1 IT Risk Management in Government Jonathan Smith Sr. Risk Manager Commonwealth Security and Risk...

1www.vita.virginia.gov

IT Risk Management in Government

Jonathan SmithSr. Risk Manager

Commonwealth Security and Risk ManagementOctober 1, 2013

www.vita.virginia.gov 1

2www.vita.virginia.gov

Agenda• Introduction• Background

– Virginia Information Technologies Agency– Commonwealth Security and Risk Management– Information Security and Reporting

• Measuring Commonwealth Risk• Governance, Risk Management, and Compliance

Virginia Information Technologies Agency

• Statewide IT infrastructure for in-scope government entities

• Prior to VITA there were 90+ independent autonomous IT shops

• IT infrastructure partnership (Commonwealth of Virginia & Northrop Grumman)

• Appx. 58,000 PC’s, 3500 servers, 60,000 accounts, over 2000 circuits and 2 Data Centers

• Centralized oversight of IT projects, security, procurement, standards, policy and procedures

www.vita.virginia.gov

Commonwealth Security and Risk Management

Security Operations• Operations and architectural design

Security Governance• Policies, standards and procedures• IT security audit program• VITA ISO duties

Risk Management• Commonwealth Risk Management program• Business impact analysis• Risk assessments• IT security incident response

§ 2.2-2009

§ 2.2-2009. Additional duties of the CIO relating to security of government information.

C. The CIO shall annually report to the Governor, the Secretary, and General Assembly those executive branch and independent agencies and institutions of higher education that have not implemented acceptable policies, procedures, and standards to control unauthorized uses, intrusions, or other security threats. For any executive branch or independent agency or institution of higher education whose security audit results and plans for corrective action are unacceptable, the CIO shall report such results to (i) the Secretary, (ii) any other affected cabinet secretary, (iii) the Governor, and (iv) the Auditor of Public Accounts. Upon review of the security audit results in question, the CIO may take action to suspend the public body's information technology projects pursuant to § 2.2-2015, limit additional information technology investments pending acceptable corrective actions, and recommend to the Governor and Secretary any other appropriate actions.

The CIO shall also include in this report (a) results of security audits, including those state agencies, independent agencies, and institutions of higher education that have not implemented acceptable regulations, standards, policies, and guidelines to control unauthorized uses, intrusions, or other security threats and (b) the extent to which security standards and guidelines have been adopted by state agencies.

Annual Report on Information Security

Assessment of the Commonwealth information security program:•Legislative requirement beginning in 2008•CIO annually reports to the Governor, Cabinet Secretaries, and General Assembly on:

– Agency Information Security Programs– Agency Risk Management Programs– Agency IT Security Audit Programs– Commonwealth Operational Security– IT Security Incidents

Understanding Commonwealth Risk

• Business Impact Analysis:– Identify primary and critical organizational business

processes– Identify IT systems that those business processes rely on– Identify Recovery Time Objectives (RTO)– Identify Recover Point Objectives (RPO)– Rate the business process for Availability

• Impact on life, safety, legal requirements, regulations, customer service and sensitive data if the business process or IT systems supporting the process is unavailable.

• Risk Assessments:– Identify sensitivity of IT system(Confidentiality, integrity,

and/or availability)– Assess the implementation of controls– Identify threats and potential risks– Rate the risks– Determine the probability of threat occurrence– Determine the potential impact if the threat occurs– Identify mitigating controls– Determine and implement mitigating controls– Determine Residual Risk: Create findings and corrective

actions when residual risk is too high

Understanding Commonwealth Risk

• IT Security AuditsInternal Audit, APA Audit, External (contractor)– Identify security audit findings– Create corrective action/remediation plans for findings– Track the remediation of the findings until closed– Validate remediation

• Vulnerability Scanning• Operational findings

What have we learned from the Annual Report?

•IT Security and Audit resources are not adequate across the Commonwealth as a whole

•Agencies are not properly planning for information security requirements

• Unless agency executives understand the impact of the risk carried, decisions made could potentially result in adverse consequences

Next steps for CSRM

• Moving to a risk based information security program

• Currently implementing a Governance, Risk Management and Compliance (GRC) tool

• Make risk recommendations for where to invest resources across the Commonwealth

• Adhere to a set level of risk tolerance across the Commonwealth

How Does CSRM Measure Agency Risk?

• Risk levels are primarily based on findings– Can come from any source

• Security audit, risk assessment, operational data, etc.

• Finding criticality level is based on several factors, examples include:– Business processes criticality level– Confidentiality of the data– Criticality of the application affected– Likelihood of occurrence– Magnitude of impact– Length of time finding open

Governance, Risk Management and Compliance (GRC) ToolWhy GRC?• Integrate the existing IT Security programs &

processes into a single centralized tool• Provide a better understanding of the risks that

Commonwealth Agencies carry• Provide Agency and Commonwealth Executives

understanding of where resources should be allocated to manage risk

Governance, Risk Management and Compliance (GRC) ToolWhat is captured in the GRC tool?• Business Processes• Applications• IT Security Audit Program Information• Risk Assessments• Findings• Remediation Plans• IT Security Incidents• Security Exceptions

Additional Benefits of a GRC tool

• Advanced Reporting• Dashboards• IT Asset Inventory• Control & Policy Library• Questionnaires/Assessments

What will CSRM do with the tool?

• Enhance reporting capabilities– Identify agencies carrying too much risk– Monitor remediation of risk at agencies– Show progress of agencies remediating risk– Identify operational issues increasing agency risk

• Make recommendations based on risk– Recommendations to AITR, ISO, agency head,

secretary, and/or Commonwealth CIO– Can include recommendation to restrict IT

investments until acceptable remediation is in place, underway, planned, or complete

What Challenges Has CSRM Faced?

• Normalizing data– Data comes from multiple sources

• Agency ISO• Agency Internal Audit• Agency Information Technology Department• Infrastructure partnership• Other VITA data sets

• Agency “Buy-in”• User training

Questions?

Jonathan SmithSenior Risk ManagerCommonwealth Security and Risk ManagementVirginia Information Technologies Agency (VITA)Jonathan.M.Smith@Vita.Virginia.Gov CommonwealthSecurity@Vita.Virginia.Gov

1 IT Risk Management in Government Jonathan Smith Sr. Risk Manager Commonwealth Security and Risk...

Documents

Credit Risk Credit Risk Management System … Risk Credit Risk Management System Management System Management System ... the credit risk management systems of ... external auditors

Commonwealth Project Management using ProSight

A Report by the Government of the Commonwealth of … Disaster risk management DRR Disaster risk reduction DSS Dominica Social Security DSWMC Dominica Solid Waste Management Cooperation

Implementing total quality management in the Commonwealth

Risk Management - SBM Group · Risk Management Rodrigues • Key Highlights • Executive Summary • Risk Management Framework • Credit Risk Management • Market Risk Management

Risk Management Overview Risk Management Overview

The Commonwealth Human Resource Management · PDF fileThe Commonwealth Human Resource Management System: An Overview for Executives and Senior Level Managers

Commonwealth High School Crisis Management Plan

Degree 04 Financial Management - Commonwealth of Learning

‘RISKY BUSINESS’ An overview of the Commonwealth Risk Management Policy Mr Robert Antich Assistant Secretary Risk, Insurance and Special Claims Branch

Market Risk Management Market Risk Management … Market Risk Management Market Risk Management System System System ChecklistChecklist “Market risk” is the risk that a financial

Risk Management for Public Works - Risk Management User Manual · Risk Management for Public Works Risk Management User Manual ... Thus by implementing a systematic project risk management

Commonwealth Security and Risk Management

Risk Management (3C05/D22) Unit 3: Risk Management · 2004. 4. 29. · Risk-management planning Risk resolution [Boehm 1991] Risk monitoring Software risk management steps & techniques

Management Cloud Oracle Risk...Oracle Risk Management Cloud Securing Risk Management Chapter 1 Introduction 1 1 Introduction Overview of Risk Management Security In Risk Management

RISK MANAGEMENT CHARTER EN RISK MANAGEMENT & …...Risk Management charter and framework v0.9 dd 15-6-2017 Tilburg University Risk Management Charter and Risk Management & Internal

Hume Strengthening Risk Management Project Presentation.pdf · multi agency approaches to strengthen family violence risk management. ... Vic Govt & Commonwealth Govt Service Integration

GOVERNANCE, RISK MANAGEMENT, AND … Risk Manageme… · (GRC)? 3.1.2 Risk Management . GOVERNANCE, RISK MANAGEMENT, AND COMPLIANCE . GOVERNANCE, RISK MANAGEMENT, AND COMPLIANCE

Introduction to Risk Management. Agenda Meaning of Risk Management Objectives of Risk Management Steps in the Risk Management Process Benefits of Risk

National Standard for Environmental Risk …€¦ · Web viewNational Standard for Environmental Risk Management of Industrial Chemicals Discussion Paper is licensed by the Commonwealth