Return On Investment On Information Security Program

Security Management and Governance Program

Security Management or Corporate security is management arena that primarily focuses on welfare of resources in an organization. This means that assets will be protected digitally and physically. Security management is closely associated with risk management and aims at the development of different procedural methods that can help identify risks in the organization (von Solms, 2005). The analysis of risks and repetition of interconnected activities is achieved through security management. The risk management and security management have similar purposes. These can be avoided through the different risk problems. The organization undergoes various threats and different corporate problems can be avoided through the security management techniques. Security management ensures authorized access in the finance and information technology. This is interconnected with authorization management (Forte & Power, 2008).  

A security management program is a close connection between people, technology and processes. A Security management process is being used in medium and large corporate organizations. There are different reasons for implementation of security management, which is similar to risk management. Most of the organizations undergo through the problems of IT security and implementation for the security solutions becomes a necessary aspect.

In this context, the benefits can be described as below-

1. Corporate preparation for auditing and compliance requirements-The company needs to employ the statutory officer or legal officer for the purpose of making informed decisions regarding the critical information about business organization.
2. Operational efficiency- The Company needs to adopt the defensive mechanism for minimizing the external threats of different cyber-crime.
3. Increased security posture- Informed security decisions are necessary for the risk assessment and a main requisite for the implementation of management, operational and administrative controls (Radbruch, 2006).
4. Accountability to shareholders-Information security is an IT responsibility. Every personnel of the organization are responsible for the protection of assets. It is the responsibility of the business managers to delegate this responsibility.
5. Policy development process-the corporate organizations try to enhance their credibility and create trust among the shareholders. The trust and credibility are two factors that can run the business and smoothen the policy development process.
6. Communication process and enforcement of security management policy(Humphreys, 2008)-The corporate organizations generate awareness among the employees and stakeholders involving security risks and concerned with security management policy and risks (Brown, 2006).

Security Management plan for a corporate organization is listed below-

1. Mission Statement- The organizations must be committed towards creating a healthier environment and that should be enacted by the best people, procedures as seen by the health care communities.
2. Vision Statement-The organization must be the eminent health care system. The organization must maintain the balance with the financial resources. The system must be able to identify the healthcare needs and that must be enhancing the health status and quality of life across the different regions (Mouratidis, Jahankhani & Nkhoma, 2008)
3. Objects of the Organization-A safe and secure environment must be created for the organization. The establishment of safety and security management procedures that are based on monitoring along with the evaluation of potential hazards is required. It is essential to provide for the security programs through which risks can be reduced. The organization needs to provide a physical environment that reduces the hazards (Kim & Chang, 2013).
4. Scope- The security management plan is applicable to all the departments and staffs and health care coverage must be provided for 24 hours and seven days in a week. The officials are required to perform the duties and must not engaged with any police action.
5. The Responsibility of the company-The organization officials are responsible for creating the best environment and effectively create the safety management program. Overall evaluation of all the responsibilities are required to be done.
6. Annual evaluation of security management plan-This security management plan is based on the evaluations that requires the safe and security and management along with the performance needs of the corporate organization.   
7. Reporting-The reporting has to be done to the safety committee and this also needs to be reported to quality council. (Drugescu & Etges, 2006)

1. Understanding the complexity-The identification of organization assets is a complex task. This is followed by the information classification or asset categorization and risk assessment done for the purpose of identification of risks and rate system so effective controls can be achieved.
2. Development, documentation of requisite policies- A key component is documentation of requisite policies. Identification of most important requirement is necessary different types of security levels are necessary for protection of data (Harnesk & Lindström, 2011).

    Tasks

1. Information audits and security
2. Network security
3. Identity Management

1. Business continuity and fraud prevention-The security management policy needs to identify the different security levels for protection of data. Identification of security issues is necessary through the secured environment.
2. Social Engineering-The process of creating procedure and establishment of controls that reserves information and provide privileges to the employees. The key elements are operational security staff that prevents unauthorized access. Organizational capabilities must be enhanced for checking the performances of organization personnel (Libeau, 2008).  
3. Security Leadership-The security leadership involves the measures undertaken for the protection of equipment, personnel and property. This requires effective use of literature and achieve enhanced security by proven technologies and systems. This is inclusive of active and passive measures. Different technologies and systems are used for deter, detect, analyze the various risks.

1. COO-Chief Operating Officer
2. Security Management responsibility
3. Appointment of Safety officer
4. Ensuring compliance
5. Department Directors
6. Investigation of departmental incidents
7. Safety committee
8. Participation in implementation and planning process
9. Hospital Associates
10. Elimination of physical incidents
11. Prompt Reporting
12. Risk Manager and Safety Officer
13. Coordination with departmental directors
14. Management of ongoing processes (Shalamanov, 2017).

Security Management program model creates and validates framework which is followed through security blue-print and identification of security controls. The models are as follows-

1. BS77 99 Security standard model-This is one of the widely used security model for the security management. This was originally established as Bristish Standard. The recommendations are given by security management by those personnels who are responsible for implantation and initiation and maintaining security in the organization. An information management security structure is required to be set up. It is not as comprehensive when compared with the other frameworks. A lot of time is required for its adoption and this could have a lot of impetus on industry security control systems.  
2. NIST SP 800-12 and 800-14 security model-This provides an eminent guide on routine management for the information security process. The little information is provided in the design. This can be used as the supplement that will provide a deeper understanding on the terminologies and its background. Identification of different management controls has been done that will be addressed by security and will be executed through people. Technical control focuses on the security computer systems (Kim, Hwang & Rho, 2013).   

Security laws and procedures govern the procuring, transmit and retention of information in the system.

1. Unclassified Information-This requires a safeguarding compliance that is coupled with security controls and this depends on security controls. This is an authorized approach for creating the different set of requirements. The data security control is dependent on the specific category of unclassified information (Breaux, Antón & Spafford, 2009).
2. Educational Rights-The education records are needed to be maintained that are directly related with an educational institution or agency.
3. Regulation of general data protection-the organizations and companies need to protect the data that are located worldwide.
4. Payment protection- There are guidelines for the protection of credit card information and different departments cannot store the card-holder data. If the details of transaction records will be needed, then the last four digits of the card will be given.

1. Technical Benefits-An information security management is based on the IT system. There are business risks associated with different organizations and the IT losses are also the part of insurance coverage.
2. Operational Benefits- Information is destroyed to make it inaccessible that is being used by unauthorized persons. The operations department of an organization must have the regulation details for the prescribed information to be used by the company officials.  
3. Legal Benefits-It is mandatory for business organizations for modification of customer information, especially when records are not available. There are numbers of legal benefits associated with security management system. The insurance company needs to reduce the risk to accepted levels. Detection of legal risk is done in the initial stages. The cost of risk transference is lower. The business must have enough cash for operating the business. The potential changes in the organizational systems are required for compliance with legal and regulatory authorities (Smith, 2010).

The Risk Management plan can be summarized below-

1. Identification of risk- A risk can be described as an event that shall prevent the organization project from being progressed. Risks are identifiable from different sources. Risks will be identified in the due course of project life cycle. Few risks will be inherited to the project and few are the result of outside variables.
2. Analysis of Risk-The assessment is necessary as to determine when the risk will take place and what will be the impact over the event. It is necessary to have an understanding about the cause and effect associations. This will differ from one project to another.  
3. Risk ranking process-Risk ranking process involves ranking the risks, whether it is less likely to appear, frequent, occasional, improbable, seldom. The standard management project tools are used and different ratings are used.
4. Treatment of Risk-It is essential to identify the response of the risk and this could be done through the help of a project manager.
5. Risk Review- Risk review is an act of preparing the plan or series of activities that enhances project team to think in progression and decided which course of action to be taken.

1. Providing insights and support to corporate directors
2. Decrease of business liability

Contingency plan needs to be created for the risk analysis of an organization. This address all critical business operations. Identification of necessary resources-money, labor and other equipment. The emergency procedures must be defined with the necessary escalation procedures. Development of contingency plans is necessary with respect to regular reviews and update.

CBA-Cost Benefit Analysis -Cost Benefit Analysis is a procedural approach of measuring the business transactions and project investments (Michael, 2012).

1. Delayed Delivery-The assessment of threat in a given location or facility requires assessment of danger, risks, hazards and other criminal attacks to be examined by the supporting information.
2. Quality Control-Quality control check is one of the necessary aspects of the security management. The assessment needs to examine the supporting information or the purpose of evaluation of risk potential or indicator of hazards that may occur at a given facility.
3. Cost Control- The corporate organizations can undergo through the devastating effects and cost control departments need to assign a variable to every cost factor and determine its impact in the long term.
4. Description of risk factor or an event-Water impact, fire hazard or any other major cause can be the reasons. This requires implementation of security management system.
5. Schedule impact-This will have a lot of impact on the operations and scheduling of hospital, location or any factory. Schedule can be delayed by a few hours or a few days in a week.

1. The identification of risk- The project team member must have awareness of risk.
2. Risk registration- The personnel need to find which risk factor is having what impact on a given situation or event.
3. The assessment of risk- The assessment of risk is done by various factors. The major being certainty factor whether the risk will take place or not?
4. Risk Response-The different steps are required for mitigation of risks.
5. Contingency planning-A course of action needs to be determined in advance for contingencies that may occur any time (Klein, Ruiz & Hemmens, 2016).

1. Specification of analysis objectives- The objectives of the different projects must be recorded explicitly. This also includes market based alternatives during the time of its expansion.
2. Establishing the policy or project-Preparation of comprehensive list of assumptions and its predicting impacts. The personnel must be conducted for identification of impacts.
3. Adjustments of costs and risk benefits-All benefits and costs must be adjusted. This should be attributable to the different projects and project can be implemented in different stages and this is visible in the separate projects. Inclusion of all important implementation costs and effectively done on the completion of programs or project (Smith, 2010).

1. There must be specification of standing in all cost benefit analysis-Cost benefit analysis is an ongoing activity that will be undergoing throughout the complete project life cycle. This project involves the identification of risks, planning for the new identified risks, monitoring he triggered conditions and operating the risks on a regular basis.
2. The user must use official sources for projection of key variables-The project status will be containing the risk management as a key variable. New risks is present like probability and impact and this can change the project life and must be reported as well.

1. Requirement of justification and specification-The contingency risks can also be reflected in project, budget and this is mainly done for covering the unexpected expenses. The budget amount for any contingency is limited to the probability risks.
2. Ensure relevant consistency- The vendor needs to ensure the relevant consistency and estimate the risks, cost and this must be multiplied to the probability. Identification of all the transfer payments must be done for the purpose of distributional analysis. The usage of key personnel for identification of key variables. The reasons explanation is required for the usage of any estimate that are necessary as found out by the official sources. The time period consistency is required, which is relevant with base case. The consistency of the project evaluation is also necessary to the base case.  

Conclusion

Security Management aims at minimizing the system risks and protection of the integrity of systems software. Implementation of different models is necessary for information processing.

The corporate organization needs to identify the vulnerable threats and regular assessment must be performed. The assessment has serious potential impacts that may occur through the successful attack and implementation of security management system becomes a necessary aspect. One of the most important key concerns of vulnerability assessment includes the ratings for loss impact. The particular facilities can be assessed through different sources. Any facility can be damaged or contaminated. This includes the partial structure, smoke impact and the facility may or may not remain intact. The organizations may be required to move the assets to remote locations. The time can vary depending on the hazards at different location sites.

References

Breaux, T., Antón, A., & Spafford, E. (2009). A distributed requirements management framework for legal compliance and accountability. Computers & Security, 28(1-2), 8-17.

Brown, W. (2006). IT governance, architectural competency, and theVasa. Information Management & Computer Security, 14(2), 140-154.

Forte, D., & Power, R. (2008). Guaranteeing convergence in security management with consolidated log management. Computer Fraud & Security, 2008(7), 5-6.

Drugescu, C., & Etges, R. (2006). Maximizing the Return on Investment on Information Security Programs: Program Governance and Metrics. Information Systems Security, 15(6), 30-40.

Harnesk, D., & Lindström, J. (2011). Shaping security behaviour through discipline and agility. Information Management & Computer Security, 19(4), 262-276.

Humphreys, E. (2008). Information security management standards: Compliance, governance and risk management. Information Security Technical Report, 13(4), 247-255.

Kim, D., Hwang, E., & Rho, S. (2013). Multi-camera-based security log management scheme for smart surveillance. Security And Communication Networks, n/a-n/a.

Kim, Y., & Chang, H. (2013). Human centric security policy and management design for small and medium business. Security And Communication Networks, n/a-n/a.

Klein, M., Ruiz, L., & Hemmens, C. (2016). A Statutory Analysis of State Regulation of Security Guard Training Requirements. Criminal Justice Policy Review, 088740341666956.

Libeau, F. (2008). Automating security events management. Network Security, 2008(12), 6-9.

Michael, K. (2012). Security Risk Management: Building an Information Security Risk Management Program from the Ground Up. Computers & Security, 31(2), 249-250.

Mouratidis, H., Jahankhani, H., & Nkhoma, M. (2008). Management versus security specialists: an empirical study on security related perceptions. Information Management & Computer Security, 16(2), 187-205.

Shalamanov, V. (2017). Institution Building for It Governance and Management. Information & Security: An International Journal, 38, 13-34.

Radbruch, G. (2006). Statutory Lawlessness and Supra-Statutory Law (1946). Oxford Journal Of Legal Studies, 26(1), 1-11.

Smith, J. (2010). Getting the Right Balance: Information Security and Information Access. Legal Information Management, 10(01), 51.

von Solms, S. (2005). Information Security Governance – Compliance management vs operational management. Computers & Security, 24(6), 443-447.

Order an Essay Now & Get These Features For Free:

Turnitin Report

Formatting

Title Page

Citation

Outline

Place an Order