Information Security as a Risk Category, Not a Technology Problem

Information security protects three properties of information: that only the right people can see it, that it has not been altered, and that it is there when needed. Information security is a risk category rather than a technology problem because most of what protects those properties is a decision about who may do what, taken by people who do not work in technology at all.

Almost everybody arrives with the same habit of mind, and it has to go first. Asked what protects a bank's information, most people describe equipment. Something at the edge of the network, something that scrambles a file, something that watches traffic. All of that equipment exists, and information security is none of it. Information security is an exposure: something that can go wrong, that has a named owner, that is written into a policy, that gets measured, that is reported to a committee, and that turns up in a loss record filed under somebody else's heading. Read that way, information security stops being a specialist subject and starts behaving exactly like every other exposure in risk management.

Everything below rests on separating the asset from the machine. The asset being protected is information and the ability to act on it, not the equipment it happens to sit on. Once that separation is held, the controls stop looking technical at all. Who is allowed to do this. Who checks. Who loses access when somebody leaves. How quickly a change of circumstances reaches the systems. Each of those is a process question with a named owner, and the failures at this invented bank occurred in exactly those questions. How any given technology works is a separate subject. The exposure is the one that gets governed.

What does information security actually protect, and from what?

Start away from any bank. A household keeps a folder of papers: a school certificate, a property deed, a small ledger of who was lent what. Three separate bad things can happen to that folder and they are genuinely different bad things. A visitor can read the ledger and learn what the household would rather nobody knew. Somebody can quietly alter a figure in it, so the record still exists and is now wrong. Or the folder can be locked in a cupboard on the one morning the deed is needed at a registrar's counter. Nothing was stolen in the third case and nothing was read. The information was simply not there at the moment it was wanted.

Information securityThe protection of three properties of information: that only the right people can see it, that it has not been altered, and that it is there when needed. is the protection of exactly those three properties, and the reason to name them one at a time is that a subject with three named properties is a subject controls can be built against. A subject described as machines is a shopping list. Naming the three is what stops the whole discipline turning into an inventory of equipment. Confidentiality is that only the right people can see it. Integrity is that it has not been altered. Availability is that it is there when needed.

The three sentences have something in common. Not one of them mentions a machine. Each is a statement about the information itself and about the ability to act on it. The separation between information and machine is what everything below depends on, and it is also why the controls that follow are almost all decisions rather than devices: a list of who may see a customer record, a rule that a change leaves a trace, a check that the list is still right this month. At Vindhya Commercial Bank Limited, invented, the same three properties carry the same three questions, and the bank writes them into policy PL7, its information security policy, one of the nine policies numbered PL1 to PL9.

Unless one boundary is drawn now, the third property swallows the subject. Availability as a property is in scope: whether the information is reachable at all. Availability as a service promise, meaning how long an important business service may be down before somebody must act, is a different measurement kept in a different record and covered in the resilience subject area. The first two properties, and the access decisions that sit under all three, carry the rest of the argument.

Why is it a risk category rather than a technology problem?

A risk category is not a topic. A risk category is an object with a specific set of parts, and the test of whether something is one is simply whether all the parts are there. Does it have a definition that separates it from its neighbours. Does it have a named owner who can be asked about it. Does it sit somewhere in the taxonomy the institution uses to insist its list of risks is complete. Is there a policy. Is there a committee that receives it. Does it produce losses that land in the loss record. Information security passes on every part of that test, and passing every part is the whole argument.

At this invented bank the parts look like this. The definition is the three properties above. The taxonomy places it inside operational risk, at level one category TX4. Policy PL7 is the information security policy. Process PR9, access management and information security, is one of the nine processes numbered PR1 to PR9 across which the bank assesses its key controls, so the controls are counted and rated exactly as the controls over lending or settlement are. Committee G8, the information security committee, six members, receives it. Every structural part that makes credit risk a risk category is present here too. Treating information security as somebody else's technical specialism is therefore a governance decision and not a description of the subject.

The consequence is practical rather than philosophical. Treated as a technology problem, the questions asked are about equipment, and the answers come from people who can only speak about equipment. Treated as a risk category, the questions become the ones this material asks of every exposure. What is it. Who is the owner. How much of it is acceptable. Which controls sit against it. How much has it cost. Which indicator moves before it costs anything. Where is it reported and how often. Those questions are asked below, and two of the answers at this bank are uncomfortable.

Where do this bank's information security losses actually land?

Here is a question that sounds administrative and is not. If information security is a risk category, where in the loss record do its losses appear? Because the labelling scheme in use has no heading for them, the honest answer at this bank, and at a great many real ones, is that they appear nowhere as such. Operational losses at Vindhya Commercial Bank Limited are filed against seven event categories, and the seven are the Basel Committee's, published by the Bank for International Settlements at bis.org. The seven are internal fraud, external fraud, employment practices and workplace safety, clients products and business practices, damage to physical assets, business disruption and system failures, and execution delivery and process management. Read that list again looking for information security. Information security is not there.

So the losses go somewhere else. Incident I7 at this invented bank, in month 7, was a phishing campaign against internet banking customers that reached 312 customers, who were reimbursed. Gross loss Rs 1.8 crore, recovery Rs 0.3 crore, net loss Rs 1.5 crore. Incident I7 is filed in category 2, external fraud, and the classification is perfectly correct: an outsider took money by deception. The same event is also, unmistakably, a failure of the first property: people who should not have been able to act on customer information were able to act on it. One event, two true descriptions, and only one of them can be the label in the category column.

The consequence follows immediately. Total the category column at this bank and information security comes to nothing at all. There is no line to total. Read the thirteen incidents one by one and the year contained at least one, at Rs 1.5 crore net. The two readings of one record disagree, and the second reading is only available to somebody who has been told to go and read. The practical meaning of a category that exists in the taxonomy and not in the labelling scheme is this: the number has to be built by hand every time anybody asks for it.

Two smaller points sit underneath. First, an availability failure would land in category 6, business disruption and system failures, so if the third property is included the reading gets wider still. Whether the year's two category 6 incidents belong to this subject is a judgement the record does not settle. The unsettled judgement is precisely the difficulty rather than a gap in the case. Second, the loss record is not the only record, and it is not even the most informative one on this subject. The event that says the most about access management at this bank cost nothing at all, so it appears in no loss figure anywhere. The event turns on access management, and access management needs a name first.

Every figure is the invented bank's own at month 12. The rupee column ties exactly to Rs 43.8 crore. The seven printed shares add to 99.9 per cent rather than 100.0 because each is rounded to one decimal; the exact shares do sum to 100.0, and no share has been adjusted to force the column.

What is access management, and why is the leaver the hard one?

Think about the keys to a small shop with four people working in it. Somebody joins and needs a key. Somebody moves from the counter to the stockroom and needs a different key, and the counter key should come back. Somebody leaves and the key should come back on the last day. Three events, three actions. Every shopkeeper knows the third is the one that goes wrong: the first two have somebody standing there wanting something, and the third has nobody wanting anything at all.

Access managementThe process deciding who may do what in which system, and keeping those decisions current as people join, move and leave. is that shop problem at institutional scale. Access management is the process deciding who may do what in which system, and, far more importantly, keeping those decisions current as people join, move and leave. Process PR9 at this invented bank carries exactly that, alongside information security more broadly, and it is one of the nine processes across which the bank counts its key controls. Notice how little of it is technical. Access management is a set of decisions about people and duties, written down, and a set of checks that the written record still matches reality.

The three events are not equally difficult and the reason is structural rather than cultural. A joiner has a start date, a manager who wants them productive, and somebody chasing until the access is granted. There is a person in the room whose day is worse until the thing happens. A mover is harder. The new access has somebody chasing it and the old access has nobody, and the classic result is a person who accumulates the rights of every desk they ever sat at. A leaver is hardest of all. On the day the access should end there is nobody left in the building who benefits from it ending. Every incentive in the joiner case runs the right way and every incentive in the leaver case runs the wrong way, and no amount of reminding people changes that arithmetic.

So a leaverSomebody who has left the institution, whose access should end at the same moment and often does not. is somebody who has left, whose access should end at the same moment and often does not. Everything that follows is about the gap between those two moments: how long it is, what decides its length, and what would close it rather than shorten it.

What is privileged access, and why is it treated separately?

Not all keys are the same. The shop has a key to the front door and a key to the safe, and somebody with the second one can do things nobody can undo. Privileged accessAccess that can change a system rather than merely use it, which is why it is granted narrowly and reviewed separately. is the second key. Privileged access is access that can change a system rather than merely use it: create accounts, alter what a control checks, change a rate table, switch a setting off. A person using a system leaves a trail through it. A person who can change the system can, in principle, change the trail itself.

Privileged access is granted narrowly and reviewed separately for a reason of consequence rather than suspicion. An ordinary account left open after somebody leaves is an exposure with a ceiling on it. A privileged account left open has no comparable ceiling: its reach includes the arrangements that would otherwise notice. The difference between ordinary and privileged access is not how much damage is likely but how much of the institution's own ability to detect sits inside the reach of the account. An institution that reviews all its accounts on one cadence has decided, without saying so, that those two things deserve the same attention.

How long can an access failure sit open, and what decides that?

Now the worked instance, and it carries the whole argument. In month 10 at Vindhya Commercial Bank Limited, a privileged access account belonging to a leaver stayed live for 46 days. The quarterly access reviewA periodic check that the access actually granted still matches the access that should be granted. found it. An access review is a periodic check that the access actually granted still matches the access that should be granted. The account had not been used for anything. Nothing was lost, nothing was reimbursed and no customer was affected. The event is near miss N5 in this bank's register of five near misses.

Because nothing was lost, it appears in no loss record at all. Near miss N5 is not in the Rs 43.8 crore of net operational loss for the year, it is not in any of the seven event categories, and a reader who only ever sees the loss report will never know it happened. A near missAn event that could have produced a loss and did not, which therefore appears in no loss record. is an event that could have produced a loss and did not, and the only place this one exists is a register somebody chose to keep. Keeping it cost nothing. One consequence is worth sitting with: the most informative event on this subject in the whole year was free to collect.

Now the arithmetic, and it changes what the 46 days means. A detective controlA control that finds the wrong thing after it has happened, whose usefulness is bounded by how often it runs. is one that finds the wrong thing after it has happened, and its usefulness is bounded by how often it runs. A review run every c days leaves a window of at most c days. Nothing can wait longer than c days before the next look. Suppose an account becomes wrong at a point in the cycle as likely to be one day as another. The assumption is the reader's own rather than a measurement this bank made, and on it the average window is c divided by two. A quarterly cycle is about 91 days. Half of 91 is 45.5.

Near miss N5 ran 46 days. The 46 days is half a day off the average the control was designed to produce, so it is not carelessness and not an outlier: it is the design working exactly as designed. The people who ran the quarterly review found the account precisely when the cadence said they would, and the length of the window was decided long before, by whoever chose quarterly. One honest refinement separates a real argument from a neat one: on a flat assumption every length from nil to 91 days is as likely as every other, so 46 is no more probable than 12 or 80. The cadence fixes two things: the ceiling, at 91 days, and the average, at 45.5. Nothing about 46 needs explaining once those two numbers are known.

Because the relationship is arithmetic and not judgement, it moves in a completely predictable way. The review cycleHow often a periodic control runs, which sets both the worst case and the average length of the window it leaves open. sets both numbers at once. Weekly, meaning about every 7 days, gives a worst case of 7 days and an average of 3.5, and the review is run 52 times a year. Monthly, at about 30 days, gives 30 and 15.0, run 12 times a year. Quarterly, at about 91 days, gives 91 and 45.5, run 4 times. Half yearly, at about 182 days, gives 182 and 91.0, run twice. Both lines are straight and both start at the origin, so halving the cycle halves the window and doubles the work in the same movement.

The observed window in near miss N5 was 46 days, on the quarterly cycle in the shaded row, against that row's average of 45.5 days. The 46 in the first column of the third row is a different object: it is a review cycle of 46 days, a setting of the dial that this bank does not run, and its own average window is 23.0 days. Reviews a year is 365 divided by c rounded to the nearest whole review, so a cycle of 46 days gives 7.9 and prints as 8.

What is the difference between a control that prevents and a control that finds?

Back to the shop, where the distinction is easier to see with keys than with accounts. One arrangement is that the manager counts the keys every Saturday evening and gets the missing one back on Monday. Another arrangement is that the door lock is changed at the moment somebody stops working there, so there is no missing key to count. The first arrangement can be run more often. The count can be run every evening. The count cannot, however often it runs, stop the key being outside the shop between the moment the person leaves and the moment somebody counts.

A preventive controlA control that stops the wrong thing happening at all. stops the wrong thing happening at all. A detective control finds it afterwards. Institutions need both, and neither is better than the other. A specific structural difference in what each can achieve is at issue, and the arithmetic makes that difference exact rather than rhetorical. Moving the access review from quarterly to weekly takes the average window from 45.5 days to 3.5, a fall by a factor of thirteen. The number of reviews rises from 4 a year to 52, a rise by the same factor of thirteen. The two factors are the same number and always will be. Both quantities are set by the same single dial and move in exact opposite proportion to each other.

Multiplied together, the point becomes unmissable. The average window is c divided by two and the reviews a year are 365 divided by c, so their product is 365 divided by two, being 182.5, whatever c happens to be. Quarterly: 45.5 times 4.011 is 182.5. Monthly: 15.0 times 12.167 is 182.5. Weekly: 3.5 times 52.143 is 182.5. The product does not move because it cannot move. A reader who redoes it with the rounded review counts given above gets 182, 180 and 182 rather than exactly 182.5, and the gap is the rounding of the count and not a wobble in the relationship.

The fixed product means that a detective control has a floor built into it that no amount of effort reaches. A shorter window can be bought with more work, at a completely predictable exchange rate, and a window of nothing can never be bought at any price. A preventive control does not sit on that curve at all. A feed from the joiner, mover and leaver process that removes the access at the moment somebody leaves does not shorten the window. The feed means there is no window at all: the action happens before the thing a review exists to find. The feed is a different control, not a faster version of the same one, and the difference between preventing and finding is exactly this.

Why does no review cadence ever close the window?

The answer is in one sentence and it is worth reading twice: a detective control cannot act before the thing it detects. Everything else follows. However short the cycle, something has to go wrong first and then be found, and the interval between those two events is the window. Set the cycle to a single day and the window is up to a day and averages half of one. Set it to an hour and the same structure holds at a smaller scale. The only way to reach nothing at all is to stop asking the question periodically and to attach the action to the event instead.

At this invented bank that would mean a feed from the joiner, mover and leaver process. The moment somebody's departure is recorded in the record that already exists, the access ends. Notice that this is a process design question and not a technology question. Somebody has to decide that the departure record is the trigger, somebody has to own the completeness of that record, and somebody has to decide what happens when the record is late. The control that would close the window is built out of the same material as the control that leaves it open: decisions about who does what and when.

There is one more thing this bank already has, and it is the measure that would show the trigger working. Its risk dashboard carries sixteen indicators. Eleven of them are lagging counts: losses booked, breaches recorded, issues overdue, complaints received, all of which describe a quarter that has already happened. Five are genuinely leading, meaning they move before the loss, and one of the five is the age profile of open access rights. An age profile is exactly the right shape of measure for this subject: the profile moves the day an access right starts getting old and does not wait for anybody to lose anything. A count of access incidents describes last quarter. An age profile shows what is building now.

Who governs this at the bank, and where does that committee report?

Because the shape of the arrangement is the finding, the governance of information security at Vindhya Commercial Bank Limited is worth listing plainly, part by part. Policy PL7 is the information security policy. Process PR9, access management and information security, is where the controls sit and get counted. Committee G8, the information security committee, has six members and meets quarterly. G8 reports into committee G6, the operational risk management committee, rather than into the board. G6 has eight members and meets monthly.

Neither of the next two facts is remarkable alone, so they are worth putting side by side. First, G8 meets four times a year, the fewest meetings of any of this bank's eight committees: the board itself and the two board committees each meet six times a year, three management committees meet monthly and one meets fortnightly. Second, the access review that decides the length of every access window also runs four times a year. The table that could change the cadence sits on the same cadence as the control it would be changing, and nobody chose that: it is what two independent decisions about meeting frequency happened to produce.

The reporting line matters for a different reason and it is not a criticism. Reporting into G6 is defensible and common. Information security is an operational risk and G6 is the operational risk committee, so the subject reaches a table that also sees the loss record, the near misses and the self assessment. The arrangement also means that information security reaches the highest table in the institution at second hand, through another committee, and only when that committee decides to carry it. Naming where a committee reports is part of describing a risk, not an aside. The reporting line decides who ever hears about the risk.

Where do an Indian bank's obligations on information security come from?

Everything above holds without reference to a jurisdiction. Three properties, a set of decisions about who may do what, a control that prevents and a control that finds, and an arithmetic relation about cadence: none of that changes with the country. The country decides what an institution is actually obliged to do. The obligation is a different question with a different answer, settled at the sources named below.