University:
Boston University
Course:
QST SM 101 | Introduction to Management
Academic year:

2020
Views:

465

Pages:

19
Author:

sung2000wmym

SRM – Security Resource Management A Framework to Support Communications and Boost IT Security trite 2 trite: adjective lacking in freshness or effectiveness because of constant use or excessive repetition. Hackneyed. Stale. 3 2 trite themes we hear all the time in information Security 4 “We need to take a risk‐based approach to IT security” “We need better communications between IT and Management (Administration)” 5 Are these themes related? 6 Let’s Explore 7 Risk-based Approach to Security Management 8 Commitment to RBSM is high. “Respondents believe that risk assessments can help assign values to risk, obtain actual costs related to an incident and predict the frequency and impact of future security incidents.” 9 10 REALITY Only about half of the organizations in the study have a formal RBSM program. Most of these are only partially implemented. 11 12 Drill Down on the Details 13 14 15 2 Contradictory Statistics 16 87% of organizations are ‘committed’ to Risk‐Based Security Management Only 52% actually have a Risk‐Based Security Management program 17 Why? 2 Reasons 18 No Metrics “Without a scorecard difficulty getting senior level support, funding and resources.” No Framework “An effective RBSM framework aligns organizational effort, metrics, and indicators drives more effective security expenditures.” 19