smartTrainee

	Total Number of Subscribers: 962


Date:19^th February 2010	Compiled by: M Sathya Kumar
CISA & IT security professionals must evolve for changi= ng market IT security awareness is = at an all-time high, and organizations are spending and hiring in record numbers. Legislation and regulations are proliferating. Yet, for all this effort, nearly every statistical measure of IT security performance ̵= 2; from the number of incidents and vulnerabilities to the cost and impact o= f a security breach — is bad news. In what other endeavor would so much investment be permitted with such poor results? The potential for disrupt= ion from malicious or accidental threats is growing, yet our ability to manage risk has never been more uncertain. Throwing more money at IT security wi= ll not close the gap. Why has this happened? There are many reasons be= hind the disconnect between effort and results. Security is still not a major design criterion in products, and connectivity is increasing at exponenti= al rates with the move to mobile platforms. Additionally, security architect= ures were mostly developed by vendors interested in providing a rationale for = the sale of products and are not based on a thorough analysis of risks and threats. Arguably, the most significant disconnect is also the most common misconception in IT securi= ty — that it is a technical problem requiring a technical solution. The technical disconnect For too long, IT security= has focused on technology and minimizes or completely ignores other critical elements of risk management: people, policy, process and technology. Alth= ough many IT security functions pay lip service to these concepts, little is d= one to implement each element equally. Security is multidimensio= nal, requiring a variety of skills. In addition to technical know-how, security professionals must work in a competitive business environment and do so i= n a legal and ethical manner. People skills require everything from proficiency in communicating complex issues with non-technical executives, to demonstrating the expertise required to interview suspects and witnesses.= Successful security professionals analyze risk beyond its simple technical components and incorporate defensible business impacts to justify budgets and educate decision-makers. Litigation and regulation= are now firmly entrenched in IT. Electronic discovery is the new gold rush in= the legal profession, and responding to discovery orders of digitally stored information has become a major concern for the general counsel's office. = Finally, investigations of security incidents require extreme legal caution. A patchwork of federal, state and international torts and laws now govern everything from requirements, to report security breaches, to issues involving workplace privacy, searches, monitoring of communications and invasion of privacy. = The inexperienced IT security practitioner is in a legal minefield and probab= ly doesn't even know it. The recent allegations of improper investigation of= HP board members are a case study in how easily simple investigations can be= come a legal and public relations nightmare. A more mature IT security: Convergence and certification Executives dependent on IT for competitive advantage confront an increasing requirement to manage ri= sks crossing functional boundaries. Two initiatives are underway in the secur= ity profession that will meet these challenges and change the way we do busin= ess: convergence and certification. The traditional model of separate functions for corporate security, physical security and IT secur= ity is wasteful and hinders organizations from managing cross-functional risk= s. Corporate or physical security functions are converging with IT security = and corporate risk management.<= /span> The most visible example = of this is the position of chief security officer (CSO) and the increased investment in implementing converged security programs. The Alliance of Enterprise Security Risk Management (a coalition of international security organizations ASIS, ISACA and the Information Systems Security Associatio= n) recently published a report titled "Convergence of Enterprise Securi= ty Organizations," <= /span> The second initiative, professional certification, address the needs of converged security by go= ing beyond demonstrating simple technical competence to recognize the broader skills required to make risk-based decisions. Examples of these newer certifications include ISACA's Certified Information Security Manager (CI= SM) and the Association of Certified Fraud Examiners' Certified Fraud Examiner (CFE). These certifications requ= ire both knowledge and experience in multiple skill domains of their respective disciplines. Experience-based certifications help organizations hire the most qualified individuals and address due diligence requirements, and they will become a job requiremen= t. The future= The future is now. IT security engineers and managers who do not develop the competencies requi= red to incorporate legal, business and investigative skills will increasingly find their career opportunities limited. Organizations are looking for be= tter results in managing risk and looking to do it for a lower cost. Contrary to popular opini= on, these are not mutually exclusive. To accomplish it, a stronger security profession is required that understands and works with strategic decision-makers to effectively manage risk across all security domains. -Kent Anderson is = the founder and managing director of Network Risk Management LLC and a member= of ISACA's CISM Certification Board.


Rewards waiting for feedback at E-m= ail : smarttrainee@gmail.com

= www.primeon= linetest.com
Disclaimer: We believe that the information contained in this e-zine is true. If you do not wish to recei= ve Smart Trainee please click here.
= Prime Acade= my - In Pursuit of excellence

<= span style=3D'font-size:7.5pt;font-family:"Verdana","sans-serif"'>Click here to contact us, if you are unable to view the content properly