Client: Government-Funded Institute A (category: public institution)
Project Period: Performed over 2 months in 2013
Project Background and Topic
The client is a government-funded institute. While under regular supervision by higher authorities, including the National Intelligence Service information security status assessment, the absence of a mid- to long-term information security plan was pointed out.
In addition to the supervisory regulations of the higher supervisory authority, the client recognized the need for an information security plan for internal management reasons as well, including securing a mid- to long-term blueprint, a phased information security roadmap, and budget.
Technical vulnerability assessments were performed semiannually by an external specialist firm, so matters of technical security were addressed by using those results.
IT and Information Security Environment
Business and IT Environment
The client is a government-funded institute established as a special corporation under a committee, and its main work is research, planning, and evaluation.
Most executives and staff, including the information security manager and the staff who also cover IT work, are highly skilled professionals. Although it is a public institution, the working environment aims to carry out work as efficiently as possible. Because it is a government-funded institute, many IT systems are its own, and there are also many systems whose operation has been entrusted by related organizations. Applying security policy is particularly difficult when the owner and the operator differ. Information systems are under integrated IT outsourcing, as at other public institutions of a similar size, so resident contractor staff and contract staff other than regular employees also perform the work.
Information Protection Environment
As at other government-funded institutes, the information security organization meets the minimum basic requirements, with the work divided among one CSO, one manager, and one practitioner. Policy and regulation documents are scaled to the organization: one document corresponding to the policy statement contains most of the basic content, and the remaining documents are operated lightly as manuals with a lower approval authority. Security solutions included those that public institutions are required to have, such as antivirus, harmful-site blocking, and media control. Issues managed in the field included the fact that network separation had not been implemented and that solutions in some areas had insufficient 64-bit coverage.
Master Plan Development
The arrangement for managing information security at the enterprise level was found to be partial and fragmented, so an enterprise information security framework was developed and a current-state analysis and a mid- to long-term information security plan were established.
Priorities for the future initiatives derived from the current-state analysis were set using only implementation difficulty and ripple effect (impact), so that the result would not become overly complex. For the detailed execution methods selected to carry out each initiative, an initiative definition was written comparing AS-IS and TO-BE so that the change resulting from pursuing the initiative would be visible. The execution method recorded how the initiative would be carried out in stages, how much budget would be required, which organization would be responsible, and what should be noted or considered during implementation. This summarized, for each initiative, what should be considered when the work is later commissioned. Where an initiative required a security solution and a physical architecture was difficult to design, a logical architecture (draft) was designed so that unnecessary work could be minimized when the initiative is later carried out.
Future initiatives were summarized in an overall initiative roadmap (Road map) and the required budget so that every initiative could be seen at a glance.
Project CSF
- Continuous communication with stakeholders from project start through completion, enabling an accurate current-state analysis and the selection and design of suitable initiatives in a short period
- For the selected initiatives, identification of relevant leading or exemplary cases in Korea and overseas, and design of an application approach suited to the client
- Design through to the logical or physical architecture where that is possible, as in an overall network redesign, so that unnecessary work is minimized when the initiative is later carried out
- Sufficient communication with stakeholders, including the organization responsible for each initiative, to build consensus on the initiatives
Key Activities and Deliverables
| Phase | Key Work Performed | Deliverables |
|---|---|---|
| IT and Security Status Review | – Review IT and security-related documents – Identify the higher supervisory authority and related laws and institutional requirements – Identify the informatization status (asset inventory and so on) – Identify the history of information security activities | – Execution Plan |
| Master Plan Development | – Develop and review initiative prototypes – Design short-, mid-, and long-term initiatives – Survey the budget required for each short-, mid-, and long-term initiative – Design the roadmap for short-, mid-, and long-term initiatives | – Information Security Master Plan |
| Identification of Exemplary and Leading Cases | – Identify leading and exemplary cases in Korea and overseas – Establish an approach for applying the exemplary cases that were surveyed | – Survey report on leading and exemplary cases in Korea and overseas |
- Sample deliverables: enterprise information security framework, initiative prioritization, and overall roadmap design
