« SMART Goals Reduce Ambiguity and Increase Commitment
How Many Projects Are Too Many? »

The Security Triangle in Project Risk Management

January 6, 2009 | Author: PM Hut | Filed under: Risk Management

The Security Triangle in Project Risk Management
By Bernie L. Dixon

With any road map, you must first establish your starting location in order to plan out a route. In security, this start point can often be found in a guide to setting computer security policies and procedures, called RFC 2196, which states that a security policy is a formal statement of rules by which people who are given access to the IT resources of an organization must abide.Well, just what the heck does that really mean? Let’s break it down into smaller parts and form a triangle of the “people” and processes. First, who in the organization can put out formal rules that everyone within the organization must follow? That would have to be the owners as it is quite conceivable that they may have to prove in a court of law that they have protected shareholder investments in that company, which includes all network resources. So owners are responsible for policy, or what is expected in regards to security within the organization. However, policies typically are very high-level statements that don’t always indicate how we are going to get there in regards to security.

The Security Triangle in Project Risk Management

The Security Triangle in Project Risk Management

This is where procedures come into play. Procedures say how we are going to meet the “what” of policies. The custodians of the owners’ information assets and data are typically responsible for the procedures. The custodians are the security managers, network administrators, system administrator, and other administrative types that take the policies and determine how to best implement those requirements. The bridge that makes that happen is risk management.

Risk management takes into account several factors to determine actions necessary to reduce risk to an acceptable level. Finally, the last and most important piece of the triangle is the users, for they are the true implementers of security. Policies and procedures are not secrets. They must be disseminated to the users, and the users must have a buy-in. The users need security awareness training that includes how to use the security technology being put in place.

Bernie L. Dixon is a Certified Information Systems Security Professional (CISSP) and System Security Certified Practitioner (SSCP). He has over 30 years experience in the field of computer and network security, including cryptography. Bernie served 25 years in the United States Air Force, where his responsibilities included analyzing and resolving communications and computer security-related problems. Upon retirement, Bernie became the Manager of Information Protection for AT&T Technical Services in San Antonio, TX, where he was responsible for communications-computer security. After 3 years, he served as the Director of System Security for Access Research Corporation. Bernie started his own company in November 1997 and has done network security consulting for companies like TRW, Unisys, Ascend (now Lucent), Department of the Treasury, Department of the Air Force, and NSA. He wrote two security courses for Global Knowledge titled Designing Security Architectures and Check Point NGX CCSA/CCSE.

This article was originally published in Global Knowledge’s Business Brief e-newsletter. Global Knowledge delivers comprehensive hands-on project management, business process, and professional skills training. Visit our online Knowledge Center at www.globalknowledge.com/business for free white papers, webinars, and more.

© Copyright 2008, Global Knowledge. All rights reserved.

Share this article:
  • Digg
  • del.icio.us
  • Facebook
  • Google
  • blogmarks
  • LinkedIn
  • Reddit
  • StumbleUpon
  • TwitThis
  • Yahoo! Buzz

Related Articles

This entry was posted on Tuesday, January 6th, 2009 and is filed under Risk Management. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

No comments yet.

feel free to leave a comment

Comment Guidelines: Basic XHTML is allowed (a href, strong, em, code). All line breaks and paragraphs are automatically generated. Off-topic or inappropriate comments will be edited or deleted. Email addresses will never be published. Keep it PG-13 people!

XHTML: You can use these tags: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

All fields marked with " * " are required.

Project Management Categories