good afternoon and good evening ladies
and gentlemen
uh it is my great pleasure to present
here
for the second time at defcon boating
village
i am sangwon lee an anti-security
specialist at the city of chicago
leading the cyber security policy and
the compliance programs
today i'm here to share thoughts on how
to update an information security policy
specifically from a local government
perspective
without further ado i would like to go
through my presentation
today i will start by exploring what is
information security policy
and the peculiarities that makes the
local government different from other
types of organization
second i will go through the aims and
goals
for the revision of the policy from the
local government perspective
third i will propose the methodology of
the revision
and the actual application based off of
the case study
of city of chicago
so what is information security policy
information security policy is the
highest directive of cyber security
posture
to formalize the security and internal
control standards
to mitigate security risks to comply
with applicable
external controls and regulations to
define
how computing and communication assets
systems
and resources should be accessed
configured used and protected
and to monitor activities of
organizations personnel should execute
to maintain
the security of the organization's
operating environment
in short to set up a baseline to
maintain
soundness of cybersecurity and provide
guidance to the relevant stakeholders
including the itscs
and to direct the cyber security
programs such as
risk management incident response and
compliance
so what to consider as a
local government the local government is
a multifunctional service provider to
its constituents
with its wide spectrum of functions the
local government engages
residents with various administrative
measures
in other words the audience of provided
services
are the local constituents at the same
time
the local government is technology
laggards the city
is very slow in accepting new technology
i might have to tell my boss to get a
new laptop but
he's even using like a five-year-old
laptop still
so at the same time we have very limited
financial
human resources specifically in cyber
security
now we city we're having more than
35 000 people employeed
however we our security team is
relatively very small compared to our
size at the organization
and i believe this is not only the case
of chicago
because chicago is the one of the
largest city
in the united states and
third is about our static
decision-making process in case of
public grade documents
we need to go through the mayoral
approval and this is not only the case
of chicago
at the same time if something is
approved and implemented
our deliverables are public facing and
open to public
so multi-function means multiple
compliance requirements
larger impact by a cyber incident and
also
public influence of our documents
and as i just mentioned
we have very slow approvals on new
changes and developments
regardless of how the cyber security
landscape is changing rapidly
so this is the reason why importance of
the policy is even further emphasized in
the local government so
in order to make our government even
more sound
in our cybersecurity postures i would
like to deliver
the aims for the isp revision
so these are the aims for this revision
first
considering the nature of the cyber
security policy or information security
policy
it is a general document but also also
it requires to be
in detail so to cover the wide spectrum
of audience and topics
the general employees would consider as
a general document that
should be followed by every single
business that they conduct in every day
at the same time for the itscs they're
being the direct stakeholders
who should be taking into a
consideration
in detail so in order to satisfy those
two
the policy should be a dynamic document
and living document
second we are
approaching the policy that should be
communicating with the constituents all
the time
so so to actively engage both within the
organization and
to external public the document should
be
a consumable document not a stressful
document to
go through like 50 or 60 or 100 pages
but it should be more consumable and
more simplified
providing the highest policy statement
from the city or from the organization
third it should be a document that
mentioning about our compliance
so we have federal local regulations and
industry standards that we should be
adhered and should be compliant with
and these are the main three
aims of the revision for the policy
so from now on i will directly go
through the methodology
to make a dynamic document first i
i propose to address the gaps and assure
the flexibility
to do so we first identify the gaps
second we analyze the current version
whether
it's good or bad or whether it's
sufficient or insufficient
third we develop a new policy if needed
so
to give an example by the increased
usage of social media for
civic engagement by the government local
governments
the revised version of the social media
usage
is required for
our policy to maintain our cyber
security
however well the current version in case
of the city
is a six or almost six year old document
and that makes our prior version very
weak
in providing sufficient controls
over the social media usage
so that was one example second is about
making a consumable document that i just
mentioned so
in order to do so i v
city is approaching to separate the
policy and the process
for specifically we are planning to
identify which statement is a policy
statement
and which statement is up which
statement
is a ticker control and by doing so
we can develop a separate process
documents which
are mainly referenced by the relevant
stakeholders such as itscs
for each policy topic so this has a
benefit of first
we provide a faster way to reference the
policy and how to implement the
sufficient controls that are required by
the policy
second by reducing the actual contents
of the policy itself
we are expecting that the
policy can be more consumable document
regardless of what role that you're in
within the local government third is
about alignment
so we are here to build our new policy
and revise our new policy
and we first map the existing policy
with the key controls from both
top down and bottom up level and i will
explain this further
very soon and second we
analyze the composition and structure
and determine which
which part of controls are
underrepresented and which part of
controls are over represented
and by doing so we can determine
and identify the required uh policies to
need for the improvement and by doing so
not only by
not only just improving the policy but
also we intend to be compliant with
any compliance requirements that we are
adhering to
so i believe this is not a sufficient
information or sufficient explanation to
understand what the aims of the
methodology is
so we will present about the direct
application and from the case of city of
chicago
our information security and technology
policy
is okay if you can check here it is
its release date is 2016. so it's five
years old and this
last revision was a minor revision just
changing some departmental names due to
the changes of organizational structure
within the city
so now we are undergoing a process
of revising our own policy to maintain
the goals and aims that i just mentioned
before
so the current policy as is
is first it's outdated as i just
mentioned the major revision was done in
2016.
it's somewhat under focused or
overreaching
regardless of considering the city's
resources and third
it is mixed up with policy statements
and technical controls
and second is about for the second is to
uh go through more about the policy and
control the policy statements are
technical controls
and policy statements and technical
controls are mixed up leaving variety of
readers
difficult to digest so for those people
who understand the technology
and people who are directly working with
the policy
maybe may feel very comfortable with
using that policy
for their daily guidelines however if
this document is released into public
and
it is actually released into public um
and the readers may found very difficult
to digest
so this is the second point of the
second uh
prescription of the not perseverance not
prescription but
the identification of our current
problem and third is about compliance
um the initial version of the policy or
the current version of the policy
was built built on the cyber security
considering the cyber security framework
and the nist 853
revision 4 which is recently revised
and also other industry standards that
we are
adhering to is also revised after
our initial announcement of the current
version
so in order to maintain uh in order to
be compliant we need to update this
policy
to what to consider about our current
organization
is as i just mentioned we are very
static and slow decision-making process
organization
and we are we have very large employees
of the organization
at the same time these employees are not
only like the desk workers but also
there
are people who are
responsible for city city
infrastructural services
and buildings or like parking
enforcement like that
and also we have a police department and
fire department
and those kind of multifunctional
business services
are offered by the city and
it's a public document and this is
this document seems to be very specific
addressing very specific issues of the
city's information systems and use of
information systems in the city business
however this is a public level document
which is open to public and
third it's about cyber threats it's
rapidly evolving
and we also have expanded use of social
media
by the city and by the people and also
we have a comprehend the comprehensive
thread with
mass empath so our audience is
not only the city employees not
not only the reason why for us to have
a lot of employees in the city actually
the city
the the paralysis of city
business or the in incident which
influences our city business would have
major impact over the residents
so this is the current stage of
our policy
and at the same time this is how the
policy is structured
especially in the city of chicago so we
have 15 chapters or 15 policies
regarding our information security
and the each policy has four different
levels
from chapter article clause and item
and if we sum up this number of these
items we have 543 items and this
document is over 80 pages
however this is also mixed up with
policy statements and
controls and some of the technical
controls are not even valid these days
because of the technological progress
and as i mentioned before it's
overreaching regardless of
city's personal resources because it may
have some statement like
the policy requires or the information
security office where i'm working for
is requiring for the system a to
maintain this
uh stage of b however that stage of b is
already outdated a few years ago
that means our last major revision was
2016 so
we need to keep updated and for
considering the city's uh approval
structure that
is very static and requires a long time
to get
finally approved and posted to public
we need to provide a room for
flexibility
and that's the one of the reason why
we're trying to separate
the controls and the policy statements
so recalling the methodology from this
section i will start
with how to make a dynamic document
so we started from mapping the policy
from top
top down so the in the
left hand side of the table there are
two tables here
the left-hand side of the table is the
result of
mapping the istp each part for each
policies within this control boundaries
and the right side is the
number the list of this control families
and here
the chapter row means that this chap
this chap like the number of chapter
which addresses
this uh control families we
when we are mapping from the top down
level first
we did not allow any overlap so we only
assigned one control family to one
policy
and based on the results we could see it
generally
it is generally balanced with missing
control families and those
were missing was a sixth missing control
families of
a t c a i a m a
p t n r a bottom up mapping results may
deal with the missing control families
and i will present this right after but
and
from here we also thought about consider
considering about the rearranging the
policy to make the policy balanced
while building up on the nist 853
so for the city the we are currently
approaching
our revision to be based on
the newest revision version the revision
5
of the news 853
and we also conducted a bottom-up
analysis
so at here we did as i
mentioned before we here it's a
it has a policy chapter number article
number
clause number and item number so these
are we divided every policy into items
and we assigned
every uh relevant control families based
on our policy contents
we have because this it was first done
by
myself but because we are um
a human being who makes mistakes i also
we also gone through multiple trials for
validation
and within our information security
office
and there there were both
underrepresented and overrepresented
control families on the policy and at
the same time as i just suggested in the
before
the slide before there are the missing
six control families which i mentioned
from the top-down approach was
reinforced by the bottom-up analysis
but still there is a need for
rearrangement to
uh split apparently to
apparently and clearly identify for
those who are missing
and these were the results and somewhat
well i think it's the nature of the
information security policy but based on
what we have here
access control is very over represented
while
the ma is very underrepresented and
these are the points that we have
identified and determined to be
reinforced by new
newest revised version of the policy
and section is about how to separate the
policy
and policy statement and controls
so this is another worksheet that i am
using right now
and we determine every item
to within the two uh three categories
which is
controls and policy and also some of
them were mixed control mixed
statements so we assign
we've gone through every 543 items
for this process and this was also um
have gone through multiple trials for
the validation
and these are the some of the mixed
mixed statements so if you see here the
technical operations
and enterprise network architecture
should ensure that system default
settings are reviewed
with the information security office
before installation to identify
potential security vulnerabilities
which is a policy statement however the
contents below
is detective control and we intend to
collect all the technical controls by
each policy so by each chapter
and then we develop a separate process
documents that are
for the reference of the itscs by doing
so
we are simplifying the policy statements
and making it
as a further stronger message and at
this
and we are also crystallizing the
technical control with the process
documents
this process not only um
lifts the burden of the reader however
at the same time
it is it allows us to make more dynamic
updates based on uh based on our current
approval process
so the process document we only need the
one we only need a single or two
single or double signatures from the
ciso
and the cio but for the policy to be
revised we have to go
all the way up through the mayor's
office which requires
several months or several weeks in a
good case
that's not because they're not they're
not doing their work but there are so
many things to be
reviewed by the mirror office so that's
the reason why we are separating these
two
to make more um readable document
consumable document at the same time
more of the document as a living
document which can make
uh rapid updates
so simplifying the positive document we
assure the room for flexibility discard
the technicalities
and we are considering this as a public
grade document
and crystallizing the technical controls
we
allow more frequent updates with process
documents
simplified approval process and internal
grade document
and this policy intend to be
a consumable policy for everyone and
final stages alignment so
to introduce some of the key references
then are some regulations that we're
adhering to right now
first it's about this 853 i believe
everyone
not everyone but mo this is a very
phenomenal document not phenomenal but a
good
cornerstone of the cyber security so
mistake under 53 revision 5 is a
comprehensive catalog of security and
privacy controls for all u.s federal
information systems
except those are related to national
security so
even though the city government is a
municipal government not a federal level
however
we are trying our best to maintain our
security level at the federal level and
cadrol standard
and for the second we are also uh
related to the pci dss the
pci data security so payment card
industry data security standard
has the goal of managing the ongoing
evolution of
the security against the payment card
and the car payments
and transactions so the city has a
credit card payment environment which
uh makes us to maintain our compliance
with the pci
and we also and we are also considering
the newest developments and newest
updates
released by the pci and also we are
not a so sorry
and also we have we are to
adhere and to be compliant with the
hipaa hipaa
is a health insurance portability and
accountability act
is to modernize the flow of healthcare
information stipulate personally
identifiable information
maintained by the healthcare and
healthcare insurance industries should
be protected from fraud
theft and address limitations on
healthcare insurance coverage
so for the nist it is to maintain
resilient city network compatible with
the federal standard
and second for the pci is to ensure the
same credit card transaction environment
and hipaa is to ensure privacy and
confidentiality specifically on the
protected health information
and the days like the times of pandemic
we have the
city is also providing various services
regarding the kobe 19
and in that manner a lot of information
information is categorized as a
protected health information
and we should be compliant with the
hipaa and this is a federal regulation
so all these are in consideration to
align
as our for our revised version of the
policy
so i believe this was quite helpful
thank you for listening and i will
answer to the questions as far as i can
and if you have any further questions
or any kind of requests please
reach out to me and we i'm happy to
reply it
thank you for listening