Title: Information Security Project Management
Course: IN 2001 Principle of Information Assurance > Section: Module 10: Chapter 10

Information Security Project Management
1. Once the organization’s vision and objectives are documented and understood, the processes for translating the blueprint into a project plan can be defined.
2. Organizational change is not easily accomplished.
3. The major steps in executing the project plan are:
  - Planning the project
  - Supervising tasks and action steps within the project plan
  - Wrapping up the project plan
4. The project plan can be developed in any number of ways.
5. Each organization has to determine its own project management methodology for IT and information security projects.
6. Whenever possible, information security projects should follow the organizational practices of project management.
7. If your organization does not have clearly defined project management practices, the following general guidelines on project management practices can be applied.

Developing the Project Plan
1. Planning for the implementation phase involves the creation of a detailed project plan.
2. The creation of the project plan can be accomplished using a simple planning tool, such as the work breakdown structure (WBS). Common task attributes are:
  - Work to be accomplished (activities and deliverables)
  - Individuals (or skills set) assigned to perform the task
  - Start and end dates for the task (when known)
  - Amount of effort required to complete the task in hours or work days
  - Estimated capital expenses for the task
  - Estimated noncapital expenses for the task
  - Other tasks on which the task depends
3. Each major task is then further divided into either smaller tasks or specific action steps. Key components of the project plan are:
  - Identify work to be accomplished
  - Describe the skill set or individual person needed to accomplish the task
  - Focus on determining only completion dates for major milestones
  - Estimate the expected capital expenses for the completion of this task, subtask, or action item
  - Estimate the expected noncapital expenses for the completion of the task, subtask, or action item
  - Note wherever possible the dependencies of other tasks or action steps on the task or action step at hand

Project Planning Considerations
1. As the project plan is developed, adding detail to the plan is not always straightforward.
2. Special considerations include:
  - Financial
  - Priority
  - Time
  - Staff
  - Scope
  - Procurement
  - Organizational feasibility
  - Training and indoctrination
  - Change control and technology governance
3. Financial Considerations
  - No matter what information security needs exist in the organization, the amount of effort that can be expended depends on the funds available
  - A cost-benefit analysis prepared earlier in the lifecycle must be verified prior to developing the project plan
  - In many organizations, the information security budget is a subsection of the overall IT budget
  - In others, information security is a separate budget category that may have parity with the IT budget
  - Both public and private organizations have budgetary constraints, albeit of a different nature
  - To justify an amount budgeted for a security project at either public or for-profit organizations, it may be useful to benchmark expenses of similar organizations
4. Priority Considerations
  - In general, the most important information security controls should be scheduled first
  - The implementation of controls is guided by the prioritization of threats and the value of the information assets that are threatened
  - A control that is not considered as important as other choices may be moved ahead of more important options if it addresses a group of specific vulnerabilities and will cumulatively improve the security posture of the organization to a greater degree than other individual controls, even if they have a higher individual priority
5. Time and Scheduling Considerations
  - Time is another constraint that has a broad impact on the development of the project plan.
  - Time can impact dozens of points in the development of a project plan, including the following:
  - Time to order and receive a security control due to backlogs of the vendor or manufacturer
  - Time to install and configure the control
  - Time to train the users
  - Time to realize the return on investment of the control
6. Staffing Considerations
  - The lack of enough qualified, trained, and available personnel also constrains the project plan
  - Experienced staff is often needed to implement available technologies and to develop and implement policies and training programs
  - If no staff members are trained to configure a firewall that is being purchased, someone must be trained, or someone must be hired who is experienced with that particular technology
7. Procurement Considerations
  - All IT and information security planners must consider the acquisition of goods and services
  - There are a number of constraints on the selection process for equipment and services in most organizations, specifically in the selection of certain service vendors or products from manufacturers and suppliers
  - These constraints may change the specifics of a particular technology or even eliminate it from the realm of possibilities
8. Organizational Feasibility Considerations
  - Policies require time to develop, and new technologies require time to be installed, configured, and tested
  - Employees need to understand how a new information security program impacts their working lives
  - The goal of the project plan is to prevent new security components from directly impacting daily operations
  - This means that changes should be transparent to systems users unless the new technology causes changes to procedures, such as requiring additional authentication or verification
9. Training and Indoctrination Considerations
  - The size of the organization and the normal conduct of business may preclude a single large training program on security procedures or technologies
  - As a result, the organization should conduct a phased-in or pilot approach to implementation, such as roll-out training for one department at a time
  - In the case of policies, it may be sufficient to brief all supervisors on new policy and then have the supervisors update end users in normal meetings
  - Ensure that compliance documents are also distributed that require all employees to read, understand and agree to the new policies

Scope Considerations
1. Project scope describes the amount of time and effort-hours needed to deliver the planned features and quality level of the project deliverables.
2. The scope of any given project plan should be carefully reviewed and kept as small as possible given the project’s objectives.
3. To control project scope, organizations should implement large information security projects in stages. There are several reasons why the scope of information security projects must be evaluated and adjusted with care.
4. The Need for Project Management
  - Project management requires a unique set of skills and a thorough understanding of a broad body of specialized knowledge
  - Realistically, most information security projects require a trained project manager—a CISO or skilled IT manager who is versed in project management techniques and can oversee the project
  - In addition, even experienced project managers are advised to seek expert assistance when engaging in a formal bidding process to select advanced or integrated technologies or outsourced services
5. Supervised Implementation
  - Some organizations may designate a champion from general management to supervise the implementation of the project plan for security information
  - An alternative is to designate a senior IT manager or the CIO of the organization to lead the implementation
  - The optimal solution is to designate a suitable person from the information security community of interest, since the inherent focus is on the information security needs of the organization
  - In the final analysis, it is up to each organization to find the leadership for a successful project implementation that best suits its specific needs and the personalities and politics of the organizational culture
6. Executing the Plan
  - Once a project is underway, it is managed to completion using a process known as a negative feedback loop or cybernetic loop, which ensures that progress is measured periodically.  The measured results are compared against expected results
  - When significant deviation occurs, corrective action is taken to bring the task that is deviating from plan back into compliance with the projection, or else the estimate is revised in light of new information.  Corrective action is required because of two basic situations: either the estimate was flawed or performance has lagged
  - When an estimate is flawed, as when the number of effort-hours required is underestimated, the plan should be corrected and downstream tasks updated to reflect the change
  - When performance has lagged due, for example, to high turnover of skilled employees, correction is required by adding resources, lengthening the schedule or reducing the quality or quantity of the deliverable
  - The decisions are usually expressed in terms of trade-offs. A project manager can often adjust one of the three following planning parameters for the task being corrected:
    - Effort and money allocated
    - Elapsed time or scheduling impact
    - Quality or quantity of the deliverable
7. Project Wrap-up
  - Project wrap-up is usually handled as a procedural task assigned to a mid-level IT or information security manager
  - These managers collect documentation, finalize status reports, and deliver a final report and a presentation at a wrap-up meeting
  - The goal of the wrap-up is to resolve any pending issues, critique the overall effort of the project and draw conclusions about how to improve the process for the future