Policy framework for security and privacy management

This document describes the problem space and solution requirements for developing an IP Security Policy (IPSP) configuration and management framework. The IPSP architecture provides a scalable, decentralized framework for managing, discovering and negotiating the host and network security policies that govern access, authorization, authentication, confidentiality, data integrity, and other IP Security properties. This document highlights such architectural components and presents their functional requirements.

Information technology security management (ITSM) entails significant challenges, including the distribution of tasks and stakeholders across the organization, the need for security practitioners to cooperate with others, and technological complexity. We investigate the organizational processes in ITSM using qualitative analysis of interviews with ITSM practitioners. To account for the distributed nature of ITSM, we utilized and extended a distributed cognition framework that includes as key aspects the themes of cues and norms. We show how ITSM challenges foster under-use of cues and norms, which comprises a type of risk that may result in outcomes that are adverse to the organization’s interests. Throughout, we use scenarios told by our participants to illustrate the various concepts related to cues and norms as well as ITSM breakdowns.

Information technology has become the core tool of business organisations'. External and internal threats as well as legal, regulatory and contractual compliance requirements are all combining to make effective information security a key information technology management challenges. This paper describes an undergraduate information technology security management course that provides comprehensive knowledge and skills necessary to manage both strategic and operational aspects of information security. The course covers a broad range of managerial topics in information technology security and makes use of a number of security tools and techniques to complement the theory taught. In this paper, we describe our approach, our experiences and lessons learned for teaching information technology security management course. The paper details the content of the course and outlines how it is taught and assessed.

Chapter 24 - Information Technology Security Management

Chapter 3 - Information Technology Security Management

While many organizations offer certifications associated with information technology (IT) security, there is no single overarching accrediting organization that has identified the body of knowledge and experience necessary for success in the IT security field. In order for an IT security workforce to be acknowledged and recognized throughout the world as possessing a proven level of education, knowledge, and experience in IT security, a formal process for certifying IT security professionals must be developed. This research effort suggests that the IT security community use the Project Management Institute’s process for certifying Project Management Professionals (PMPs) as a model for developing an open and easily accessible IT Security Body Of Knowledge (ITSBOK) and an associated international certification process for IT security professionals.

Information technology (IT) risk management plays an important role in controlling security and building confidence in using IT system services.Many organizations have focused on risk management for IT security.In this study the committee of sponsoring organizations of the treadway commission (COSO) enterprise risk management (ERM) was used in risk management by identifying risk factors in accordance with the requirements of COBIT 5 areas that need to be controlled.In addition, 2 experiments were conducted with 3 government organizations and 3 business organizations in order to evaluate the performance of IT security control.The first experiment identified the risk levels with risk assessment, which provided the risk levels that need risk response in accordance with COBIT 5 framework implementation life cycle.From the second experiment, it was found that the risk management using all 7 phases of the COBIT 5 implementation life cycle decreased the risk levels for both government and business organizations.However, moderate and low risk levels were still observed which need to be managed in order to keep them at a very low level.In addition, it was found that the risks of government and Business organizations were different, which was a result of differences in obstacles and the context of the problems encountered in risk management.The findings of this study provide the guidelines for developing a framework for IT risk management in the future.

18 - Windows Server 2003 Security Management

Chapter 9 - Corporate IT Security Project Plan

Assessing the value of information technology (IT) security is challenging because of the difficulty of measuring the cost of security breaches. An event-study analysis, using market valuations, was used to assess the impact of security breaches on the market value of breached firms. The information-transfer effect of security breaches (i.e., their effect on the market value of firms that develop security technology) was also studied. The results show that announcing an Internet security breach is negatively associated with the market value of the announcing firm. The breached firms in the sample lost, on average, 2.1 percent of their market value within two days of the announcement--an average loss in market capitalization of $1.65 billion per breach. Firm type, firm size, and the year the breach occurred help explain the cross-sectional variations in abnormal returns produced by security breaches. The effects of security breaches are not restricted to the breached firms. The market value of security developers is positively associated with the disclosure of security breaches by other firms. The security developers in the sample realized an average abnormal return of 1.36 percent during the two-day period after the announcement--an average gain of $1.06 billion in two days. The study suggests that the cost of poor security is very high for investors. rity, information technology security management, Internet security, security breach an-

Electronic health records are becoming increasingly common in the health care industry. Although information technology (IT) poses many benefits to improving health care and ease of access to information, there are also security and privacy risks. Educating health care providers is necessary to ensure proper use of health information systems and IT and reduce undesirable outcomes. This study evaluated employees' awareness and perceptions of the effectiveness of two IT educational training modules within a large publicly funded health care system in Canada. Semi-structured interviews and focus groups included a variety of professional roles within the organisation. Participants also completed a brief demographic data sheet. With the consent of participants, all interviews and focus groups were audio recorded. Thematic analysis and descriptive statistics were used to evaluate the effectiveness of the IT security training modules. Five main themes emerged: (i) awareness of the IT training modules, (ii) the content of modules, (iii) staff perceptions about differences between IT security and privacy issues, (iv) common breaches of IT security and privacy, and (v) challenges and barriers to completing the training program. Overall, nonclinical staff were more likely to be aware of the training modules than were clinical staff. We found e-learning was a feasible way to educate a large number of employees. However, health care providers required a module on IT security and privacy that was relatable and applicable to their specific roles. Strategies to improve staff education and mitigate against IT security and privacy risks are discussed. Future research should focus on integrating health IT competencies into the educational programs for health care professionals.

The increasing use of wireless technologies in enterprise networks demands strong security management and policy enforcement mechanisms. The conventional security management frameworks used in wired LAN do not suit in wireless domain due to dynamic topology and mobility of hosts. The enforcement of organizational security policies in wireless LAN requires appropriate access control models as well as correct distribution of access control rules in the network access points. In this paper, we propose a WLAN security management framework supported by a spatio-temporal RBAC (STRBAC) model. The concept of mobile IP has been used to ensure a fixed layer 3 address of a mobile host. Each wireless policy zone consists of a Policy Zone Controller that coordinates with a dedicated Local Role Server to extract the low level access configurations corresponding to the zone access routers. The system can be mapped into a reconfigurable hardware to exploit the parallelism in computing. We also propose a formal STRBAC model to represent the global security policies formally and a SAT based decision procedure to verify the access configurations

2 - Cross-sector security priorities and issues

Data breach incidents are on the rise, and have resulted in severe financial and legal implications for the affected organizations. We apply the opportunity theory of crime, the institutional anomie theory, and institutional theory to identify factors that could increase or decrease the contextual risk of data breach. We investigate the risk of data breach in the context of an organization’s physical location, its primary industry, and the type of data breach that it may have suffered in the past. Given the location of an organization, the study finds support for application of the opportunity theory of crime and the institutional anomie theory in estimating the risk of data breach incidents within a state. In the context of the primary industry in which an organization operates, we find support for the institutional theory and the opportunity theory of crime in estimating risk of data breach incidents within an industry. Interestingly though, support for the opportunity theory of crime is partial. We find that investment in information technology (IT) security corresponds to a higher risk of data breach incidents within both a state and an industry, a result contrary to the one predicted by the opportunity theory of crime. A possible explanation for the contradiction is that investments in IT security are not being spent on the right kind of data security controls, a fact supported by evidence from the industry. The work has theoretical and practical implications. Theories from criminology are used to identify the risk factors of data breach incidents and the magnitude of their impact on the risk of data breach. Insights from the study can help IT security practitioners to assess the risk environment of their firm (in terms of data breaches) based on the firm’s location, its industry sector, and the kind of breaches that the firm may typically be prone to.

This chapter explored communications security through the use of an empirical survey to assess the extent of network and data transfer security management in Ghanaian higher educational institutions. Network security management controls consist of monitoring of networks, posture checking, network segmentation, and defense-in-depth. Data transfer security management includes encryption, media access control, and protection of data from public networks. Data were collected from information technology (IT) personnel. The ISO/IEC 21827 maturity model for assessing IT security posture was used to measure the controls. Overall, the result showed that the institutions were at the planned stage of communications security management. In particular, network monitoring, defense-in-depth, and the protection of data from public networks were the most applied controls. Conversely, posture checking was the least applied control. Higher educational institutions need to review their communications security plans and better manage network and data transfer security controls to mitigate data breaches.