Final Exercise: Part 2
Enterprise Security
Brian Marsh
11/12/07
 
Section 1: Risk Assessment
Introduction
	It has been a successful past two years for Personal Data Vault, Inc.  PDV’s customer base has grown rapidly, increasing ten-fold.  This drastic increase has caused PDV to potentially be exposed to new risks and vulnerabilities.  It is important to note that the previous risks and vulnerabilities described in the original risk assessment are still valid, however in addition to the aforementioned problems new threats must be identified and dealt with.  The purpose of this paper will be to describe the current vulnerabilities and threats that Personal Data Vault, Inc. is exposed to due to their large customer base and their current service offerings.  This paper will be organized into three main sections.  The first section will briefly recapitulate the previously described risks and threats that continue to be applicable to PDV’s current and future existence.  The following section will describe the various threats and vulnerabilities tied to various legal and civil guidelines as well as the laws that are applicable to PDV’s operation.  Lastly, potential vulnerabilities with PDV’s operations will be discussed, including both technical and non-technical threats.
Previous and Continuing Threats
Asdf
Vulnerabilities and Current Legal/Civil Guidelines
Asdf
Operational Risks: Technical
Asdf
Operation Risks: Non-Technical
Asdf
Summary
	In conclusion, the  

Threats:
Non-compliance… now with more things to comply with! SOX/SEC/ETC
Spoofing/spam email-IM-Video Conferencing to leech account info (more people know about us now, services reach broader scope, target pool increased = more exposure = more valuable target for h4x0r$)
Vulnerabilities:


Section 2: Information Safeguard and Confidentiality Requirements

Section 3: Data Retention Policy
Preamble
It is necessary for every company to have a valid and applicable data retention policy.  A properly conceived and deployed policy can aid in reducing litigation, protecting trade secrets, as well as offer a means for defending the company against legal attacks.  A proper Data Retention Policy also helps avoid various penalties (criminal, financial, and civil) arising from improper data management.  It is important to distinguish individual requirements for differing types of data to ensure a properly applied data retention policy.  By doing so, each individual data object can be assessed and correctly be assigned a timetable for destruction - be it a document, a worksheet, or a report.  The following sections outline the key fundamental requirements for Personal Data Vault, Inc.’s data retention policy.  Each provision contains three sections.  The first gives a brief description of what type of data the provision addresses.  Next, a section outlining the timeline is provided to establish when data can be safely disposed.  Third, any applicable laws or guidelines are cited, lending credence to the provision.
Provision 1: Legal Documentation
Provision 1.1: Audit Documentation
Provision 2: Electronic Documentation
Provision 2.1: Email
Provision 2.2: Documents
Provision 3: Data Vault
Provision 4: Accounting
Provision 5: Investment Services
Exceptions

Section 4: Security Governance
In light of recent and projected changes at Personal Data Vault, Inc. – hereafter referred to as PDV – the previously described Security Governance Structure must be revisited and adjusted to meet the ever changing needs of the company.  The previous organization structure is for the most part still valid (Figure 1).  However some slight adjustments must be made to properly address the growing needs of PDV.  This document will describe the two main addendums necessary to change the existing security governance structure to make it applicable to PDV’s current and future needs.
Figure 1:  Existing Security Governance Structure Hierarchy
 
The first adjustment to the existing security governance structure is in response to the increased legal responsibilities of PDV.  The inclusion of legal aid has previously been a strictly cursory addition to the ISC and ITSC committees.  Only when legal gray areas or specific policy proposals dealt directly with issues covered by litigation were the company lawyers consulted.  This may have been appropriate for a private company’s first attempt at security governance structure; however in light of PDV becoming publically traded and PDV’s expansion into the investment, legal, and accounting services, this level of the legal department integration is not sufficient.  The current changes at PDV demand a more active inclusion of legal aid into not only the ISC and the ITSC, but also each individual department at PDV – including the SSD and the PSD.
The first area in which legal aid will be used is in each individual department.  Questions regarding legal action can come from human resources, sales, PDV’s technical services departments, or any other departments at PDV.  In the revised Security Governance Structure at PDV, a representative from PDV’s legal department will be assigned as a liaison for each department, accessible through the department head, or via direct contact if the situation warrants direct contact (i.e. whistle blowing).  Bi-monthly sessions will be held during which the department liaison attends an open luncheon – similar to the technical educational sessions held by the CSO, these sessions will offer the opportunity for everyone in the department to ask questions and learn about the legal issue de jour. The inclusion of a legal liaison for every department at PDV and the bi-monthly sessions will accomplish two goals.  First, it will provide a means for every employee to learn about legal issues specific to their department (i.e. human resources focus on legal issues such as Equal Employment Opportunity).  There will be an opportunity to discuss widespread legal issues at quarterly meetings to ensure a general level of understanding by all employees.  If any questions are not answered at these quarterly meetings, they may be raised at the bi-monthly luncheons.
In addition to the new legal department liaisons, technical advisors will be appointed to each department regardless of the department’s technically-oriented responsibilities.  These technical advisors will be equipped to address any technical questions by employees – either by providing PSD approved answers, referring the employee to the help desk, or by taking note of the question for future research.  The technical advisors will be positioned under the Policy and Standards Department and will report to a Chief Technical Advisor (CTA).  Questions that cannot be answered by the individual department technical advisors will be referred to the CTA.  Common issues can be related to the head of the PSD for review.  Significant problems such as improper policy application shall be addressed at weekly meetings between the head of the PSD and the CTA.  If the situation requires, the issue can be further escalated up the chain to the ISC or to the CSO.
The second area in which the legal department will integrate further into PDV’s operations is the technical support hierarchy.  Previously, legal aid was referenced in the ISC and ITSC only sporadically.  The revised security governance structure creates specific positions for legal aid on each committee.  These positions will be filled by experienced lawyers knowledgeable of all relevant law to each committee (information security specific for ISC, general information technology for ITSC).  Participants in both the ISC and the ITSC will be charged with educating their committees on relevant law and with aiding in policy/standards development and deployment.  In addition to participating in the ISC and ITSC committees, legal advisors will take part in the subsequent PSD and SSD reorganization (Figure 2).  Specifically, the PSD gains two distinct legal departments – one devoted to laws governing publicly traded institutions, and one focused on SEC rules/regulations.  This will allow PSD to be fully informed as they create the specific wording for policies and standards.  The legal presence in the PSD will also ensure that any legal questions by policy designers can be addressed quickly and accurately.
Figure 2: Revised Security Governance Structure Hierarchy
 
There will also be changes made to the previously established bi-quarterly conferences.  In light of the continued expansion, these conferences will be held every quarter, each focusing on the relationship between IT Security and one particular area – accounting, trading, and legal.  By targeting specific relations, attendance can be maintained while scaling to the ever increasing customer base.  These new conferences will maintain the original goals as the original conferences.  They will strive to educate the customers regarding security concerns of PDV in relation to their customer’s expectations and needs.  The emphasis will shift however to the actual effect of various policy and standards changes to PDV’s operation.  Whereas the previous motivation was to show customers how the changes would impact PDV, the motivation behind these newly redesigned conferences will be to relate how PDV policy and standards changes directly impact customer relations with other customers and with PDV.  This will ideally create a personal connection with the policies and aid in compliance among customers.
By implementing these proposed adjustments to the existing security governance structure, several improvements to PDV’s overall information security situation will follow.  Legal department liaisons and technical in each department regardless of their technological responsibilities (i.e. human resources, sales, etc) will ensure that any questions by employees can be either adequately answered or passed up the chain of command to be properly addressed.  The inclusion of representatives from PDV’s legal department to the ITSC and the ISC will enable both committees to make better informed decisions, gradually leading to a complete rework of existing security policy implementation. The end result is a balanced security approach as well as a proper information security governance structure for current and future PDV operations.
Section 5: Data Breach Contingency Plan
PDV currently has clients in all 50 of the United States.  As a result, the legal obligations regarding data breaches are varied.  To ensure compliance with all legal requirements, it is in PDV’s best interest to use the state with the most stringent legal guidelines as good practice for the remaining 49 states. 
Section 6: Congressional Report