University:
Boston University
Course:
QST SM 101 | Introduction to Management
Academic year:

2022
Views:

430

Pages:

32
Author:

Elisa Morris

trite 2 trite: adjective lacking in freshness or effectiveness because of constant use or excessive repetition. Hackneyed. Stale. 3 2 trite themes we hear all the time in information Security 4 “We need to take a risk‐based approach to IT security” “We need better communications between IT and Management (Administration)” 5 Are these themes related? 6 Let’s Explore 7 Risk-based Approach to Security Management 8 Commitment to RBSM is high. “Respondents believe that risk assessments can help assign values to risk, obtain actual costs related to an incident and predict the frequency and impact of future security incidents.” 9 10 REALITY Only about half of the organizations in the study have a formal RBSM program. Most of these are only partially implemented. 11 12 Drill Down on the Details 13 14 15 2 Contradictory Statistics 16 87% of organizations are ‘committed’ to Risk‐Based Security Management Only 52% actually have a Risk‐Based Security Management program 17 Why? 2 Reasons 18 No Metrics “Without a scorecard difficulty getting senior level support, funding and resources.” No Framework “An effective RBSM framework aligns organizational effort, metrics, and indicators drives more effective security expenditures.” 19 Without a Framework Implementing Risk Based Security Management is a Daunting Task 20 21 Where do we Begin? 22 SRM Tools Can HELP: Security Resource Management IT Security Metrics Implementation of SRM Initial Commitment to RBSM 23 Better Communications and Management Support SRM is CRM for IT Security 24 SRM FRAMEWORK Threats Controls Risk 25 Things to look for in an SRM System 26 #1: Unified Compliance Framework Integration 27 UCF – Provides Detailed Mapping 28 Authorities -> Citations -> Controls 29 Regular Authority Updates 30 Vendors 31 RSA Archer Bwise LockPath TruOps TraceSecurity Vendors 32 RSA Archer Bwise LockPath TruOps TraceSecurity #2: Ease of Implementation Implementation of SRM Initial Commitment to RBSM 33