University:
Boston University
Course:
QST SM 101 | Introduction to Management
Academic year:

2023
Views:

405

Pages:

23
Author:

cuelhenl02r

The Framework provided by an SRM system is necessary to support good Risk Based Security Management 53 “We need to take a risk‐based approach to IT security” “We need better communications between IT and Management (Administration)” 54 Top-Ten IT Issues in Higher Education  2007: #2 – “Security”  2008: #1 – “Security”  2009: #3 – “Security”  2010: #3 – “Security”  2011: #4 – “Security” 55 Top-Ten IT Issues in Higher Education  2012: SECURITY off the List Replaced by: “Establishing and Implementing IT Governance throughout the Institution.” 56 “Establishing an IT governance process is possibly the single most-effective step toward effective IT leadership because it will provide a framework for defining decisions around IT priorities and resource allocation.” 57 "Once a structure and process—a framework—is established, the institution can focus on the quality of decisions that flow from it. A good framework will result in decisions that are well understood and widely accepted." —Joseph Vaughan, CIO and Vice President for Computing 58 What do we need to support the communications necessary for good IT governance? 59 A Framework! 60 Where can we find such a Framework? 61 62 SRM Systems Provide a Governance Framework Facilitate Communications w/Administration IT Security Metrics Implementation of SRM Initial Commitment to RBSM 63 Better Communications and Management Support Summary Dashboards 64 Management Reports 65 Management Reports 66 The Framework provided by an SRM system is necessary to support good Communicatons and IT Governance 67 Review Let’s work our way backwards 68 Review  IT Security initiatives require the support and backing of the Administration  Support and backing are gained through communications and agreed-to IT Governance standards  IT Governance standards require a Framework  The Framework collects data necessary to support the Governance Standards 69 Review  Framework Data should include: Risk Gaps Compliance Gaps Progress in closing Gaps Identification of new threats and requirements on a regular basis 70 Review  Framework Data should be gathered by:  Identifying Authority Documents  Compliance requirements like FERPA, HIPAA, Mass Data Privacy  Best Practices like ISO 27001 Identifying Assets Containing Protected Information Evaluating Threats to that Data Identifying Appropriate Controls Assuring that those Controls are implemented 71 Review  SRM Systems Provide the Framework Help collect and organize Data Provide pre-mapped conditions for Threat -> Controls -> Compliance Requirements 72 Conclusion A Risk-based approach to IT Security management and Establishing better communications between IT and the Administration ARE Related 73 2 Final Thoughts 74 Get started today on truly implementing a Risk‐based framework for better IT Governance and better communications Thank you for your time and attention. 75