Establishing an Organizational Security Framework
Those who work in security and systems administration could spend every hour of every day down in the trenches dealing with the latest threat, reconfiguring devices, patching applications, and telling others to stop downloading non-work related material from P2P networks. At some point though, many of us will be asked to step back and look at the big picture and answer questions like how do we better manage our security operations? how do we decide where to invest in countermeasures? who should be responsible for different aspects of security and compliance? and so on.
There is no easy answer and every organization needs to work through these questions but an article 16, Elements of Organizational Security, in the The Essentials Series: Messaging and Web Security Volume II has tip to helps get the process started. The article includes tips on:
1. Focusing on risk, not just compliance and certifications
2. Sharing responsibility for security
3. Using composite metrics to measure effectiveness
4. Using realistic and enforceable metrics
5. Introducing security initiatives along with other organization or department level
initiatives
You might also be interested in article 7, Measuring Security: Application Metrics, which is also available in The Essentials Series: Messaging and Web Security Volume II
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
