Download to read offline
Uploaded byAbidullah Zarghoon
Role management
The document discusses various topics related to role management in IT security, including: - IT security roles such as the chief security officer, security engineer, and information security analyst. - Where the IT security department should be located within an organization, including options of being within the IT department, outside of IT, or a hybrid solution. - The importance of top management support for IT security, as well as developing relationships with other departments such as HR, legal, and audit. - Outsourcing some IT security functions to managed security service providers or other firms to leverage external expertise, though all controls should not be outsourced.
More Related Content
Role management
- 1.
- 2. What to expect? Understanding organization IT Roles Where to locate IT security? Top Management Support Relationships with other departments Outsourcing IT security
- 3. Understanding Organization Comprehensivesecurity is not possible without proper security staff Their placement Relationships with other organizational units Requires proper planning and allocation
- 4. IT Roles ChiefSecurity Officer The title usually used for head of security department Application security engineer Application security engineers maintain computer applications and software. They spend almost all their time in an office environment, with most of their work involving writing and testing software. Security engineer Security engineers are responsible for creating and implementing solutions that ensure an organization’s products and systems are secure.
- 5. IT Roles Networksecurity engineer Network security engineers play an essential part in the deployment, configuration, and administration of network- and security-related hardware and software. This includes firewalls, routers, network monitoring tools, and VPNs (virtual private networks). They are also tasked with performing network security risk assessments, and might be asked to help design network infrastructure. Information security analyst Information security analysts are responsible for examining security problems and finding solutions. Their duties include researching the industry, finding security threats, and developing strategies to ensure their organization remains secure.
- 6. IT Roles SecurityManager The title given to the responsible body of organization to manage security IT security specialist IT security specialists analyze an organization’s cybersecurity posture and its past breaches to understand how incidents occur and what needs to be done to prevent them. Given that IT and cybersecurity are such broad topics, organizations will usually have many IT security specialists, each one focusing on a specific area.
- 7. Location of ITSecurity Department
- 8. Within IT Department Placing the IT security department within the information technology department is attractive because security and IT share many of the same technological skill set. Report to the responsible of IT of the organization directly, for instance, Chief Information Officer (CIO). CIO will be accountable for security breaches CIO will support the security department to create safe IT infrastructure Easier to implement security changes. Dependent of IT department
- 9. Outside of ITDepartment Easier to deal with other departments Enforce security policies on IT department as well Mostly advised option Conflict with the IT department
- 10. Hybrid Solution Rolesegregation Operational aspects are divided IT maintains devices such as firewalls and others Planning, policy making and auditing relates to security
- 11.
- 12. Top Management Support Top management support is crucial to the success of any security program. IT security is hard to succeed unless top management gives strong and consistent support. Support of top management will help in the following: Budget Support in conflict Setting personal examples
- 13. Relationships with otherDepartments
- 14. Special Relationships Tobe successful, the IT security department must develop productive relationships with other departments. Some departments in an organization are of special importance to the IT security department
- 15. HR Department Therelationship between HR and IT security should be rich. HR is responsible of security training programs. Controls the process of recruitment and termination of employees. IT security should be involved in the recruitment and termination process to ensure security issues are taken into account. HR is involved in penalities when employees break security rules.
- 16. The legal Department Legal department deals with all the issues related to a countries law and regulations. It is important to have good relationships with legal department Legal department should ensure that security policies are legally sound The legal department should be involved if security incident happens
- 17. Audit Department Mostof the big companies such as banks have internal audit department. This department examines organizational units for efficiency, effectiveness and adequate controls. The IT audit department examines the efficiency, effectiveness and controls of processes involving information technology. IT security audit is usually placed under one of the audit departments. Not the IT security department This makes the IT security audit independent of IT security department
- 18. All other departments The security department should have good relationships with all the departments in the organization Security department is not about developing and distributing policies to other departments Other departments does not trust security department because security makes life harder It is important to have good relationships with other department to have a conflict free and successful security
- 19.
- 20. Outsourcing It isnot common to fully outsource IT security However, it is an option Most companies outsource some of the IT security This allows companies not to lose control of their security
- 21. Email Outsourcing Themost common IT security outsourcing is for email Email connections to and from the Internet are routed through the outsourcer The outsourcer provides inbound and outbound filtering This avoids spam and malware in attachments and scripts in email bodies Outsourcing email filtering is effective because filtering is becoming a highly specialized field Email filtering relies on rapid response to new threats Lists of dangerous email sources are updated hourly or even more rapidly
- 22. Managed Security ServiceProvider This is outsourcing alternative to delegate even more controls to an outside firm This firm is generally known as Managed Security Service Provider (MSSP) MSSP places a central logging server on your network. Ther server uploads the firm’s event log data to MSSP site. Security experts and security scanning programs checks the logs and alert in case of an incident
- 23. Why use MSSP? Security experts are expected to sit idle most of the time because incidents do not happen regularly Internal security experts might not be as capable as the MSSP security experts due to the extent of security events MSSP handles every day. MSSP is independent and will not make exceptions in the companies policy for any top management staff MSSP can observe the IT staff of the company
- 24. Continued All controlsshould not be given to MSSP Policy development and planning are very important for the organization to handle Contract should be specific even in simple matters MSSP should be regularly checked with Poor job by MSSP can cause great damages to the company
- 25. IT Asset Management(ITAM)
- 26. What is ITAM? IT Asset Management (ITAM) is defined as the set of business practices that join financial, contractual and inventory functions to support lifecycle management and strategic decision making for the IT environment in support of the organization’s overall business objectives.
- 27. Why do ITAM? Manage IT Assets so that maximum value is gained from the use of the assets across the lifecycle and beyond Value is: • Financial accountability • Risk reduction such as through proper disposition of waste • Efficiency, performance • Customer satisfaction • Control, long-term manageability
- 28. Key Process Areas AcquisitionManagement Disposal Management Policy Management Asset Identification Documentation Management Program Management Compliance Management Financial Management Project Management Communication and Education Management Legislation Management Vendor Management
- 29. To Manage orNot to Manage? Cost of asset Volume in the environment Life expectancy Risk factors if not managed Security risks Loss of productivity Sarbanes Oxley & other legislation Redeployment Leased Mobility of asset Cost of building the IT asset management processes
- 30. Commonly Managed Assets Software – Licensing compliance risk – high cost and audits Mainframes – high cost Laptops – mobility, cost, risk factors Desktops – redeployment candidate, often leased BYOD devices – risk factors Telecom – division of ownership Servers – cost, risk to business continuity Should we Manage? Printers Monitors Hub, routers, firewalls
- 31. IT Asset ManagementPolicies Policies govern behaviors within the organization. The purpose of asset management policies are to have assets that are: Trackable Maintainable Cost effective Used for the good of the organization Topics are many times buried in policies with other names such as Security, Acceptable use, Disaster Recovery, Expenses, etc.
- 32. Policy Topics forAsset Management Privacy – no expectation of privacy Prohibited use – limitations on use of equipment and or software Personal use – rules for use non-business Use of non-corporate assets on the network – BYOD devices and software allowed? Dialing in from home? Physical security of the equipment – loss and theft prevention, usually in the Security policy Commitment to energy conservation – Energy Star program, monitor sleep settings Environmental Self Audit – policy for disclosure, escalation methods
- 33. End of Lifecycle Redeployment Retirement Re-use
- 34.