The Problem
A large Federal Government Department was seeking skilled and highly experienced Cyber Security Professionals to help improve its ICT assessment & authorisation framework and associated practices. We had the expertise and hands-on practical experience in this area and were therefore engaged directly by the Information Technology Security Advisor to help with this requirement.
The Approach
We commenced the engagement by identifying current practices and listening carefully to key stakeholders. This is important because although we are highly experienced in helping other clients with this type of problem, there is always nuance and important details that come from listening carefully. Understanding the root cause of any problem is as crucial as the problem itself. We undertook a gap analysis between the current practices, our own experiences in solving this issue and industry best practice in order to manage and plan our course of action. We engaged with other branches to identify potential opportunities to leverage tools and information that could assist to solve the mandatory requirement that government ICT systems are security authorised to operate.
We provided a high-level blueprint on how the new framework would look, identified the challenges, bottlenecks and lower-level solutions for how implementation should occur. This required input into, changes to, or development of lower-level practices, guidance and tool sets.
A key strategic objective was to transition to a state whereby the department could triage and prioritise the cyber security authorisation of its many thousands of systems. We recommended effective and robust methods in which security assurance activities can be applied within the context of a hierarchical prioritisation of systems.
The Outcome
We developed the ICT Security Authorisation Framework from scratch which was approved for use by the Chief Information Security Officer. The client now has a contemporary and fit-for-purpose ICT authorisation methodology which considers the systems criticality within its broader security environment and context. This meant that the department can now formally identify its most critical assets and apply the highest security assurance to them whilst providing the flexibility to subject other systems to a degree of security due diligence that is commensurate with its criticality. In the context of the department having thousands of systems and limited resources, this methodology was critical in directing effort towards areas of highest risk and achieving efficiencies. The framework provided detailed workflow diagrams for the various stakeholders within the authorisation cycle (System & Business Owner, Security Analyst, Project Manager & Architect). This was a fundamental and generational change in the ICT authorisation framework that required senior executive support and a high degree of collaboration within and across different branches.