Rating Security and Systems...

Is system security a technology or business (risk) issue? A question posed to top executives with over 55% answering that it is a technology issue - result from a KPMG study that also found that over 40 of top executives while concern with security the ability to manage security threats must improve.

Treating security as a measurable activity whose progress can be track and improve through management fundamentals. ISO/IEC 27002 can provide these fundamentals for management to track and improve security and technology relating issues. Once dressed with realistic metrics, the path to best security practices has commences.

Management should ask not only on the safety of information but ascertain that their organization understand what it takes for making IT safe and safer. Further, even know a level (metric) of security.

Whilst ISO/IEC 17799 provides fundamentals to measure how is the safety of our IT is doing, teamwork and knowledge are important for organizations to improve, innovate and perhaps invent (I³ - a BULLTEK GlobalNet modular technique) . Discontinuance of technology is one of the many challenges that today's enterprise phase, and measuring security within an continual moving target it's more of a challenge.

It is also of interest indicate that ISO/IEC 17999 | ISO/IEC 27001 is not the only scheme providing management and metrics fundamentals, also consider others:

• OCTAVE , Operational Critical Threat, Asset, and Vulnerability Evaluation
• IS.MS certification
• CIS, launch benchmark for Windows 2000 and Solaris plus VPN, routers and Firewalls
• Federal Information Technology Security Assessment Framework - US Government agencies methodology to assess IT security programs and pursuit improvement.
• DITSCAP (iaesa.disa.mil/ditscap), Department of Defense Information technology Security Certification and Accreditation Process - used by the DoD that documents, assesses and certifies the security of its computers systems before they're implemented and over the course of their use. This program pursuit, implements and practice a framework similar to ISO 17799.

Visit our GlobalNet Global Virus Map page, updated daily. 

For international certification of the information security management system, ISMS^®

Creating an Information Incident Team

By implementing an information security incident investigation policy and designating a incident response team will assist in mitigating and preventing intrusion and issue relating to information security. When provided by local authorities assure liaison with law enforcement. The action taken by this response team shall be objective, robust and viable to stand in court, as the need rises.

An investigative process may follow a simple three-step strategy:

1. Initial Analysis (and coordinate with those involved),
2. Identifying and implementing course of action to restore services promptly and safely, and
3. Identify and implement preventive actions.