Industry View

Information Security and the Importance of Context

Those entrusted with information security must raise their contextual awareness, say Ben Rothke and Benjamin Tomhave

By Ben Rothke & Benjamin Tomhave, BT Professional Services

Page 2

1. Know your risks. The foundation of any information security program must be a formal and comprehensive risk assessment, whether that be with ISFâ¬"s risk tools (e.g. IRAM or FIRM), RMI's FAIR, or any number of other methodologies. If you don't know your risks, you have no idea of your context, no idea of who your enemies are. You end up doing a lot of security stuff, but do not have much to show for it.

2. Determine protection levels. Once your risk assessment is complete, you need to create a formal plan on how much security you want to deploy. This is a combination of business and technology requirements. You need to find that point where the right amount of security to be deployed is. This determination can leverage any number of prioritization approaches, such as by performing a business impact assessment (see ISF's IRAM, again) or even by leveraging a formal security maturity model, such as SSE-CMM.

3. Create the information security program. This requires management support and a CISO with an effective team and a strong project manager. Many different frameworks can be leveraged in building out the security program, though our favorite is leveraging the ISO 27000 series standards.

Follow those three steps and you will have created a world-class information security organization. But if you blindly buy the security appliance of the month, and chase perceived threats, your security staff will be nothing more than simple screeners. It's all about context. ##

Ben Rothke CISSP, QSA (ben.rothke@bt-ps.com), author of Computer Security: 20 Things Every Employee Should Know (McGraw-Hill Professional Education), and Benjamin Tomhave, MS, CISSP (benjamin.tomhave@bt-ps.com) are Senior Security Consultants with BT Professional Services.