of repeatedly conducted awareness-raising training
- Establish an efficient change-management system through systematic history management of the enactment and amendment of Evaluation Institute A’s regulations and guidelines
Key Activities and Deliverables
| Phase | Key activities | Deliverables |
|---|---|---|
| Perform vulnerability assessment (twice a year) | – Existing information systems and, during each half of the year, information systems newly built, developed, or renewed are included in the scope – For servers/WAS/Web/DBMS/network/security systems, security vulnerability assessment (performed twice a year, in the first and second half) – Penetration testing of external-facing service websites (twice a year) | – Server/WAS/Web security assessment result report – DBMS security assessment result report – Network security assessment result report – Internal/external website penetration test result report |
| For employees information security and personal information protection awareness-raising training (4 times a year) | – Conduct information security training and evaluation in even-numbered quarters – Conduct personal information protection training and evaluation in odd-numbered quarters | – Training plan for each quarter – Training materials for each quarter – Training result evaluation for each quarter |
| Regular information security regulations and enactment and amendment of guidelines (once a year) | – Once-a-year regular information security and personal information protection enactment and amendment of regulations and guidelines – When changes arise under guidelines from higher supervisory agencies, enactment and amendment of the related regulations and guidelines | – Information security and personal information protection regulations and guidelines – Old-and-new comparison table of regulations and guidelines |
| Regular information security exercise and evaluation (once a year) | – Based on information security regulations and guidelines, once a year conduct and evaluate the exercise | – Information security exercise plan – Information security exercise result report |
| National Intelligence Service information security status survey support (once a year) | – Support the National Intelligence Service’s annual information security status survey – Perform advisory work on various issues that arise before and after the status survey | – Related advisory result report |