Building a Data Security Strategy¶

Ivor Padlock is Coco Pharmaceuticals' only security officer, responsible for both physical and IT security. He has a lot of experience of physical security, but no real IT background. When the fraud around the supplier database is detected, he engages Sidney Seeker, the fraud investigator helping with the case, as a security consultant. On the IT side, Ivor has been relying on Gary Geeke, who joined Coco Pharmaceuticals from college and has learnt IT systems management, and the security that goes with it, on the job. Gary has been a great help, but he is no security expert either.

Ivor invites Sidney Seeker, Gary Geeke and Lemmie Stage to a meeting to discuss the data security strategy. Lemmie and Gary describe their processes to secure the IT systems. They use certificates, a firewall and SSL on the internal network, along with strong passwords on administrative user accounts.

Sidney asks if the security of the systems has ever been tested, by an expert - or using advanced tools? The answer was "no".

Sidney explained that cyber attackers are using sophisticated tools that include AI to penetrate organizations and steal information. They have a lot of computing resources to pound an organization's systems, looking for vulnerabilities. They may also use social engineering (such as phishing) to get information from employees. Since cyber threats are not static, and evolve rapidly, it is necessary to perform regular audits and assessments to stay one step ahead of the threats by identifying and mitigating potential vulnerabilities before they can be exploited.

Ivor realizes that this is a serious situation. Coco Pharmaceuticals' future depends on taking care of its intellectual property and reputation. Both are at risk from cyber attacks. It needs to take steps to protect their data and ensure that it is safe and secure. He asks Sidney to help him build a briefing for the board to raise awareness of the situation and request further investment in IT security.

Both of those exposures are later recorded as entries in the governance team's risk register: theft of personalised treatment intellectual property, and ransomware disruption to manufacturing operations. Ivor owns them, and both are rated Critical.

Supporting the Data Security Strategy¶

A key finding of their analysis was that Ivor needed specialist help to monitor, test and improve the security of the IT systems, and Sidney recommends that the company employs more security staff. In typical Coco Pharmaceuticals style, they employ one new person: Simon Burr (known as Si to his friends) joins as Chief Information Security Officer (CISO), reporting to Ivor, who becomes the Chief Security Officer.

Choosing a framework¶

Si's first recommendation is that Coco Pharmaceuticals should not invent its own security program. The international standard for an information security management system (ISMS), ISO/IEC 27001:2022, already describes what a well-run security program does, and its Annex A provides a reference set of controls covering the organizational, people, physical and technological aspects of security. Building on the standard gives Ivor a structure that auditors, hospital partners and regulators already understand, and certification against it gives patients independent assurance that their data and the research behind their treatments is protected.

Ivor, Sidney and Si write the strategy together. They agree that it should not stand alone: the governance leaders have already defined the Cyber Resilience business imperative, the Cyber-Attack on Operations or Data threat, and the obligation that All Users Must Be Authenticated and Accountable. The new definitions respond to those drivers rather than restating them, so that the security program is visibly part of the company's wider governance.

The security governance definitions¶

The strategy is captured as a set of governance definitions in the Security governance domain.

Each new policy is linked back to the driver it responds to, and each control to the policy it implements. For example, the supplier obligation answers the threat's implication that "data shared with external partners must be governed by agreements and monitored", and the incident obligation answers the implication that "incident response procedures must exist and be tested regularly". Every definition is also added to Ivor's Chief Security Officer governance folio, so that he has a single view of everything he is accountable for. The definitions that Si operates day to day - the ISMS cycle, the certification, the metrics and the critical cyber security risks - are also collected in Si's own Chief Information Security Officer folio.

Baking security into the business¶

When Ivor presents the strategy to the other governance leaders, it becomes clear that very little of it can be delivered by the security team alone.

• The asset inventory that the ISMS depends on is, in practice, the same list of systems that Gary Geeke maintains for IT infrastructure. The security team cannot patch, monitor or scope an estate it cannot enumerate. Rather than build a second inventory, Ivor and Gary agree that the systems inventory and the ISMS asset inventory are the same enumeration seen from two angles, and that it will be maintained once - in Egeria. This makes improving IT systems governance a precondition for security governance, and turns Gary into one of Ivor's most important collaborators.
• The classification obligation has to dovetail with Faith Broker's classification of personal data.
• The supplier obligation depends on the corporate governance team knowing who the company's third parties are.
• Revoking the access of a leaver depends on human resources telling security that someone has left.
• The training obligation is delivered through the company-wide education program that the governance leaders are designing together. To support it, Si writes a security glossary with Ivor and Sidney, so that words such as threat, risk, vulnerability and incident mean the same thing to everyone.

In the governance team's language, Security is a systemic domain: it addresses issues that cut across the business, in service of the domains that own the business outcomes. The same is true of data governance, and the two programs are built in the same way - as obligations that other domains' work depends on, with the links between them maintained in open metadata. This is how security becomes part of the way Coco Pharmaceuticals works rather than a layer applied on top of it.

Next steps¶

With the strategy agreed, Si turns to assuring the security of the IT systems, and Gary's team continues cataloguing the IT infrastructure that the ISMS asset inventory rests on.

Raise an issue or comment below