Cis 519 Week 3 Individual Assignment

In this paper I will be discussing some of the benefits of having frameworks for information security management. What each of the frameworks of information security are, their pros and their cons. Which major perspectives to consider in information security management and framework choice. What organizational factors should be considered in framework choice? I will also attempt to come up with a better framework for information security.

The framework for this analysis is straightforward. The FBI must define the information security environment it wants to create by identifying information policies, specific threats, and secure usage assumptions. The Bureau must assess threats that existing security countermeasures do not counter and information security policies that are not being enforced. The FBI can then select programs, tools, and technologies to sustain its security environment (Fox,

A SaaS solution will provide automated pre-built business process solutions (solution including: Human Capital Management, Sales Force Automation, and Business Intelligence). Bill has many business processes that need to be automated through information technology, and these solution will not only help Bill in managing his business, it will also save him time to focus on improving his current and future business strategies.

All organizations should have an effective IT security policy framework to creating a security program to meet the needs of the organization to protect information and their information systems. There are many security frameworks that can be used to design an IT security program such as NIST and COBIT being a few. It is very important to establishing compliance of IT security controls with U.S. laws and regulation. The organization can align the policies and controls with the regulations. There are seven domain in the framework and each have their own challenges. There are issues and challenges with implementing a security policy framework and ways to overcome these problems.

In recent years the role has evolved from a pure security focus to identification and management of the organization’s business and operational risks. It goes beyond architecture and technology to address risks to the business and represent cybersecurity concerns and issues for organizational decision-making.

Cincom Systems is a global provider of enterprise software for many of the world's largest manufacturers and defense contractors. Their approach to defining an IT Security Plan is defined in this document as is the definition of their Disaster Recovery Plan (DRP). As Cincom is a global leader in the development and implementation of enterprise software, the focus of this IT Security Plan details how to best secure and protect not only their core intellectual property (IP) but that of their customers as well, many of which are government agencies headquartered both in the U.S. and throughout the world. The most effective IT Security Plans and Policies both support and streamline the attainment of corporate objectives over time (Johnson, 2011). Information security is crucial for the overall development of an effective strategic plan as well, concentrating on how enterprise systems can be extended, enhanced while also better aligned to the specific needs of global expansion in a business (Merkow, Breithaupt, 2006). As Cincom operates in 17 different nations and continually invests in new application development to support many foreign governments' information systems and defense-related needs, there is a corresponding increase in the level of security its systems must also deliver. The intent of this analysis is to define how Cincom can become more effective in managing potential threats, and also how it can use a

The business scenario method for understanding and defining the business requirements by properly addressing the architectural methods.

AUS-SMAT Framework ‎was developed by NICTA organization‎‎[7]. It aims to develop a framework for scope, cost and effort for SOA projects. In this framework the SOA project is decomposed into its constituent services. Each service is classified to its type either: service mining, service development, service integration or application development. Each service type has its own specific activities, templates, cost factors and cost functions. The overall cost of the project will be a summation of the cost of its constituent services.

SABSA concentrates on the utilization of "best practices" for any association that needs to create data security arrangements and traceable business undertaking activities. SABSA gives coordinated structures, models, systems, and courses of action that are danger centered and location both dangers and opportunities. The SABSA technique utilizes a "business-driven methodology" comprising of a "six-layer model covering each of the four sections of the IT lifecycle: Strategy, Design, Implementation, and Management & Operations."

The task of risk management has perplexed many organizations. Organizations have to make important decisions which will ensure their assets (data) are secure. Not only do organizations have to be concerned with risk management but they are also tasked with ensuring their systems are compliant. The article “When it comes to enterprise security is it better to focus on compliance or risk”? discusses which area should be considered a higher precedence compliance or risk. The author Christian Anschutz, of the article is SVP and former CIO of Underwriters Laboratories. The article focuses on security, technology and financial risks. Has the author taken into consideration underlying circumstances in which organizations are not able to place one area above another? What are the industry standards? Who enforces these standards? This paper will focus on hazy task of organizational risk management and compliance.

Designing a working plan for securing the organization s information assets begins by creating or validating an existing security blueprint for the implementation of needed security controls to protect the information assets.  A framework is the outline from which a more detailed blueprint evolves.  The blueprint is the basis for the design, selection, and implementation of all subsequent security policies, education and training programs, and technologies.  The blueprint provides scaleable, upgradeable, and comprehensive security for the coming years.  The blueprint is used to plan the tasks to be accomplished and the order in which

Information security is one of the weakest links on the information system management. Thus, non-technical managers lack knowledge on the subject. This increases the risk of threats by driving them to comply with the organization security policy. To protect, the organization information security assets, non- technical managers should be exposed to the three main areas of accountability such as Confidentiality, Integrity, and Availability (CIA). By doing so, it helps to create a pro-active environment to preserve the confidentiality of the information, maintain its integrity, and also ensure its availability. Since the value of information is so high, companies are thriving all the time to develop

SaaS is a method of software that allows data to be accessed from any device with an internet connection. In the web-based model,

In today’s complex IT system because of the wide abundance of threats and deliberate attempts to attack networks and IT assets, it is crucial to have a stream-lined process which attempts to incorporate security as an integral part of the development process as opposed to including security measures after the development cycle has finished. System Development Lifecycle (SDLC) is a hypothetical method created for the design and step-by-step implementation of general information system in business organizations using six different phases. Security System development lifecycle (SecSDLC) uses the same six phases to implement the security project except that its intent and scope is specific to the particular threats identified and designing

SaaS is becoming an increasingly prevalent delivery model as underlying technologies that support Web services and service-oriented architecture (SOA) mature and new developmental approaches, such as Ajax, become popular. SaaS is closely related to the ASP (application service provider) and On Demand Computing software delivery model