Two years of Applying ITSG-33: Report from the Trenches

No ratings

Presented at CounterMeasure 2014 by

François Marinier

As an IT security analyst, I have spent most of the past two years applying key processes and activities of ITSG-33 to real-life IT projects. From new infrastructure services to mission-critical business applications to changes to existing information systems, I had many opportunities to put ITSG-33 guidance to the test and measure how effective it can be at improving information system security in today’s Government of Canada IT landscape. In this presentation, I will share with you my experience during the last two years of applying ITSG-33 guidance to support IT projects. Departmental security control profiles, departmental threat assessments, system-specific security controls, system security engineering, threat and risk assessments, security assurance, security assessment and authorization, and capability maturity are on the menu. I will talk about what I did, what worked and what didn’t and why, some lessons learned, and my thoughts on where organizations should go with ITSG-33 moving forward.