| Administrative Controls | | | Administrative controls are basically directives from the senior management that provide the essential framework for the organizations security infrastructure. Administrative controls consist of the procedures that are implemented to define the roles, responsibilities, policies and various administrative functions that are required to manage the control environment as well as necessary to oversee and manage the confidentiality, integrity and availability of the organizations information assets. Administrative controls can range from very specific to very broad and can vary depending on the organizational needs, particular industry, and legal implications. Administrative controls can generally be broken down into six major categories which include operational policies and procedures, personnel security, evaluation, and clearances, security policies, monitoring, user management, and privilege management. Ultimately, the senior management within an organization must decide what role security will play within the organization and define the security goals and directives.
Due care by definition is the care that an ordinary and reasonable person would take over their own property or information. An example of this would for a person to place documents that contain sensitive information such as social security cards, passports, etc. in a locked safe within their home. This measure is taken to ensure that only those individuals with authorized access can obtain those documents and view the sensitive information. Due care is a legal concept that is used to assist in determining the level of liability in a court of law. If it is determined that due care was taken then the probability of being found negligent and therefore being held liable for an incident taken place is much lower. Administrative controls key to the practice of due care. As stated in the previous paragraph, administrative controls are the essential framework for the organizations security infrastructure provided by senior management. Under the Federal Sentencing Guidelines, senior officials can be held personally liable if their organization fails to comply with any applicable laws and exercise due care. Through the application of administrative controls, senior management is able to set policies and procedures that outline how the organization will protect its informational assets. This in turn will provide guidance on the various methods that can be used from technical implementations, physical access to end user training that will be used to ensure the protection of the organizations information.
When the senior management within an organization fails to implement any form of administrative controls, they fail to set the necessary framework required to protect the organizations information. This failure on the part of the senior management not only opens the organization for liability issues, but also members of the senior management as they can be help personally liable for failure to take the necessary steps to ensure the protection of the information under their control. By failing to implement any form of administrative controls within the organization, then any security framework would cease to exist. Without this security framework, the necessary steps that are required to protect any information cannot be taken, therefore there is a lack of due diligence which therefore translates to a lack of due care. So since due care is a legal concept that is used to assist in determining the level of liability in a court of law, when there is a lack of due care then the organization and their senior managers can more than likely would be held fully liable for any and all damages that result from any incident that would take place.
Since administrative controls are the essential framework for the organizations security infrastructure they play an extremely important role in the choice of technical and physical controls that are put in place. For example, in the military where information has different classifications the requirements to have access to that information both physically and technically differ than information of a lower classification. How the information is classified and the requirements for access to various levels of classification are outlined by senior officials in administrative controls. Unclassified information, which can be accessed and obtained by everyone, has different technical and physical controls in place verses information that is classified as Secret or Top Secret. Without these administrative controls being defined by senior officials, the various types of information would not be able to be placed into a classification category such as unclassified, classified secret or classified top secret and the appropriate access controls, both physical and technical, could not be implemented to control access to the information.
The absence of administrative controls even impacts the various projects within the IT department. The reason that the absence of these controls impacts projects is that any project within the IT department touches and or manipulates organizational data. Since administrative controls contain policy and procedures defined by senior management on how organizational data will be secured, the absence of such policies and procedures means that there is no framework in place to provide guidance on how security will play a role or be impacted by any project. An example of how administrative controls affect an IT project would be the collapse and consolidation of a datacenter. As organizations look at ways to cut costs, many organizations look toward the concept of virtualization. Although relatively expensive to implement, the long term savings on equipment, power and cooling are quite considerable. However, going to a consolidated or collapsed datacenter that is virtualized provides some unique security challenges in and of itself. With information being consolidated and roles and responsibilities begging to cross, the lack of administrative controls makes it extremely difficult to define the lines or boundaries necessary to implement an effective security plan in the new environment. Although securing the data is a small portion of the overall project, not having a clear and concise understanding of the security needs to ensure that the organizational data is protected will stop the project in its tracks. This concept is not only true in the situation that I have outlined, but also true for any project that would take place in the IT department. Without definitive guidelines on how organizational data is to be protected it is impossible to ensure that any project initiated will be able to implement the proper technical and physical controls needed to protect the organizational data.
As we can see from the previous paragraphs administrative controls are truly the foundation of security for any organization and without the proper foundation, it is virtually impossible to implement any form of security within an organization. Much like a house or building must have a foundation to start from in order to be built properly, so to must organizational security. If the house or building is built without the proper foundation it will be unstable and fail. The same concept applies to security within an organization. When no administrative controls are clearly defined any other aspects of the organizations security are bound to fail due to the lack of appropriate guidance and support from senior management.

References

F.Tipton, H. (2010). Official (ISC)2 Guide to the CISSP CBK, Second Edition. Boca Raton, FL: Auerback Publications.
Harris, S. (2010). CISSPAll-in-One Exam Guide, Fifth Edition. New York, NY: McGraw-Hill.
Miller, L., & Gregory, P. H. (2010). CISSP for Dummies. Hoboken, NJ: Wiley Publishing.