Aligning Security and Privacy Risks to the GoC Transformation

1
Aligning Security and Privacy Risks to the GoC
Transformation

• Presentation to
• Canada School of Public Service/Ecole de la
  fonction publique du Canada
• 18 November 2004

2
Agenda

• The GoC transformation
• Goals
• Reference Model (GSRM)
• What do I need to do?
• Aligning the Security framework to the Reference
  Model
• Case study with the security framework
• Advantages of aligning security assessments to
  the framework

3
The GoC Transformation

• Goals include
• Improving citizen-centered service delivery to
  better address the needs of Canadians through a
  coherent government-wide approach
• Aligning service delivery with government-wide
  accountability and management outcomes using
  performance measurement
• Reviewing costs and priorities to increase
  interdependencies/ efficiencies among Departments
  and Agencies.

Security and Privacy requirements should be
aligned with these changes through an integrated
Threat and Risk Assessment (TRA) framework.
4
New GoC-wide Policies for Security and Privacy
5
GoC Strategic Reference Model (GSRM)

• GoC-wide expenditure and management review by
  Treasury Board Secretariat (TBS).
• Business Transformation Enablement Program (BTEP)
  includes business problem assessment, vision,
  strategy, design, business case, implementation,
  and alignment assessments.
• GoC Strategic Reference Model (GSRM) is the BTEP
  tool, which includes a set of business models
  using a consistent approach to assure alignment
  of GoC programs and services
• with explicit accountability for outputs and
  outcomes,
• supported by explicit performance measurement
  tied to achieving desired outcomes.

6
BTEP Design Goals

• Consistent outcomes standardized design for
  common business processes across the GoC where
  appropriate
• Move towards smart data more intelligent data
  definition and management (interoperability,
  privacy, security, sharing, expiry, etc.)
• Shared governance of information stewardship
  across the GoC.

7
Framework for Understanding Business Process
Requirements
This is the US Federated Enterprise Architecture
Reference Model. TBS Enterprise Architecture
Framework will have a similar construct. Shadowed
area indicates the level at which sufficient
security and privacy information can be
formulated.

• Ref US Federal Enterprise Architecture Program
  Management Office

8
How will the GoC-wide Transformation Affect Me in
terms of Security? (Part 1)

• Savings through common services with the aim of
  reducing IM/IT costs.
• Common security services should also improve
  security effectiveness and efficiency
• Needs a high level of cooperation because it is
  allowing the Departments to work together.

9
How will the GoC-wide Transformation Affect Me in
terms of Security? (Part 2)

• GoC revitalization programs under BTEP using
  Reference Model (i.e., GSRM) tools
• Is re-defining security and privacy into business
  requirements for each program or service.
• TBS has just completed models of government-wide
  incident detection and response.

10
How do I Align Security with Transformation What
do I need to do?

• You need to
• Become fully familiar with the transformation and
  requirements
• Determine appropriate security requirements, and
  coordinate with stakeholders
• Ensure security controls are to the appropriate
  level of risk for all programs and services
• Take into account how security services affect
  others, across domains.

11
Lets Look More in Detail at the Security
Implications of GOC Transformations

12
Steps in Applying a Security Assessment to the
Reference Model Framework

• Top-Down review of assets in business context
• Who uses them for what?
• Evaluate how valuable, sensitive, and critical
  the assets are.
• Bottom-up assessment
• Evaluate what threats and vulnerabilities are
  subject to the assets
• Determine what controls and security measures are
  required.
• Ensure recommended controls match the business
  requirements.

 
Business Driven Approach (Citizen Centered Focus)
Validation of controls to context and conditions
13
Case Study with the Security Framework
This is a fictitious example and doe not reflect
the true security profile of the Canada Student
Loan Program
14
Case Study Doing a Security Assessment to this
Framework (Part 1)

• Student Loan Program example.
• Top-down review of the assets.
• Business drivers example
• Need to support users regardless of location and
  type of end-user (citizens, stakeholders and
  staff)
• Reduce potential liability for lack of due care
  in the protection of personal information
• Data concerns
• Need to support secure financial transactions
• You need to maintain the control and
  confidentiality of end-user citizens,
  stakeholders and staff

15
Case Study Doing a Security Assessment to this
Framework (Part 2)

• Security Services verification
• Assessment of the services for enrolment of
  citizens who are applying for loans
• We find that loan processing is decentralized and
  inconsistent
• Past incidents of improperly identified user
  populations and their association to resources.
• So what? In terms of impacts to services
  requirements
• Method of processing the loan applications may
  introduce fraudulently obtained loans.

16
Case Study Doing a Security Assessment to this
Framework (Part 3)

• Bottom-up Assessment and Verification to show
  relations among potential failure modes that
  could result in hazards.
• Technical level verification
• Assess of the method for identification and
  authentication among interrelated functions and
  applications
• We find a vulnerability that allows scenario of
  hijacking of users session by an intruder.
• So what? In terms of impact to business and
  technical requirements
• May disrupt activities of citizens who apply for
  loans,
• Personal information may be collected or altered
  permitting loss of personal privacy and
  unauthorized access to program data.

This is a fictitious example and does not reflect
the security vulnerabilities of the Canada
Student Loan Program
17
Advantages of Aligning Security Assessments to
this Framework

• Security and privacy controls have been assessed
  and verified objectively.
• Compared to policies for compliance.
• Ensures that controls are appropriate to the
  business context.

18
How can Security Assessments be Improved by the
Reference Model Approach?

• We need to improve the quality, effectiveness and
  efficiency.
• Keep the purpose of the survey to the business
  environment and system requirements.
• Consistent to Government policies, directives and
  standards.
• Consistent to the reference models (GSRM).
• Keep to the level and scope within the reference
  models.
• Re-useable results to a common set of metrics.
• Common threat and vulnerability information
• To defined security and privacy profiles.

19
Summary of Benefits

• Assessment method is
• Consistent to the business needs of the
  Departments.
• Maps to common services and business processes
  under BTEP.
• Formalized for processes and alignment to allow
  significant re-use.
• Savings (time, money, resources).
• Consistent and standard across GoC for security
  and privacy threat and vulnerability data.

20
Thank you!

• Questions????