Information Security Management Working in Iraq Bill Casti

Information Security Management Working in Iraq Bill Casti, CQA, SSCP, CISM, CISA, CITP, ITIL Foundations ASQ Section 0511 Northern Virginia 20 June 2007

Introduction • Position: Senior Advisor, IT Information Security Management, e. Government Services, Economic Governance II Project • What are all those letters? • CQA = ASQ Certified Quality Auditor • SSCP = ISACA Systems Security Certified Practitioner • CISA = ISC 2 Certified Information Systems Auditor • CISM = ISC 2 Certified Information Security Manager • CITP = British Computer Society Chartered IT Professional • ITIL Foundations = passed IT Infrastructure Library Foundations exam 2

Quality Management in Iraq • Short answer: There isn’t any. Longer answer: In order to build effective, consistent, repeatable, documented quality management, you need a stable infrastructure, and that’s not there in Iraq as a whole. • Quality Management for this presentation: This slide show has been quality-managed by me, but I can’t tell you much about quality management in the Government of Iraq…there’s no formal or informal system for that. Someday maybe, but not today. • Day 2 Day working environment in Iraq for regular workers: Their big issue is getting to and from work alive. QMS kind of takes a backseat to that. • 3

Econ Gov II Project • Project is USAID-funded Project was just picked up for both of its one-year extension options, runs thru September 2009 • Project designed to help restore and rebuild economic governance for the Government of iraq • Project parameters include: Fiscal, Tax and Customs Reform; Monetary policy and Central Bank; Financial Reform; Commercial Law and Institutional Reform; Utilities/Regulatory Reform and Government-wide IT; Social Service and Pension Reform; General policy Implementation and Special Projects • 4

My TOR (Terms of Reference) Providing technical assistance to the Iraqi government in order to help them establish for their information requirements the legislation, processes, procedures, and technical requirements required to economically manage the resources, collection, storage, and sharing of information with the goal to provide: • • Transparency of Government • Increased access to Government • Decrease in discrimination • Increase in commerce • Increase in foreign investment • Reduction in the cost of government • Increased efficiency of government • Increased security • Private Sector participation 5

TOR (cont. ) Tasks • Provide assistance to the National CIO Office: 1. 2. 3. Establish Government-wide information security standards that comply with international best practice Establish a plan for implementing IT security standards across all Government Ministries Build capacity and understanding of security standards 6

Expected Deliverables • In conjunction with team members and the National CIO office develop Government wide IT security standards • In conjunction with team members and the National CIO office develop a comprehensive IT security management capacity building program that covers o Security policy o Disaster recovery planning o Risk management o Securing the network o Intrusion detection, hacking o Computer forensics o Implementing PKI • Develop and conduct the following training seminars: o Disaster recovery planning o Securing the network o Risk management 7

Some Threats to Information Employees : who can you trust? • • Unstable infrastructure Information transmission risks, both natural and manmade • • Verbal communications • Printed documents • Facility security • Back-up sites 8

Information Security Management The ISO 17799 Way Safeguarding the confidentiality, integrity, and availability of written, spoken and computer information. 9

What is Information Security? BS ISO/IEC 17799: 2005 defines this as: Confidentiality: ensuring that information is accessible only to those authorized to have access Integrity: safeguarding the accuracy and completeness of information and processing methods Availability: ensuring that authorized users have access to information and associated assets when required 10

Security for Advisors • Private security service is employed fulltime to take advisors to/from venues in the Red Zone • To Venues: • All Advisors wear body armor during any travel outside the IZ, covered with a dark-colored sweatshirt or casual shirt • Lead car is Level 4 armored, low-profile BMW or Mercedes that fits into the milieu of typical cars you see on the street; no big Chevy Suburbans or Ford Excursions with lots of flashing lights and military escorts; two armed guards in front, maximum of two advisors in back • Trailing car is soft-side Nissan Altima or similar low profile car with two armed guards. 11

Corporate Camp Living 12

Camp Living (cont. ) 13

Camp Living (cont. ) 14

Camp Living (cont. ) 15

Camp Living (cont. ) 16

Camp Living (cont. ) 17

Camp Living (cont. ) 18

Camp Living (cont. ) 19

Thanksgiving 2006 20

Thanksgiving 2005 21

Traveling to/from the Airport 22

Science & Technology Counterparts Sundus Mousa Dr. Mahmood Sharief Director-General ITD 23

Red Zone Pics 24

Red Zone Pics 25

Red Zone Pics 26

Travel to/from BIAP 27

Baghdad international Airport 28

BIAP 29

Note ‘The relevance of any control should be determined in the light of the specific risks an organization is facing. Selection of controls should be based on a risk assessment. ’ BS ISO/IEC 17799: 2005 30

Controls for Best Practice • An Information Security Management Plan • Documented Roles and Responsibilities • Ongoing Information Security Education and Training • Ongoing Risk Assessments and Management of Risk • Reporting of Information Security Incidents and Events • Documented Disaster Recovery and Continuity of Business Operations Plans • Leveraging existing or off-the-shelf controls as needed to reduce labor and financial costs and to preclude “reinventing the wheel” 31

Customer and Other Contractual Requirement Considerations • Security Screening • Restricted Access • Physical perimeters • Data storage • Encryption • Digital signatures • Biometrics 32

Questions? 33

Contact Information Bill Casti, CQA, SSCP, CISM, CISA, CITP, ITIL Foundations e. Government Services IT Advisor, e. Government Services Iraq Economic Governance II Project Bearing. Point +964 (0) 790. 191. 9612 Iraqna Mobile +1. 703. 879. 5635 Skype Vo. IP Email: bill. casti@bearingpoint. com 34