Evaluating Information Security Consultant

SABSA model is a method for developing enterprise information security architectures that are risk driven. Security infrastructure solutions are delivered. The primary characteristic of the SABSA model made some analysis of the business requirements for security, especially those in which security has an enabling function through which new business opportunities can be developed and exploited.

Whitman, M. E., & Mattord, H. J. (2010). Management of information security (3rd ed.). Boston, MA: Course Technology.

An effective information security program should include, periodic assessments of risk, including the magnitude of harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the organization. Policies and procedures should be based on risk assessments, cost effective reduced information security risk, and it should ensure that the information security is addressed throughout the entire life cycle of each and every organizational information system. Subordinate plans for providing sufficient information security for groups of the information system, facilities, networks, or information systems.

There are many costs and benefits to be considered when choosing a proprietary or contract security. When deciding on the type of security, be sure to weigh the positives and negatives of the different types and which can be more beneficial to the business. Each business will have its own personnel and facility knowledge. Proprietary security is more costly when replacing individuals. Contract security makes it easier to lower the internal pressures and provide services such as recruiting, training, supervision, security factors, uniforms, and the costs is lower than proprietary security. My recommendation as the security manager for the international automobile manufacturer is to utilize the contract security.

Assess the adequacy and effectiveness of the organization’s IS security policy. In addition, assess whether the control requirements specified in the organization’s IS security standards adequately protect the information assets of the organization. At a minimum, the standards should specify the following controls and require them to be applicable to all information systems:

An information security benchmark model (CIA) an acronym for information Confidentiality, Integrity and Availability can be used to evaluate the solution

This engineering standard provides a standardized collection of terminology related to systems and software engineering, as well as references to other source standards where the included terms may be actively defined.

Information security analysts have numerous roles in an organization or business. Some of the roles they have are to help create, implement, and maintain security for databases and other electronic assets. Monitoring and reporting security issues with detection and prevention of threats is the goal of professional security analysts. Security analysts will manage any networks, intrusions, and create prevention

The Information Security Team may request that additional security measures be implemented in addition to the measures stated in this document, depending on the nature of the project. The Information Security Team may change the requirements over time, and all ASP's involved are expected to comply with these changes.

Information security engineers ensure that an organization's data and sensitive digital information is kept safe from

Information systems are known to be at risk from malicious attacks, user error, and from other disasters. As technology is relied upon more heavily and computer systems become interdependent and accessible by more individuals, the susceptibility to threats increases. In addition, individuals are developing high levels of computer skills that results in an increased risk of intrusion from outsiders. The Information Security Risk Assessment will determine the assets of the company, organizational risks, the current security posture, any areas of risk for GDI, and recommend a mitigation strategy for reducing information security risks and implementing strategies to reduce these risks. Through the Information Security Risk Assessment, GDI is taking steps to ensure that the organization identifies significant risks and determines the best method to mitigate the risks.

NIST (2011), Managing Information Security Risk -- Organization, Mission and Information System View, National Institute of Standards and Technology Special Publication 800-39.

Question 3. Design an information security metrics program that would provide ChoicePoint executives with visibility into the effectiveness of the security program in preventing future data breaches. What information security metrics would you recommend and why? [20 points]

The survey went out to 5412 security practitioners and 351 experts returned the surveys (Richardson, 2011). The survey participants are people that have either attended a CSI event or have an interest in security and are concerned with making improvements to security. The survey is an anonymous questionnaire that provides information about what security specialists are facing in the industry. The responses come from specialists within from various different types of groups within the private and public

I have been charged with the task of identifying potential security weaknesses and recommending solutions for Quality Web Design (QWD). The project was completed in two phases. The first phase of the project specifically identified and defined two potential security weaknesses: software and policy. The second phase recommends solutions to these potential weaknesses. I chose a scenario that outlines specifics of the organization’s type of business, business processes, assets, services, and security controls.