Security Mgt U10, world class security infrastructure

Security Mgt U10, world class security infrastructure

1. ISO ceritifcation benefits

   • business partner trust
   • customer confidence
   • leverage for security programmes
   • mgt attention for deficiencies
   • public recognition
   • efficient, low cost
   • more control for external auditors

2. importance of security is rising

   • increasing threats
   • increasing expectations
   • increasing exposure

3. cyberspace wars

   • kinds
     • espionage
     • sabotage
     • deception
   • knowledge has become power
     • power struggles over control of information
   • information has become increasingly available
     • growth in information brokering

4. cyberterrorism

   • growth of diversity
     • growth in extreme advocates
   • globalisation of IT
     • terrorists acquire IT capability
     • terrorism becomes transnational

5. challenges to secure environments

   • vendors' intrinsic security
   • interoperability, manageability, scalability

6. good architecture

   • anticipates problesm
   • avoids single points of failure
   • extends across enterprise
   • flexible
   • continuous improvement
   • long-lasting infrastructure

7. important control areas

   • technology
     • applications
     • architecture
     • infrastructure
     • adopted standards
       • Security Mgt U10, Be pragmatic about technology standards (chart)
   • people
     • Security Mgt U10, select appropriate style of guidance (chart)
     • org structure
     • roles and responsibilities
     • culture & attitutdes
     • skills & training
   • processes
     • compliance
     • procedures

8. 3 dimensional risk assessment

   • project
   • value chain
   • asset

9. incident response scope

   • Security Mgt U10, Scope of Incident Response (chart)

10. because of deperimiterization, we need...

    • industry standards
    • assurance processes that build trust across boundaries
    • agreed protocols & strength of mechanisms
    • reconized classification schemes for data, systems and connections
    • consistent user authentication standard
    • common security policy definition language