Information Security Management: Learning from Leading OrganizationsJack L. Brock, Jr. DIANE Publishing, 2000 - 68 páginas With the dramatic increase in computer interconnectivity & the popularity of the Internet, the ultimate success of many of these efforts depends on an organization's ability to protect the integrity, privacy, & availability of data & systems. The information must be readily available with few disruptions in the operation of computer & telecommunications systems. While many factors contribute to information security deficiencies at federal agencies, the problem is that senior officials have not established a framework for reducing security risks associated with their operations. This report studies organizations that have superior security programs to identify practices that could be adopted by federal agencies. |
Contenido
| 5 | |
| 14 | |
| 20 | |
| 21 | |
| 23 | |
| 26 | |
| 27 | |
| 28 | |
| 47 | |
| 48 | |
| 49 | |
| 50 | |
| 51 | |
| 52 | |
| 53 | |
| 54 | |
| 30 | |
| 31 | |
| 32 | |
| 33 | |
| 35 | |
| 36 | |
| 38 | |
| 41 | |
| 42 | |
| 43 | |
| 45 | |
| 56 | |
| 58 | |
| 59 | |
| 60 | |
| 61 | |
| 62 | |
| 63 | |
| 64 | |
| 65 | |
| 66 | |
Términos y frases comunes
Assess Risk automated systems business managers business operations business risks business units central group central security group central security management Chief Information Officer CISSP Clinger-Cohen Act compliance Computer Security Control Effectiveness Determine Needs developed discussed efforts electronic employees Evaluate Point Promote example expertise federal agencies federal information security Financial Audit financial services corporation helped ensure identify important Information Management information protection information resources information security policies information security programs information security risks Internet levels below CIO monitoring tools NIST organization's information security organizational policies organizations we studied Paperwork Reduction Act Point Promote Awareness policies and controls policies and guidelines Policies and Related related controls relied reported Risk & Determine risk assessment Risk Management Principles risks associated security administrators security incidents security management groups security specialists security weaknesses senior executives senior security staff system administrators techniques university we studied users vulnerabilities
Pasajes populares
Página 45 - Information is a corporate asset .... Information must be protected according to its sensitivity, criticality and value, regardless of the media on which it is stored, the manual or automated systems that process it, or the methods by which it is distributed, " (2) outlined the responsibilities of information owners, custodians, and users, (3) defined the organization's three data classification categories, and (4) stated that each business unit should develop an information protection program to...
Página 27 - ... predetermined control requirements, as was the case at the financial services corporation and the manufacturing company discussed previously or (2) provided the results of risk assessments, as was the case of the utility company described in the following case example. According to the security managers, such sign-off requirements helped ensure that business managers carefully considered their decisions before finalizing them. A major electric utility company has developed an efficient and disciplined...
Página 9 - ... individual agencies. Although many of these recommendations have been implemented, similar weaknesses continue to surface because agencies have not implemented a management framework for overseeing information security on an agencywide and ongoing basis. A list of our previous reports and testimonies on information security is provided at the end of this guide. Requirements Are Outlined in Laws and Guidance The need for federal agencies to protect sensitive and critical, but unclassified, federal...
Página 19 - Establish a central management focal point 5. Designate a central group to carry out key activities 6. Provide the central group ready and independent access to senior executives 7. Designate dedicated funding and staff 8. Enhance staff professionalism and technical skills Implement appropriate policies and related controls 9.
Página 62 - We are on the verge of a revolution that is just as profound as the change in the economy that came with the industrial revolution. Soon electronic networks will allow people to transcend the barriers of time and distance and take advantage of global markets and business opportunities not even imaginable today, opening up a new world of economic possibility and progress." Vice President Albert Gore, Jr., in the Administration's July 1997 report, A Framework For Global Electronic Commerce To achieve...
Página 38 - The CISSP certification was established by the International Information Systems Security Certification Consortium. The consortium was established as a joint effort of several information security-related organizations, including the Information Systems Security Association and the Computer Security Institute, to develop a certification program for information security professionals.
Página 11 - ... programs in order to identify practices that could be applied at federal agencies. We focused primarily on the management framework that these organizations had established rather than on the specific controls that they had chosen, because previous audit work had identified security management as an underlying problem at federal agencies. Although powerful technical controls, such as those involving encryption, are becoming increasingly available to facilitate information security, effective...
Página 26 - ... Security manager at a major equipment manufacturer The organizations we studied were unanimous in their conviction that business managers must bear the primary responsibility for determining the level of protection needed for information resources that support business operations. In this regard, most held the view that business managers should be held accountable for managing the information security risks associated with their operations, much as they would for any other type of business risk....
Página 34 - Assessing risks and identifying needed policies and controls for general support systems, such as organizationwide networks or central data processing centers, that supported multiple business units. For example, some central groups controlled all new connections to the organization's main network, ensuring that the connecting network met minimum security requirements. Similarly, one organization's central group was instrumental in acquiring a strong user authentication system to help ensure that...
Página 15 - Maintain customer, constituent, stockholder, or taxpayer confidence in the organization's products, services, efficiency, and trustworthiness Protect the confidentiality of sensitive personal and financial data on employees, clients, customers, and beneficiaries Protect sensitive operational data from inappropriate disclosure Avoid third-party liability for illegal or malicious acts committed with the organization's computer or network resources • Ensure that organizational computer, network, and...