1 Information Security Management Lifecycle of the supplier s relation VS Gery Mollers Conseiller en Sécurité du Système d Information
2 SUPPLIER GOVERNANCE Why? Undiable Partner for Infor. System Maintenance & Evolution Goal : Maintain Appropriate Level of Information Security How? Challenge his security maturity behaviour Security Measurements Audit & Test & Control
3 SUPPLIER GOVERNANCE Feedback by example
4 SUPPLIER GOVERNANCE Termination Prospecting Operational Production Selection Implemen- tation Negotiation Agreement
5 Example 1 : Prospecting A Crazy Presentation
6 SUPPLIER GOVERNANCE Termination Prospecting Operational Production Selection Implemen- tation Negotiation Agreement
7 Example 2 : Product Selection and Negotiation A Crazy Solution I have a dream? IT committee Agreement Purchase Team implication Standard Security Requirements +
8 Selection Define, Analyze & Evaluate Vade-mecum for Project Team Information Security Committee Agreement
9 SUPPLIER GOVERNANCE Termination Prospecting Operational Production Selection Implemen tation Negotiation Agreement
10 Example 3 : Agreements A Crazy Contract Review Terms and conditions
11 Before : Certification Requirements E.U. Certification ENV 12924, 13606 CE medical label National agreement etic charter USA Certification HIPAA FDA 21 part 11 + EU Data Protection Compliance For example : Safe Harbor Certification (USA)
12 Review of contract and of procedure: Specific terms and conditions Confidentiality agreement Appropriate SLA Business goal 7/7 24/24 Define Organisational Procedure Responasbility of each stakeholder U.E. & Belgian Law + Belgian regulation Termination responsabilities A REMINDER - UN «PENSE-BÊTE»
13 SUPPLIER GOVERNANCE Termination Prospecting Operational Production Selection Implemen- tation Agreement Negotiation
14 Example 4 : implementation Developping your own guidelines : Prior to a correct integration NO exotic implementation : Define our Standard Architecture NO exotic management : Define our Standard Procedures Apply Access Control Policy Support and Technical review Documentation SECURE ASSET REGISTRATION PROCESS Security Audit session (CONTROL & TEST) GO / NO GO
15 SUPPLIER GOVERNANCE Termination Prospecting Operational Production Selection Implemen- tation Negotiation Agreement
16 Example 5 : Operational Oh My God «eat your dust» SLA + Change of request Procedure Test, Validation, Prod. environmt Internal & remote access control
17 Implementation / operational process Manage the change Assure Functional & Technical & Security Test Test, validation, production environment fiability, response time, portability, maintenability Code inspection, performance test, stress test Logfile inspection Incident : To be informed Workaround vs Approuved Solution Always Documented Report Actions plans
18 SUPPLIER GOVERNANCE Termination Prospecting Operational Production Selection Implemen- tation Negotiation Agreement
19 Example 6 : Termination Where is «my» equipment? Where is «my» database? Asset declaration + CMDB Restitution Clause Reversibility Clause Separate Agreement Certificate of Destruction
20 SUPPLIER GOVERNANCE Termination Prospecting Operational Production Selection Implemen- tation Negotiation Agreement
21 CONCLUSIONS
22 CONCLUSION : Supplier governance ONE WORD : CHALLENGE Stronger and complete Information security approach Target : Each solution = a secure asset Confidentiality Integrity Availability Security agreement Separation certificate Access control policy Identity access managnt Cryptographic control Non-repudiation mechanism Code without malicious code safe programming approach Control correct processing Integraty, realibity record data state check for each workflow event Secure architecture Perform response time Backup/Restore Procedure DRP procedure Event management Incident Monitoring Audit trail & log I/O validation SLA Procedure
23 Lifecycle of the supplier s relation ISMS : manage third party Stronger & Systematic Approach Supplier Governance LIFECYCLE OF SUPPLIER RELATION Business goals IT_related goals Security goals Before: Security Requirements During : Regulary Audit & Control After : Secure remove Project Mangt Include I.S. approach - Organization - Technology - Business process Manage Change-request Incident Review & close relation Goal : Maintain Appropriate Level of Information Security