Security Risk Management

The purpose of this qualitative study is to identify the IT leaders who have successfully implemented security policies and procedures. Using the quantitative methodology would not be appropriate because the collected data will not be in the form of numbers and/or statistical results, and the statistical findings will not generalize the real-world problem that needs to be resolved. (Creswell, 2014). Quantitative methods are used mainly to find out the who, what, when and where and the results numerical descriptions provide where the researcher needs more of a detailed narrative (Sutton, & Austin, 2015)

Both Security Management and Prevention are categories that should be included in any review or audit process of IT systems. SM reviews how security is managed from the top down. The how and if management supports the ISMS program is identified. The overall management of the company and how services are provided are essential. Prevention looks at the performance and maintenance of IT systems and the reporting of these processes. It is extremely important to have these categories as part of the ISMS process and any review of these processes.

Whitman, M. E., & Mattord, H. J. (2010). Management of information security (3rd ed.). Boston, MA: Course Technology.

Assess the adequacy and effectiveness of the organization’s IS security policy. In addition, assess whether the control requirements specified in the organization’s IS security standards adequately protect the information assets of the organization. At a minimum, the standards should specify the following controls and require them to be applicable to all information systems:

Author Petri Puhakainen classified sixty-four InfoSec awareness tactics from the viewpoint of design theory with an emphasis on kernel theory (Puhakainen, 2006). Puhakainen felt that in addition to recognizing numerous IS security awareness approaches, a profounder comprehension of these approaches is of significance (Puhakainen, 2006). Lack of comprehension of the existing InfoSec awareness approaches is apparent, for instance, in the use of methods unsupported by sufficient empirical data on their pragmatic efficacy (Puhakainen, 2006). Moreover, lack of comprehension can become obvious in the use of proposals that do not fit the culture of the organization in question (Puhakainen, 2006). Suitably, kernel theories reel on

After the information system is installed, the IS security controls must be monitored and assessed on a continuous basis. Continuous monitoring ensures the security controls in place are effective. In this step, there are five tasks. The first task requires managers to determine the security impact based on the threat environment. The second task is conducting assessments on certain security controls as outlined in their Continuous Monitoring Strategy. The third task is correcting discrepancies found in the assessment. The fourth task requires updating the Security Authorization package based on the previous results. The fifth task requires the appropriate officials to make a risk determination and acceptance by reviewing the reported security

While all of these technologies have enabled exciting changes and opportunities for businesses, they have also created a unique set of challenges for business managers. Chief among all concerns about technology is the issue of information security. It seems to be almost a weekly occurrence to see a news article about yet another breach of security and loss of sensitive data. Many people will remember high profile data breaches from companies such as T.J Maxx, Boston Market, Sports Authority, and OfficeMax. In the case of T.J. Maxx, a data breach resulted in the loss of more than 45 million credit and debit card numbers. In many of these incidents, the root cause is a lack of adequate security practices within the company. The same technologies that enable managers can also be used against them. Because of this, businesses must take appropriate steps to ensure their data remains secure and their communications remain

Previous studies showed that the more an organizations’ top leadership engage in creating the information security environment, the more employees are willing to be compliant with the policies (Chen, Ramamurthy, Wen, 2012). This is because more commitment, monitoring and training are being in place with respect to information security policy and preparation. Therefore, in this study the three hypotheses will be a positive relationship between management engagement, regulation and training of information security and employees compliance with these policies.

Since E-Commerce and technology evolves every day, developing a team or process to stay on top of potential business risks associated to security.

12. Why is a methodology important in the implementation of information security? How does a methodology improve the process?

While it lessens the burden on organizations, reducing and shifting the cost and risk of its IT operation, security and management issues to an external service provider or vendor, outsourcing any portions of an organization's Information System has significant risks that can sometimes become detrimental to the outsourced organization. According to the Commission on Government Outsourcing, "when outsourcing an organization exposes itself to significant risks in terms of security, accuracy, and completeness of information (Holroyd City Council, 2008)". Comprised in the rest of this document is an

Security risk management is “the culture, processes and structures that are directed towards maximizing benefits and minimizing disbenefits in security, consistent with achieving business objectives”. (Australia, 2006) And where

In order to effectively implement security governance, the Corporate Governance Task Force (CGTF) recommends that organizations follow an established framework, such as the IDEAL framework from the Carnegie Mellon University Software Engineering Institute. This framework, which is described in the document “Information Security Governance: Call to Action,” defines the responsibilities of (1) the board of directors or trustees, (2) the senior organizational executive (i.e., CEO), (3) executive team members, (4) senior managers, and (5) all employees and users. This important document can be found at the Information Systems Audit and Control Association (ISACA) Web site at www.isaca.org/ContentManagement/ContentDisplay.cfm?ContentID=34997.

One well accepted description of risk management is the following: risk management is a systematic approach to setting the best course of action under uncertainty by identifying, assessing, understanding, acting on and communicating risk issues. In order to apply risk management effectively, it is vital that a risk management culture be developed. The risk management culture supports the overall vision, mission and objectives of an organization. Limits and boundaries are established and communicated concerning what are acceptable risk practices and outcomes. Since risk management is directed at uncertainty related to future events and outcomes, it is

Top down has strong upper management support, dedicated funding, clear planning and the opportunity to influence organizations culture, whereas Bottom up lacks a number of critical features such as participant support and organizational staying power.