Information Security Program high-level slidesA repeatable process and customizable/adaptable for any organization.
Subscribe to:
Post Comments (Atom)
Privacy matters! Risk Management is the apex for any InfoSec practice because what is identifiable is resolved by compliance, mitigation, or transference. To that point, I'd like to take a lighter note on Information Security as it pertains to real world activities and perspectives. Perhaps you'll share your experiences in the journey and not a destination security field of dreams ;)
Top 6 most ridiculous security statements…
- 6. Their is a Vulnerability Management Program however we don't track if/when vulnerabilities are fixed [response to questionnaire]
- 5. We are a small organization (of 4 IT responsible with read/write access to volumes of U.S. PII data) but we don’t see the need for separation of duty--nor is there independent logging...just all with elevated privileges [small financial firm]
- 4. I don't understand why screen saver passwords is needed when we all know each other here [hospital executive on an administrative floor with no physical security and practicing open door policy—by leaving office & floor doors opened/unlocked]
- 3. I am not worried about PCI...it is a requirement that will fade and wane in a couple years [VP of IA some years ago]
- 2. Would we really know what kind of “sensitive” data was on the misplaced item [comment on a possible leakage scenario]
- 1. What is your company's contingency plan if the public Internet goes down for all of the U.S.? [external auditor]
Security tool belt
About Me
- Rich's Column
- Windy City, United States
- I.T. professional currently championing information security and privacy management...from a business risk and emerging technology perspective with a strong financial, regulatory and auditing background. {Find your voice then help others find theirs}
No comments:
Post a Comment