University of The Cumberlands DGI Data Governance Framework Paper Chapter 10: From this chapter, in addition, the previous ones, we continue to enhance our

University of The Cumberlands DGI Data Governance Framework Paper Chapter 10: From this chapter, in addition, the previous ones, we continue to enhance our knowledge and understanding about IG best business practices, and how good data governance can ensure that downstream negative effects of poor data can be avoided and subsequent reports, analyses, and conclusions based on reliable, and trusted data could be achieved. From the risk management perspective, data governance is a critical activity that supports decision makers and can mean the difference between retaining a customer and losing one. On the same token, protecting your business data is protecting the lifeblood of your business, and improving the quality of the data will improve decision making, foster compliance efforts, and yield competitive advantages; thence business profits would be earned. To provide meaningful support to business owners, the Data Governance Institute has created a data governance framework, a visual model to help guide planning efforts and a logical structure for classifying, organizing, and communicating complex activities involved in making decisions about and taking action on enterprise data.
Q1: With this framework in mind that allows for a conceptual look at data governance processes, rules, and people requirements identify and name the 10 levels of the DGI Data Governance framework from the Data Governance Institute?
Chapter 11 – According to the authors, privacy and security go hand in hand; and hence, privacy cannot be protected without implementing proper security controls and technologies. Today, organizations must make not only reasonable efforts to offer protection of privacy of data, but also must go much further as privacy breaches are damaging to its customers, reputation, and potentially could put the company out of business. As we continue learning from our various professional areas of practice, its no doubt that breaches have become an increasing concern to many businesses and their future operations. Taking Cyberattacks proliferation of 2011 into context, security experts at Intel/McAfee discovered huge series of cyberattacks on the networks of 72 organizations globally, including the United Nations, governments and corporations.FILLER TEXT
Q2: From this research revelation in our chapter 11, briefly state and name the countries and organizations identified as the targeted victims? ITS 833 – INFORMATION
GOVERNANCE
Chapter 11 – Information Governance
Privacy and Security Functions
Dr. Geanie Asante
1
Copyright@Geanie Asante 2019
CHAPTER GOALS AND
OBJECTIVES
Things To Know:
Things to Know:
? Sources of Threats to protection of
data
? Solutions to threats to protection of
data
? Identify some privacy laws that apply
to securing an organization’s data
? What is meant by redaction
? What are the limitations on perimeter
security?
? What is IAM?
? What are the challenges of securing
confidential e-documents?
? What are the limitations on an
repository-based approach to
securing confidential e-documents?
? What are some solutions to securing
confidential e-documents?
? What is stream messaging?
? How is a digital signature different
from an electronic signature?
? What is DLP Technology?
? What are some basic DLP methods?
? What are some of the limitations of
DLP?
? What is IRM?
? What are some key characteristics or
requirements for effective IRM?
? What are some approaches to
security data once it leaves the
organization?
2
Copyright@Geanie Asante 2019
Cyberattack Proliferation
Who are the victims ?
?
Government
?
Corporations
?
Banks
?
Schools
?
Defense Contractors
?
Private Individuals
Who are the perpetrators?
? Foreign Governments
? Domestic and foreign businesses
? Individual Hackers/Hacking societies
? Insiders
3
Copyright@Geanie Asante 2019
INSIDER THREATS
Some malicious/some not malicious
Insider threats can be more costly than outside threats
?
Nearly 70% of employees have engaged in IP theft
?
Nearly 33% have taken customer contact information, databases
and customer data
?
Most employees send e-documents to their personal email
accounts
?
Nearly 60% of employees believe this is acceptable behavior
?
Thieves who are insiders feel they are somewhat entitled as
partial ownership because they created the documents or data
?
58% say the would take data from their company if terminated
and believe they could get away with it
4
Copyright@Geanie Asante 2019
SOLUTION?
?
Security – including document life cycle security
?
Risk Education
?
Employee Use Policy
?
IG Training and Education
?
Enforcement and Prosecution – Make an example!
?
Monitoring
5
Copyright@Geanie Asante 2019
PRIVACY LAW THAT MAY APPLY
?
Federal Wire Tapping Act
?
?
?
?
?
Prohibits the unauthorized interception and/or disclosure of wire, oral or
electronic communications
Electronic Communications Privacy Act of 1986
?
Amended Federal Wire Tapping Act
?
Included specifics on email privacy
Stored Communications and Transactional Records Act
?
Part of ECPA
?
Sometimes can be used to protect email and other internal
communications from discovery
Computer Fraud and Abuse Act
?
Crime to intentionally breach a “protected computer”
?
Used extensively in the banking industry for interstate commerce
Freedom of Information Act
?
Citizens ability to request government documents – sometimes redacted
6
Copyright@Geanie Asante 2019
LIMITATIONS ON SECURITY
“Traditional Security Techniques”
•
Perimeter Security
•
Firewalls
•
Passwords
•
Two-factor authentication
•
Identity verification
Limitations to traditional techniques
•
Limited effectiveness
•
Haphazard protections
•
Complexity
•
No direct protections
Security requires a change in thinking about security
•
Secure the document itself, in addition to traditional techniques that
secure “access” to the document
7
Copyright@Geanie Asante 2019
DEFENSE IN DEPTH
TECHNIQUES TO SECURITY
?
Use Multiple Layers of
Security Mechanisms
?
Firewall
?
Antivirus/antispyware
software
?
Identity and Access
Management (IAM)
?
What is IAM?
?
Goal is to prevent
unauthorized people
from accessing a system
?
Effective IAM included:
?
Auditing
?
Constant updating
?
Hierarchical passwords
?
Evolving roles
?
Intrusion Detection
?
Risk reduction
?
Biometric Verification
?
Physical Security
8
Copyright@Geanie Asante 2019
LIMITATIONS OF REPOSITORY-BASED
APPROACHES TO SECURITY
?
Traditionally, we have applied “repository-based”
solutions which have not been effective. We have
document repositories that reside in databases and
email servers behind a firewall.
?
Once Intruder breaches firewall and is inside the
network, they can legitimately access data
?
Knowledge workers tend to keep a copy of the
documents on their desktop, tablet, etc.
?
We operate in an Extended Enterprise of mobile and
global computing
comprising sensitive and
confidential information
9
Copyright@Geanie Asante 2019
SOLUTION?
Better technology for better enforcement in the extended
enterprise
Basic security for the Microsoft Windows Office Desktop-protection
of e-documents through password protection for Microsoft Office
files
Good idea but passwords can’t be retrieved if lost
Consider that “deleted” files actually aren’t.
Wipe the drive clean and completely erased to ensure that
confidential information is completely removed
Lock Down: Stop all external access to confidential documents.
Take computer off network and block use to ports
Secure Printing
Use software to delay printing to network printers until ready to
retrieve print
Erase sensitive print files once they have been utilized
?
?
?
?
?
?
?
?
?
?
10
Copyright@Geanie Asante 2019
SOLUTION (continued)
?
E-mail encryption
?
Encryption of desktop folders and e-docs
?
Use Stream messages when appropriate
?
Use of Digital Signatures —not the same thing as an electronic signature
?
Use Data Loss Prevention (DLP) software to ensure that sensitive data does not
exit through the firewall
?
(Three techniques for DLP-Scanning traffic for keywords or regular
expressions, classifying documents and content based upon predefined set,
and tainting) This method has weaknesses!
?
IRM Software/ERM Software-provides security to e-documents in any state
(persistent security)
11
Copyright@Geanie Asante 2019
SOLUTION (Continued)
?
Device Control Methods –example
blocking ports
?
Use of “thin clients”
?
Compliance requirements by different
organizations
?
Hybrid Approach: Combining DLP and
IRM technologies
12
Copyright@Geanie Asante 2019
More on IRM
?
Transparently – no user intervention required
?
Remote control of e-documents
?
Provides for file-level protection that travels with file even if
stolen
?
Includes cross-protection for different types of documents
?
Allows for creation and enforcement of policies governing access
and use of sensitive/confidential e-documents
?
Decentralized administration
?
Good IRM software provides useful audit trail
?
Integration with other enterprise systems
?
Provides embedded protection that allows the files to protect
themselves
?
Key Characteristics of IRM
?
Security
?
Transparency – can’t be more difficult to use than working with
unprotected documents
?
Easy to deploy and manage
13
Copyright@Geanie Asante 2019
SECURING DATA ONCE IT
LEAVES THE ORGANIZATION
?
?
?
?
?
REMEMBER – CONTROL DOES NOT REQUIRE
OWNERSHIP!
Consider new architecture where security is built
into the DNA of the network using 5 data security
design patterns
?
Thin Client
?
Thin Device-remotely wipe them
?
Protected Process
?
Protected Data
?
Eye in the Sky
Document Labeling
Document Analytics
Confidential Stream Messaging
14
Copyright@Geanie Asante 2019
THE END
15
Copyright@Geanie Asante 2019
ITS 833 – INFORMATION
GOVERNANCE
Chapter 10 – Information Governance and
Information Technology Functions
Dr. Geanie Asante
Copyright@Geanie Asante 2019
1
CHAPTER GOALS AND OBJECTIVES
?
?
Identify current trends that are considered
weaknesses in IT processes
Describe IG best practices in the area of IT
governance
?
Identify the foundational programs or areas
that support the IG efforts in IT
?
What is meant by data governance? How
does it differ from IT?
?
What would be the steps in implementing an
effective data governance program?
?
Who created the data governance
framework? Why?
?
What is information management? What are
its subcomponents?
?
What is master data management (MDM)?
?
What is information lifecycle management?
Copyright@Geanie Asante 2019
?
What is data modeling?
?
What are the different approaches to data
modeling?
?
What is the goal of IT governance?
?
Be able to identify or give examples of
several IT governance frameworks and tell
the distinguishing features of each
?
What is the ISACA organization and what is it
responsible for?
?
Who was responsible for creating ValIT?
2
Issues related to IT and IG
?
IT has not been held accountable for the output in its custody
IG BEST PRACTICES THAT ASSIST
IT IN DELIVERING BUSINESS
VALUE
?
Focus on the business impact instead of the technology itself
?
Customize IG approach for the specific business, applying industry
specific best practices where applicable
?
Tie IG to business objectives
?
Standardize the use of business terms
Copyright@Geanie Asante 2019
3
Programs that support IG effort in IT
?
Data Governance – Processes and controls that ensure information at the data level is
true, accurate, and unique.
?
Data Cleansing
?
De-duplication
?
Information quality
?
Master Data Management (MDM)
?
Accepted IT Standards and Best Practices
Copyright@Geanie Asante 2019
4
Steps to effective data governance
Recruit Strong Executive Sponsor – Not easy to do. Executive
management does not want to deal with minutia
Assess Current State – Where does data reside? What
problems are related to existing data
Set ideal state vision and strategy-Create realistic vision,
articulate business benefits, articulate measurable impact
Compute Data Value-compute how much value good data
can add to business unit
Assess Risks-Likelihood of potential data breaches? Cost of
potential data breaches
Copyright@Geanie Asante 2019
5
Steps to effective data governance…continued
Implement “going forward” strategy – provide a
clean starting point
Assign accountability for Data Quality to Business
Unit, not to IT – Push ownership and responsibility
to business unit that created the data
Manage the Change – Train and Educate as to why
and benefits
Monitor Data Governance Program – Look for
oversight, shortfalls and fine-tune
Copyright@Geanie Asante 2019
6
DATA GOVERNANCE INSTITUTE (DGI) FRAMEWORK
Copyright@Geanie Asante 2019
7
INFORMATION MANAGEMENT
?
Information Management is a principle function of IT
?
IM-application of management techniques to collect information,
communicate it within and outside the organization and process it to enable
managers to make quicker and better decisions.
?
Components of Information Management
?
Master Data Management (MDM)-Goal is to ensure reliable, accurate data from a
single source is leveraged across business units.
?
Information Lifecycle Management – Managing information appropriately and
optimally at different stages of its useful life
?
Data Architecture – Design of structured and unstructured information systems in
an effort to optimize data flow
?
Data Modeling-Illustrates the relationship between data
Copyright@Geanie Asante 2019
8
KEY STEPS FROM DATA MODELING TO
INTEGRATION
Copyright@Geanie Asante 2019
9
6 Approaches to data modeling
?
Conceptual data modeling – diagrams data relationships at the highest
level
?
Enterprise data modeling – business oriented approach that includes
requirements for the business or business unit
?
Logical data modeling – Illustrates the specific entities, attributes and
relationships involved in the business function
?
Physical data modeling – implementation of a logical data model
?
Data Integration – merges data from two or more sources, processing
data and moving it into a database
?
Reference data management modeling – refers to data in categories using
look up tables, categorizes data found in a database – often confused
with MDM
Copyright@Geanie Asante 2019
10
COMPARISONS OF DATA MODELS
Copyright@Geanie Asante 2019
11
COMPARISONS OF DATA MODELS
Copyright@Geanie Asante 2019
12
IT GOVERNANCE
?
Efficiency
?
Value Creation
?
Method by which stakeholders ensure that
investment in IT creates business value
?
Focus on software development’
?
Keep CEO and Board of Directors in the loop
Copyright@Geanie Asante 2019
13
IT GOVERNANCE FRAMEWORKS
?
CobiT®
?
ITIL
?
CobiT 5
?
ValIT®
?
ISO38500
Copyright@Geanie Asante 2019
14
ISACA
As an independent, nonprofit, global association, ISACA engages in the development, adoption and use of globally accepted, industryleading knowledge and practices for information systems. Previously known as the Information Systems Audit and Control
Association, ISACA now goes by its acronym only, to reflect the broad range of IT governance professionals it serves.
SACA got its start in 1967, when a small group of individuals with similar jobs—auditing controls in the computer systems that were
becoming increasingly critical to the operations of their organizations—sat down to discuss the need for a centralized source of
information and guidance in the field. In 1969, the group formalized, incorporating as the EDP Auditors Association. In 1976 the
association formed an education foundation to undertake large-scale research efforts to expand the knowledge and value of the IT
governance and control field. Previously known as the Information Systems Audit and Control Association®, ISACA now goes by its
acronym only, to reflect the broad range of IT governance professionals it serves.
Today, ISACA’s constituency—more than 140,000 strong worldwide—is characterized by its diversity. Constituents live and work in
more than 180 countries and cover a variety of professional IT-related positions—to name just a few, IS auditor, consultant, educator,
IS security professional, regulator, chief information officer and internal auditor. Some are new to the field, others are at middle
management levels and still others are in the most senior ranks. They work in nearly all industry categories, including financial and
banking, public accounting, government and the public sector, utilities and manufacturing. This diversity enables members to learn
from each other, and exchange widely divergent viewpoints on a variety of professional topics. It has long been considered one of
ISACA’s strengths.
Offers a number of certifications in:
Certified Information Systems Auditor
Certified in Risk and Information Systems Control
Certified Information Security Manager
Certified in the Governance of Enterprise IT
Cybersecurity NEXUS – CSX – Certificate and CSX-P Certification
(source: www.isaca.org)
Copyright@Geanie Asante 2019
15
COBIT
?
Control Objectives for Information and Related
Technology
?
Traditional Paradigm
?
Plan and Organize
?
Acquire and Implement
?
Is a process based IT Governance Framework
?
IT Governance Institute and ISACA
?
Deliver and Support
?
Strengths
?
Monitor and Evaluate
?
?
Cuts IT risks and gain business value from IT
?
Assists in meeting regulatory compliance requirements
?
Improved reporting and management
?
Improves IT and Information Asset Control
?
Detailed description of processed and tools
to measure progress
?
Broken into 3 organizational levels and
their responsibilities
Maps to the ISO 17799 and is compatible with ITIL
(Information Technology Infrastructure Library)
which are accepted practices in IT development and
operations
?
Copyright@Geanie Asante 2019
?
Board of Directors and Executive Management
?
IT and Business management
?
Line-level governance
4 IT Domains
?
34 IT processes
?
210 Control objects
16
COBIT FRAMEWORK
Copyright@Geanie Asante 2019
17
IT GOVERNANCE FRAMEWORKS-COBIT
5
Contains 7 categories of enablers
?
Released in 2012
?
Newest version of the business
framework for the governance of IT
from ISACA.
?
Expands on CobIT 4.1
?
Integrates other major frameworks,
standards and resources that are in
frequent use today
?
Comprised of 5 key principles for
governance and management of IT at
the enterprise (big business) level
?
Meeting Stockholder needs
?
Covers Enterprise end-to-end
?
Applies single integrated
framework
?
Enabling a holistic approach
?
Separates governance from
management
?
?
Principles, policies and frameworks
?
Processes
?
Organizational Structures
?
Culture, ethics and behavior
?
Information
?
Services, infrastructure and applications
?
People, skills and competencies
18
Copyright@Geanie Asante 2019
IT GOVERNANCE INSTITUTE
IT Governance Institute® The IT Governance Institute (ITGITM) (www.itgi.org) is a
non-profit, independent research entity that provides guidance for the global
business community on issues related to the governance of IT assets. ITGI was
established by the non-profit membership association ISACA in 1998 to help
ensure that IT delivers value and its risks are mitigated through alignment with
enterprise objectives, IT resources are properly allocated, and IT performance is
measured. ITGI developed Control Objectives for Information and related
Technology (COBIT®) and Val ITTM, and offers original research and case studies
to help enterprise leaders and boards of directors fulfil their IT governance
responsibilities and help IT professionals deliver value-adding services.
Source: https://www.isaca.org/Knowledge-Center/Val-IT-IT-Value-Delivery/Documents/Val-IT-Framework-2.0-Extract-Jul-2008.pdf
Copyright@Geanie Asante 2019
19
IT GOVERNANCE FRAMEWORKS VALIT®
?
?
?
?
?
?
Value-oriented framework
Complements CobiT
Focus on principles and best practices aimed at gaining maximum
value from IT investments
40 key ValIT management practices = CobiT control objectives
Includes 3 primary processes
?
Value Governance
?
Portfolio managemenet
?
Investment management
When integrated with CobiT 5:
?
Define relationships between IT and the responsible business functional
areas with governance responsibility
?
Manage an organization’s portfolio of It enabled business investments
?
Maximize the quality of business cases for IT enabled investment
Copyright@Geanie Asante 2019
20
IT GOVERNANCE FRAMEWORKS – ITIL
?
ITIL was created in the 1980’s by the UK governments CCTA (Central Computer and Telecommunications
Agency) with the objective of ensuring better use of IT services and resources.
?
The ITIL concept emerged in the 1980s, when the British government determined that the level of IT
service quality provided to them was not sufficient. The Central Computer and Telecommunications
Agency (CCTA), now called the Office of Government Commerce (OGC), was tasked with developing a
framework for efficient and financially responsible use of IT resources within the British government and
the private sector.
?
The earliest version of ITIL was actually originally called GITIM, Government Information Technology
Infrastructure Management. Obviously this was very different to the current ITIL, but conceptually very
similar, focusing around service support and delivery.
?
Large companies and government agencies in Europe adopted the framework very quickly in the early
1990s. ITIL was spreading far and, and was used in both government and non-government organizations. As
it grew in popularity, both in the UK and across the world, IT itself change…
Purchase answer to see full
attachment