Information Security IBK3IBV01 College 3 Paul J. Cornelisse.

Information SecurityIBK3IBV01 College 3

Paul J. Cornelisse

Organization of Information Security

The Internal Information Security Organization


• To protect their information assets, public and private organizations need to consider how best to manage their information security efforts


To ensure comprehensive protection for all the organization’s information, the approach should address information security comprehensively, organization-wide


• An enterprise-wide approach also facilitates management oversight and coordination of information security efforts


• The design of the information security management framework should ensure it is properly tuned to the operational needs of the organization, which should primarily focus on the management of risks to its information assets


• The design of the information security function must provide a management framework

• The framework permits• effective initiation• Implementation• and control

• of information security activities within the organization


This includes• Planning• Coordination• management

of major information security projectsas well as

• Monitoring• Measuring• Tracking


• As well as overseeing the implementation of all aspects of the organization information security program


To have the requisite level of authority, the information security function must• be led by a member of the organization’s

management staff• be positioned in the organizational

management structure where the visibility of information security can be ensured


• Today, leadership of the information security organization resides at the executive level with most large organizations.

• The position is that of the Chief Information Security Officer (CISO)


• The process of organizing information security must address factors such as • its mission• its composition• its placement within the organizational

structure• its authority towards other elements of the

organization• its responsibilities• the functions it must perform• its lines of communication and coordination


• Based on knowledge of the current state of the organization’s information security posture, as well as the future state, organizations must then perform a

• gap analysis • to identify unmet requirements, and a

path forward for meeting them


• The organization should clearly define the boundaries of the information security function to address interfaces with other internal elements that perform security-related functions


These may include:• information technology operations • personnel security function• privacy staff• the physical security office


Relationships should be documented in coordinated operational agreements • charters• concepts of operations or CONOPs• procedures, etc.


Management Support• Management must also recognize • its own responsibility for information

security by communicating this fact both in written and oral means


It is within management’s purview to ensure that the goals for the security of organization information are established through • strategic and tactical planning • maintained, emphasized, and measured


• Management must act to ensure the organization has a mechanism for creating an information security policy that facilitates goal achievement


Management must ensure:• the approved information security policy

is properly implemented

and consequently must take action to• ensure that it has a mechanism for

monitoring implementation activities for effectiveness


Organizational management must • render appropriate direction and support

for initiatives relating to its information security program


• awareness campaign• rollout of a new security strategy• introduction of a new security process or

solutionThrough such efforts, management can promote and foster a culture of security


The security of organization information requires a multidisciplinary approach involving:• all organizational elements• personnel

• engage expertise available within the organization to include:• the general counsel• public affairs• facility security and

engineering• personnel security• union management• human resources• Training• Contracting

• Finance• internal audit• information technology

operations• system development• capital planning• Insurance• enterprise architecture• Privacy• and records

management


The objective of cross-organization coordination should be collaboration and cooperation.



Contact with AuthoritiesContact with Special Interest GroupsManagement AuthorizationConfidentiality AgreementsExternal PartiesAssessment of External Risks

Volgende week: Cryptology

Sleep de afbeelding naar de tijdelijke aanduiding of klik op het pictogram als u een afbeelding wilt toevoegen

Information Security IBK3IBV01 College 3 Paul J. Cornelisse.

Documents

Transcript of Information Security IBK3IBV01 College 3 Paul J. Cornelisse.