Gap Analysis in IT Security

Definition

• Gap Analysis: A study comparing the current state to the desired state.
• Purpose in IT Security: To understand necessary future security needs.

Complexity

• Involves analyzing current environment and planning future security improvements.
• Takes weeks, months, or even years.
• Requires collaboration across various organizational divisions.

Preparation

• Baseline Creation: Establish a baseline to know where the organization currently stands and the desired goals.
• Sources of Baselines:
  • National Institute of Standards and Technologies (NIST) SP 800-171 revision 2
  • ISO/IEC 27001 by the International Organization for Standardization and the International Electrotechnical Commission
  • Custom baselines based on specific organizational needs.

Components of Baseline Analysis

• People:
  • Assess experience and training in IT security.
  • Understand knowledge of specific security policies and procedures.
• Policies:
  • Evaluate existing IT systems against formal security policies.

Gap Analysis Process

1. System Comparison:
   • Identify weaknesses in existing systems.
   • Compare weaknesses to effective processes for compensation.
2. Detailed Analysis:
   • Break down broad security categories into smaller segments.
   • Example: Access control broken down into user registration, provisioning, and privileged access rights.

Final Documentation

• Summary Document:
  • Compare detailed baseline objectives with current status.
  • Identify necessary steps (time, money, equipment) to reach the desired state.
• Gap Analysis Report:
  • Include current status and pathway for future improvements.
  • Document recommendations to meet baselines.

Reporting

• Example Table:
  • System requirements broken into smaller parts for detailed analysis.
  • Evaluate remote sites against baseline objectives.
  • Use color coding (green, yellow, red) to indicate proximity to baselines.
  • Focus improvement efforts starting with red, then yellow, and finally green.
• Report Details:
  • Explanation of color coding.
  • Summary of steps to implement security controls.