Features and functionality of modern SGRCsystems

Ruslan Rakhmetov, Security Vision

In today's ever-changing cyber threat landscape, the ubiquitous use of AI, and ever-increasing complexity of legislation, cybersecurity professionals cannot do without automation tools. At the same time, automation has long gone beyond the classical application in security tools, various scripts and utilities. Today, without comprehensive automation of information security processes, it is impossible to keep the cybersecurity management system up to date – without continuous and operational changes to the process part and their implementation in technical means of protection, attackers will always be one step ahead. In modern conditions, it no longer makes sense to talk about automation of "paper" security – it is important that the organizational, process and technical parts correspond, complement and mutually strengthen each other. To implement this concept, you can use systems for complex automation of information security processes - solutions of the SGRC class, which we will discuss in this publication.

SGRC systems (Security Governance, Risk Management, and Compliance, Security, Risk, and Compliance Management) allow you to automate an interconnected set of cybersecurity areas:

     - managing information security strategy, policies, documents, and processes.

     - information security risk management;

     - managing compliance with information security requirements.

We will tell you more about each of the directions.

1.Governance (Information Security Management).

Without a well-established strategy and documentary support, it is impossible to build cybersecurity processes – Their implementation will require at least the approval and resource support of the organization's managers. High-level documents – the information security strategy and policy-are developed to document (formalize) common approaches to cyber defense and are signed by the first person of the company to ensure the implementation of the principles set out in them. The information security strategy can be a fairly general document, and the information security policy contains a more complete description of the interrelated high-level principles that govern corporate cybersecurity processes. Further, standards, regulations, procedures, and instructions are developed that contain detailed rules, organizational and technical requirements for information security, and templates for their implementation.

As the documentation component grows, it becomes increasingly difficult to keep track of edits, approval sheets, versions, and update dates. Without automation of this direction, there may be situations when the deadlines for the next annual update and approval of documents will expire, the necessary changes will not be made to the next edition, and the agreed versions of various documents may even contradict each other in some aspects. In order to avoid such confusion, SGRC class systems offer information security document management functionality: you can automate the collection of primary requirements (for example, send questionnaires by email in certain formats and automatically process responses), approval and approval (documents can be marked accordingly in the SGRC interface after receiving a positive response fromapplicants by email). In addition to parsing emailmessages, you can also collect information directly in the web interface of the SGRC system: you just need to prepare questionnaire forms, grant appropriate access rights to process participants and approving persons, and then send out a notification about the need to fill out survey forms/documents. Version up – to-date control and document revision deadlines are also controlled automatically.SGRC will notify you of the need to start a new approval cycle at the right time. In the SGRC system, it is also easy to set up a complex document approval process. For example, if a high-level information security document that affects the work of, say, a legal department must first be approved by the head of the information security department, then by the head of the legal unit, and only then get signed by the first person of the company. You can also organize the processing of various comments, suggestions, and corrections for documents - with the collection of feedback and notification of those responsible.

In addition to document management, SGRC systems allow you to robotize a wide range of different cybersecurity processes – the main thing is that data about them is contained somewhere in a machine-readable form. For example, you can automate processes such as asset management, vulnerabilities and configuration flaws, changes, exceptions, tasks and requests, business continuity and recovery, training and accumulated knowledge. For effective automation, it is important that the SGRC solution receives up-to-date and accurate data from integrated systems that technically implement information security processes: these can be both IT solutions (directory services, CMDB, hypervisors, monitoring systems, OS and network device logs, etc.) and security tools (against the simplest antivirus programs up to SIEM, SOAR, TIP, UEBA, and other advanced systems). In this way, data about the actual security status and information about the infrastructure status will flow to SGRC: for example, to get information about the status of the asset management process, you need the CMDB / ITAM solution to contain up-to-date data about IT infrastructure elements and be able to export this information to SGRC (for example, via the API or even banal via file uploads). The same applies to managing vulnerabilities and configuration flaws: a VM or SPC-class solution must be able to send consolidated and consistent data to SGRC. Thus, SGRC will accumulate information from various sources, which will gradually form a complete, objective picture of the state of information security in the company with the ability to generate reports and visualize data in various sections on dashboards, charts, widgets, etc.

In this way, you can systematize and automate even the most complex processes that affect various business lines and corporate divisions. For example, to manage business continuity and recovery, you will need to obtain up-to-date inventory data for assets and information systems, as well as determine availability targets and recovery requirements, such as the target recovery Point (RPO, Recovery Point Objective), recovery time (RTO,Recovery Time Objective), and the maximum allowable business interruption period (MTPD,Maximum Tolerant Period of Disruption). Next, you will need to" get " data from backup systems in SGRC with data on the frequency and success of creating backups, plan data recovery testing (for example, by simulatinga viper virus attack on a number of information systems), and then compare the actual results with the target indicators.

As we can see, even the most advanced SGRC platform with the widest integration functionality and customization capabilities will be as effective and efficient as the relevant information security processes are mature and built. It is important to remember that any automation system is primarily a tool that is based on the processes built by specialists. It makes sense to implement an SGRC system only if the processes automated on its basis are sufficiently mature. To describe the maturity levels of processes, you can use the CMMI (Capability Maturity Model Integration) model, according to which processes are divided into the following maturity levels:

     - Initial: the process is performed in a chaotic manner.

     - Managed: the process is repeated, planned, monitored, adjusted, but there is no regulation.

     - Regulated: the process is documented and regulated, and predictable results are achieved.

     - Quantifiably managed: quantitative performance metrics are implemented to monitor and evaluate the process.

     - Improving: The process is continuously improved.

Before evaluating the feasibility of implementing SGRC, you should conduct an internal audit of the maturity of the processes that will be automated. Information security processes that are at the initial level are not suitable for automation – It is desirable that the process be at least manageable. As the level of maturity increases, you can trust the SGRC system with more processes and a higher degree of automation: at the "Regulated" level, the automation tool can be used to robotize individual repetitive and documented actions, at the "Quantitatively Managed" level, atomic robotic actions can be combined into a full-fledged process and monitor its effectiveness using quantitative metrics, and at the "Regulated" level, the automation tool can be used to automate individual repetitive and documented actions. At the "Improving" level, feedback should already be collected and processed for continuous improvement of information security processes and the entire ISMS as a whole.

2. Risk Management.

Most of the strategic tasks in building corporate cybersecurity are related to the need to justify the allocation of budgets and resources to the company's management. Terms that are familiar in the professional environment, such as" threat"," vulnerability"," incident", do not make a proper impression on decision makers – they are used to focusing on specific numbers and amounts. In order for cybersecurity to reach the level of company managers and stop being an addition to IT, it is important to operate not only with legal and technical requirements, but also with financial indicators. The risk management process allows you to prioritize cyber threats, choose adequate protective measures depending on the level of risk, and demonstrate the economic efficiency of information security costs.

To build an effective risk management process, it is important not only to determine the methodology of risk analysis, but also to operate with accurate data — this will allow you to draw objective conclusions and conduct risk assessment, using figures of costs and potential damage. For qualitative risk assessment, you can use the Traffic Light method, for quantitative risk assessment, you can calculate the level of expected annual losses (ALE/ALE using the PERT method), and for risk modeling, you can use the Monte Carlo method, which allows you to conduct many iterations of scenarios using random variables to take into account possible changes and variations in the data. You can also use other risk assessment methods – FAIR, COSO, FMEA, VaR, etc. Risk assessment requires at least data on assets and information systems (their properties, values, responsibilities), data on vulnerabilities and implemented protection measures, accumulated data on the number of different incidents by year, estimated damage from each of them. incidents. The stages of risk assessment to some extent coincide with actions when modeling threats and intruders and when evaluating scenarios for the implementation of cyber threats-approximately the same set of introductory data is used (with the exception of financial indicators).

By combining these data on the SGRC platform, it is possible to systematize and automate almost the entire risk assessment process-from interviewing responsible persons to modeling the consequences of risk implementation and assessing the number of incidents and damage caused by them in the future, from selecting and justifying economically justified protection measures to monitoring their implementation and effectiveness. It is worth remembering that both threat modeling and risk assessment should not be one –time events, or even periodic ones-the speed of changes in the cyber threat landscape today is such that they should be re-evaluated on a continuous basis, constantly assessing the state of cyber security of the company and monitoring the performance of implemented security measures and their adequacy to the current level of threats. SGRC systems allow you to get up-to-date and objective information about the state of infrastructure, security measures, the number and danger of vulnerabilities and incidents, the level of external cyber threats and trends of intruders through integration with IT/information security solutions. The visualization and reporting functionality will help you not only visually see the current picture of the company's cyber security and the level of cyber risks, but also provide situational awareness of the company's managers, which will help them make risk-oriented management decisions.

3.Compliance (Compliance Management)

One of the tasks of the information security division is to meet regulatory requirements for cybersecurity. At the same time, the requirements can be either legislative, i.e. external, or internal – they are also mandatory, but they are imposed not at the state or industry level, but in accordance with the corporate hierarchy (within the holding company, group of companies, and relationships between subsidiaries and affiliates). The ultimate goal of meeting the requirements is not to develop "beautiful" reports on full compliance, but to find and eliminate inconsistencies, which ultimately leads to a systematic increase in the level of security. Unfortunately, the scope of mandatory requirements is such that it becomes difficult to understand them even with the help of a team of lawyers, especially since some specific requirements and provisions can only be understood within the framework of explanations from regulators. That is why it is important that information security specialists have access to a tool with clearly described, decomposed, and deduplicated requirements – both external and internal. The SGRC system becomes such a tool: in addition to the pre-established regulatory framework, you can upload additional internal requirements, build the process of conducting audits and self-assessments, send out questionnaires or prepare web forms with questionnaires, monitor compliance with requirements, form requests for troubleshooting, appoint responsible people, set and control deadlines.

Due to integration capabilities, advanced SGRC systems allow you to collect actual data on meeting requirements in an automated manner. For example, if a regulatory requirement says that you can't use depersonalized accounts, then SGRC will get a list of accounts with their properties from the directory service and search for empty fields where the account owner should be specified. Another example: if regulations require critical vulnerabilities to be fixed within 24 hours, then after receiving the relevant data from the vulnerability management system, the SGRC will immediately issue a list of nonconformities ("expired" vulnerabilities), form urgent requests, and send notifications to those responsible. A good SGRC system not only comes with a rich set of pre-installed regulatory requirements and not only supports various integrations with IT/information security systems, but also allows you to easily visualize data on the degree of compliance with certain requirements, and also quickly generates the necessary reports in accordance with the forms of regulators, which facilitates the passage of various kinds of audits and inspections.

As we can see, modern solutions of the SGRC class are already much more than just a paper security automation system. Opportunities for integration with various corporate IT/information security solutions, pre-installed expertise packages and sets of regulatory documents, the ability to flexibly customize internal processes, visualization and reporting functionality make SGRCS the main assistants of information security departments and cybersecurity managers. For example, the Security Vision SGRC platform implements the no-code/low-code toolkit, in which users can easily create new integrations and refine the internal logic of the system to meet the requirements of a specific company using an intuitive graphical constructor. Mutual enrichment of data from IT/information security systems, their correlation, analytics and visualization of the results obtained clearly and objectively demonstrates the state of infrastructure and processes in various sections. The Security Vision platform allows you to use a number of modules to automate most cybersecurity processes – In particular, the SGRC functionality is implemented in the following modules:

• Security Vision СМ (Compliance Management);

• Security Vision RM (Risk Management);

• Security Vision BCM (Business Continuity Management);

• Security Vision SA (Self-Assessment);

• Security Vision ORM (Operational Risk Management);

• Security Vision ASOC (Application Security Orchestration and Correlation);

• Security Vision PD;

• Security Vision CII.

The Security Vision platform combines the above solutions with products for counteringcyberthreats, which are natively integrated within a single ecosystem:

• Security Orchestration, Automation and Response (SOAR) - a module designed to automate the response to information security incidents.

• Next Generation SOAR (NG SOAR) - advanced incident management module.

• Security Information and Event Management (SIEM) - a module for monitoring событий information security events.

• Threat Intelligence Platform (TIP) - модуль анализа cybersecurity threat analysis module кибербезопасности.

• User and Entity Behavior Analysis (UEBA) - модуль behavioral analysis module.

• Asset Management (AM/CMDB) - asset and inventory management module.

• Vulnerability Management (VM) – vulnerability management module.

• Vulnerability Scanner (VS) - сканер vulnerability scanner.

• Security Profile Compliance (SPC) – a module for monitoring security parameters.