Top 10 IT security actions – No. 7 protect information at the enterprise level - ITSM.10.097

2.2 Insider threats

An insider threat is any individual who has knowledge of or access to your organization’s infrastructure and information and who uses, either knowingly or inadvertently, the infrastructure or information to cause harm. Insider threats can put your organization’s employees, customers, assets, reputation and interests at risk.

Generally, when we think of an insider threat, we think of someone who knowingly wants to cause harm. An individual may carry out targeted attack by abusing privileged access or general accounts to install malware or steal sensitive information.

However, anyone who has access to your organization’s infrastructure or information (e.g. employees, contractors, or service providers) can cause harm inadvertently. For example, inadvertent insider threats can be caused by the following behaviours:

• misplacing a mobile device or removable media
• granting user access to sensitive information beyond what is required for a person’s job functions
• mishandling sensitive information (e.g. storing it improperly, not applying protective markings or distribution caveats)

An insider threat can affect the confidentiality, integrity, and availability of your organization’s systems and information. For example, an insider threat may unintentionally disclose sensitive information or intentionally steal intellectual property, disrupt organizational services, or destroy critical information.

For more information, see ITSAP.10.003 How to protect your organization from insider threats ^{Footnote 4}.

2.3 Threats to your supply chain

You should ensure that you manage the risks associated with your supply chain as part of your cyber security plan and risk management activities. Your supply chain includes any of the suppliers, services, equipment, software, or processes your organization uses.

Even with a robust cyber security program in place, your organization’s systems and information are at risk if your supply chain is compromised. Threat actors may try to compromise the supply chain by infiltrating trusted suppliers and vendors, violating the assumed trust that you might have with suppliers and vendors.

For more information on protecting your supply chain, see ITSAP.00.070 Supply chain security for small and medium organizations ^{Footnote 5}.

3.1 Identify its value (RA-2)

By identifying the value of your organization’s information, you can prioritize what needs to be protected.

You can determine the value of your organization’s information by assessing the possible harm that could result from the inability to protect its confidentiality, integrity, and availability. When assigning value, consider the following types of information:

• Business critical information: Information that your organization relies on for its ongoing operation (e.g. sales information, emergency response plans).
• Sensitive information: Information that needs to be kept confidential or only accessed by certain people (e.g. financial or personal information, intellectual property).
• Records and evidence: Information that needs to be protected from unauthorized modification (e.g. contracts, receipts).

For more information on determining the value of information systems and assets, see ITSAP.40.001 Protecting high value information: Tips for small and medium organizations ^{Footnote 6} and section 2.3 of our Baseline cyber security controls for small and medium organizations ^{Footnote 3}.

3.2 Classify and categorize (RA-2)

As you identify the value of your enterprise information, you should also classify and organize it into groups or classes based on its level of sensitivity. The classification markings that your organization applies may vary, depending on whether you are a government department or a non-government, private organization. Classifying your information appropriately helps you manage your information and protect your information against unauthorized access and distribution, as well as improper retention and disposition.

Categorizing your enterprise information have several purposes, including the following examples:

• reflects the value that your organization has assigned to the information
• represents your organization’s risk tolerance
• determines how your organization assures the confidentiality, integrity, and availability of information

When enterprise information is classified and categorized appropriately, your organization is in a better position to manage it throughout its lifecycle, ensure that it is properly retained and destroyed, and protect it against unauthorized access and distribution. In addition, by understanding your information, you can implement the appropriate security controls and manage risks according to your organization’s agreed upon risk tolerance.

4.1 Retention and disposition (SI-12 and MP-6)

You should ensure that information, records, and media are retained for as long as required for business purposes and legal and regulatory requirements. Information has different retention requirements based on its function. For example, from a legislative and regulatory perspective, you must retain financial information for a longer period than you would for administrative information, such as committee or meeting notes. Your organization is responsible for creating and maintaining a retention schedule that outlines how long information must be kept and its final disposition actions (e.g. destroy, preserve).

When information reaches the end of its lifecycle, you should ensure that it is disposed of properly (e.g. shredding, incinerating, degaussing) to prevent data remanence and breaches. If information or media are not properly destroyed, residual data may remain, or data may be recovered and reconstructed.

Note: If you are reusing physical or electronic media or releasing it out of your organization’s control, you must ensure that it is properly sanitized. In some cases, you may want to sanitize media, such as a hard drive, before it is destroyed as an additional layer of security.

If your organization uses cloud service providers (CSPs), you should be aware of some additional challenges to properly destroying information. You have less control over ensuring that information is properly removed from physical assets. You should ensure that you address retention and disposition in your service-level agreement with a service provider. One aspect of data disposal to consider for cloud environments is crypto-shredding. With this method of data disposition, the encryption key assigned to protect the data is purposefully deleted or overwritten. This method can only be applied to data that has been encrypted. Your organization should encrypt sensitive and proprietary data when it is at rest, in transit, and in use in order to ensure you maintain the confidentiality, integrity, and availability of your data.

4.2 Inventories and tracking (CM-8)

Your organization should have an inventory of all your organization’s information systems and their components (i.e. hardware, software, databases, networks, people). You are responsible for determining the criteria for the types of information system components (e.g. microprocessors, motherboards, software, programmable logic controllers, network devices) that are included in the inventory.

The information you include about the components should be detailed enough for your organization’s tracking and reporting requirements. For each component, you should list its configuration information, including any approved deviations, and the individuals, and their contact information, who are responsible and accountable for the component. Be sure to include system specific information (e.g. system association, system owner, software license, software versions) and hardware inventory specifications (e.g. manufacturer, device type, model, serial number, and physical location). For networked components or devices, you should also include machine names and network addresses.

Be sure to review this inventory. You should update the inventory in scenarios such as when information systems are updated and when components are installed and removed. You may want to use automated mechanisms so that you can maintain an up to date, complete, and accurate inventory.

As part of your inventory maintenance, ensure you review the cryptographic configurations within your software and hardware. To allow for cryptographic agility, your inventory should list the cryptographic algorithms configured for each component. Cryptographic agility is a concept of best practice that enables cryptographic algorithms used in applications and protocols to be interchanged easily to ensure systems remain secure if new cryptographic vulnerabilities are discovered. This is done primarily through configuration without requiring major software or hardware updates. For more information, see ITSAP.40.018 Guidance on becoming cryptographically agile ^{Footnote 7}.

4.3 Backups (CP-9)

Backing up your organization’s information is another step that you can take to protect information. When you back up your information, you are creating a duplicate copy that is stored in a different location. Your organization should determine an appropriate storage location based on your risk assessment and the level of sensitivity of the information.

Backups protect the availability of information if a system is down or compromised. For example, if your organization is the victim of a ransomware attack, you have a separate copy of the information that has been encrypted by a threat actor. If data is lost, you can use the backups to recover the data and continue with business activities.

5.1 Enterprise mobility models (MP-7 and SA-9)

Mobile devices are essential to most organizations, but your organization needs to decide on the ownership model for these devices.

There are four different enterprise mobility models that your organization should consider. Choose a model that best suits your business objectives, security requirements, and risk management framework. The four models include the following:

• Corporately Owned for Business Only (COBO)
• Corporately Owned and Personally Enabled (COPE)
• Choose Your Own Device (CYOD)
• Bring Your Own Device (BYOD)

You should clearly define the mobility model that your organization has in place, ensuring that it aligns with your policy requirements and that employees understand the implications of the model. When choosing a model, ensure that you consider the following aspects:

• Which type of devices are included in this model (e.g. provider, smartphones, tablets, laptops, and other IoT devices)?
• Who is responsible for paying for the device?
• Who manages the devices and who is responsible for supporting it?
• Which applications are authorized to run on the devices?
• How tightly is the device integrated into the enterprise network?

Although there are benefits to integrating mobile devices in the workplace, you need to balance this integration with the ability to reduce risks associated with having unmanaged devices connect to your network.

When deploying mobile devices in your organization, you should consider the risks and benefits of various deployment models. If it makes business sense, your organization should provide equipment (e.g. servers, desktops, laptops, mobile devices) to employees, using a device management framework and a configuration change management process. If your organization chooses to allow employees to use their personal devices for business, you should implement a strict control policy and review technologies and legal requirements for segregating business and personal information. Your organization can use unified endpoint management (UEM) to maintain the security of mobile devices. UEM combines features from mobile device management and enterprise mobility management processes.

5.1.1 COBO model

In a COBO model, mobile devices are supplied and owned by your organization. This model prohibits the use of personal devices for work purposes and the personal use of work devices. If it makes sense in your environment, we recommend that you provide employees with the equipment they require for their work (e.g. servers, desktops, laptops, mobile devices) because it provides your organization with more control over the security controls that are implemented on devices. You can also install antivirus software and other protective measures to secure the devices.

5.1.2 COPE model

In a COPE model, your organization provides employees with devices, but you also allow employees to use these devices as personal devices. With COPE equipment and devices, you have more control over the security controls that are implemented. Additionally, when an employee leaves your organization, you keep the equipment and devices.

You should ensure that sensitive information and your corporate IT infrastructure are secured appropriately. We recommend that you ensure that work and personal data, including applications, email accounts, and contacts, are separated on these devices. There are different solutions available that you can use to separate personal and work data. Some examples of solutions include using separate apps for work or using a secure folder or locker functions for sensitive business information. You should ensure that all sensitive data is encrypted and securely stored.

Your organization needs to take additional measures to protect mobile devices, as they are at a higher risk of being exploited by threat actors than organization-owned devices (e.g. desktops and laptops) that are only used within the workplace and on your organization’s networks.

5.1.3 CYOD model

In a CYOD model, you allow your employees to choose from a list of devices that your organization has approved for business use. Your organization selects the devices and continues to manage them, which means that you have more control over the security controls implemented, the applications that run on the devices, and the functions that are available to users.

5.1.4 BYOD model

There are many reasons why your organization may want to allow employees to use their personal devices for work. With a BYOD model in place, your organization benefits by saving money that would otherwise be spent buying mobile devices for all employees and using up to date technology that employees are comfortable with.

However, your organization needs to consider the associated security risks before you tell employees that they can use their personal devices. While this section does not cover all the associated risks, you should consider the following:

• How will you manage and support different devices?
• How will you limit the information that is accessed or shared via personal devices?
• What technical controls (e.g. container applications, mobile device management) will you implement?
• What are your legal responsibilities for protecting personal information?
• How will you address security incidents if a personal phone is lost or stolen?
• How will you ensure that information on personal devices is backed up or wiped when an employee leaves the organization?

Conduct a threat and risk assessment (TRA) before you implement a BYOD model. Because the use of personal devices may have privacy impacts, you should assess the privacy risks that may be introduced.

You should also create a policy that informs users of the acceptable use of personal devices and their expected behaviours. Policies should be communicated to your staff through training programs so that you can ensure everyone understands their roles and responsibilities.

For more information on BYOD, refer to ITSM.70.003 End user device security for Bring-Your-Own-Device (BYOD) deployment models ^{Footnote 10}.

5.2 Travel and mobile devices

There are risks you need to consider if your employees are travelling with work devices. Individuals who hold senior or executive positions are at a higher risk of being targeted by threat actors. Keep in mind that, in some countries, hotel business centres and phone networks may be monitored, and rooms may be searched. When travelling, users should assume that there is no privacy in offices, hotels, Internet cafes, or other public areas.

When determining which locations are of concern, defining required configurations for the devices, ensuring that the devices are configured as intended before travel is initiated, and applying specific safeguards to the device after travel is completed.

Before travelling, you should determine whether the destination or the nature of the event is an area of concern and ensure devices are configured appropriately. You should advise employees to take precautionary measures by disabling features such as Bluetooth and wireless headset capabilities and backing up data on the devices that they are taking with them. Employees should be cautioned not to use unknown, unsecured, or public Wi-Fi networks.

When employees return from a work trip, your IT department should assess all devices before they are connected to organizational systems and networks. You should apply specific safeguards to devices once travel is complete. For example, specific safeguards applied to mobile devices upon return from travel include, examining the device for signs of physical tampering and purging or reimaging the hard disk drive. There may be some scenarios in which it may be appropriate to use dedicated travel or “burner” devices, or even to dispose of the device rather than allowing it back on your network.

6.1 Identify the associated risks (AC-20 and SA-9)

External information systems, such as Internet and Cloud service-based applications, can be cost-effective and efficient. However, your organization typically doesn’t have direct supervision or authority over the security controls implemented on external systems. For example, your organization is vulnerable to cyber attacks if employees are using their personal devices for work purposes and these devices have outdated or unpatched software or applications are in use without the proper permissions being assigned prior to employees’ use of the app. Another example of this is when employees in your organization use Internet-based platforms to share files or conduct video calls, as these platforms are not controlled by your organization’s IT security infrastructure or architecture. The less control you have over systems and devices that process, store, or transmit business information, the less confident you can be that the information is secure. It is recommended that your organization conduct a risk assessment and a supply chain assessment prior to sanctioning the use of personal devices, applications, or Internet and cloud-based systems for employee use. For more information on risk and supply chain risk assessments, see ITSG-33 ^{Footnote 2} and A cyber supply chain: An approach to assessing risk (ITSAP.10.070) ^{Footnote 11}.

Before contracting potential service providers, such as CSPs, you should identify the data that will be accessible to the service provider and the sensitivity level of that data. By understanding your data and its sensitivity, you can identify the security controls that are required to protect it appropriately.

Data sensitivity is measured by the impact a compromise would have on your organization’s ability to achieve its mandate. Data sensitivity is categorized as high, medium, or low:

• High (H): Compromise has a critical or a prohibitive impact on your organization’s ability to achieve its mandate;
• Medium (M): Compromise has a major impact on your organization’s ability to achieve its mandate; or
• Low (L): Compromise has a moderate impact on your organization’s ability to achieve its mandate.

Your organization is always responsible for protecting the confidentiality, integrity, and availability of your networks, systems, and information. To protect your systems from compromise, damage, or harm, you should only permit the use of an external system if you have verified that the system has security controls that are consistent with your security policies and plans. To verify the controls, you can, for example, use third party, independent assessments or attestations. Choose a method that suits the confidence level required by your organization.

Your organization may determine that there’s a higher level of risk associated with prohibiting the use of these devices; we recommend that you restrict the use of these devices in the following ways:

• ensure that approved security controls are implemented on devices before they can connect to organizational systems
• limit device access to certain types of information, services, or applications
• use virtualization techniques to limit processing and storage activities to your organization’s servers or other system components
• ensure users agree to your organization’s terms and conditions

When entering into an agreement with a CSP or managed service providers (MSPs), data storage should be discussed, and terms agreed upon. When data is stored outside of your organization’s infrastructure, you need to know where it is going to be stored, for example the geographical location of the CSP’s or MSP’s data centre. The location of your data is important, as data stored outside of Canada is subject to different privacy, security, and data ownership laws and regulations. Depending on the industry or the sector to which your organization belongs, the data may also be subject to different regulations and standards that govern the data’s retention, disclosure to third parties, and chain of custody. Ensure you document the terms of data residency in your service level agreement (SLA) with the CSP or MSP.

6.2 Document agreements (AC-20 and SA-9)

If using information systems that are owned, operated, or maintained by another organization or service provider, you should document all agreements with third parties. As an example, you should ensure that you have a SLA with CSPs. SLAs describe the level of service that you expect from the CSP. They also define expectations with regards to the performance of security controls, describe measurable outcomes, and identify remedies and response requirements for instances of non-compliance or security incidents. SLAs should be consistent with your organizational security policies and procedures. You should also review all agreements periodically.

Your organization and the service provider both have roles when it comes to protecting systems and data. Your organization is the data owner and is legally responsible for data security. Therefore, it is critical that you explicitly define your organization’s security requirements and ask a CSP or MSP the right questions before you sign on to use a service. Having this information will ensure that you define an effective service level agreement with third-party service providers.

7.1 Continuous monitoring (AU-1)

You should ensure that all endpoint devices are monitored continuously. By monitoring devices, you can detect and follow up on uncharacteristic behaviour or suspected compromises.

Your organization’s information systems should have audit logs to ensure that events (e.g. updates, changes, authentication attempts) are captured for future review. You should ensure that logs can only be accessed by authorized individuals. Keep in mind that if you have outsourced some services, then it can be more difficult to obtain the logs.

We also recommend using automated mechanisms, such as periodic scanning, to detect any unauthorized hardware, software, and firmware components within the information system. If unauthorized components are detected, you should disable their network access and isolate them (e.g. sandboxing).

8.1 Contact information

For more information on implementing the guidance included in this document or any of our other top 10 IT security actions, email or phone our Contact Centre:

Contact Centre
email contact@cyber.gc.ca | Mobile 613-949-7048 ou 1‑833‑CYBER‑88