IT DRILLDOWN
 
NEWSLETTERS
 

CIO.com updates, insights and advice on technology, management and your career.

 
 
 
LEADERSHIP
 
CIO Executive Programs
The Leader in Face-to-Face Education for Senior Executives

Offering regional and national programs, CIO (and CSO) events bring together some of the most respected names and thought leaders in information technology and security. Presented by CIOs and other senior level executives, these invitation-only programs offer timely topics and strong networking. Learn More »

 
CIO Executive Council
A Peer-Advisory Service and Professional Association for CIOs

Social Responsibility's Strategic Benefits

December 15, 11:30 AM - 12:30 PM US/Eastern (GMT-5)

Join Ed Granger-Happ, CIO of Save the Children, for a discussion of how creating an organization that is socially responsible improves staffing, retention, leadership development and overall corporate health.

Working With and Communicating to Your Board of Directors

January 13, 2009, 4:00 PM - 5:00 PM US/Eastern (GMT-5)

CIO panelists who will share tips and experiences working with their boards: Twila Day of SYSCO; Jeff O'Hare, West Corp.; Marc West, formerly with H&R Block.

IT's Role in Growing Mid-Market Companies

January 14, 4:00 PM - 5:00 PM ET (GMT-5)

Mid-market Council members will share their companies' stories and challenges in driving or coping with growth. Panelists represent Veterinary Pet Insurance, Medicis Pharmaceutical, and Intrax Cultural Exchange.

More / Register »

Learn more about the CIO Executive Council »



 
 
RESOURCE CENTER
 
 
 
SUBSCRIBE TO CIO
 
Are you involved in setting the direction for your company's IT budget or strategy?

Apply today for a FREE subscription to CIO Magazine!

 
 

Building an Enterprise Security Program in Ten Simple Steps

The complexity of today's technologies, regulations, business processes, security threats and a multitude of other factors greatly increases the risks faced by businesses today. These tips for building an enterprise security program (ESP) can help.

 

October 15, 2008CIOBusiness information exists in a complex ecosystem, teeming with a multitude of technologies, regulatory requirements, standards, business processes, vendors, security threats, system vulnerabilities, and market pressures. This information moves through elaborate workflows across networks, multiple applications, databases, servers, and across political boundaries. In today's world, much of this information has to meet the three information security tenets: availability, integrity and confidentiality.

Availability means that information must be available in a timely manner by those who need it. Integrity means that information is complete and free from tampering and confidentiality means that information must be secured from unauthorized access.

The following steps provide guidance for implementing an enterprise security program (ESP), a holistic approach to IT security.

Step 1: Establish Information Security Teams

In his book Good to Great, Jim Collins extols the virtues of having the right people on board before embarking on any corporate journey. The ESP journey is no different. Broadly speaking, the company needs to form two teams: the executive team and the cross-functional security team. The executive team is responsible for establishing the mission, objectives and goals for the ESP, and is usually comprised of senior-level executives. This team is also responsible for setting top-level security policies, establishing organization risk thresholds, obtaining funding for the ESP, and creating the cross-functional security team.

The cross-functional security team, itself made up of sub-teams, is responsible for day-to-day IT security operations, which include managing IT assets, assessing threats and vulnerabilities, managing risks, establishing policies, setting up procedures and controls, conducting internal audits, and providing training.

Step 2: Manage Information Assets

Managing information assets starts with conducting an inventory. This inventory should document hardware, applications (both internal and third party), databases, and other information assets (e.g., network shared folders, ftp sites etc.). Once the inventory is complete, each asset must be assigned an owner and/or a custodian. An owner serves as a point of contact for the assigned asset, whereas a custodian has responsibility for the stored information.

The assets are then categorized into different levels of importance, based on the value of the information contained in them and the cost to the company if an asset is compromised.

Step 3: Decide on Regulatory Compliance and Standards

Regulations are mandatory, legal requirements. Healthcare providers must implement Health Insurance Portability and Accountability Act (HIPAA) guidelines, and most companies in financial services must implement Gramm-Leach-Bliley Act (GLBA). Standards—such as Payment Card Industry (PCI), ISO 27001—are industry best practices. The executive team determines which regulations and standards must be implemented.

Loading...
 
 
CENTER OF EXCELLENCE
 
Security
» Prudential Financial Protects its Brand with Symantec Data Loss Prevention Solutions
FORTUNE 100 insurance leaders rely on the Symantec Data Loss Prevention solution to protect sensitive customer data.
» Information Security: Data Drains and How to Prevent Loss
Do you know where your confidential data is, where it is going, and how to prevent it from leaving your organization.
» Data Loss Prevention: Keeping Sensitive Data Out of the Wrong Hands
Learn what the thought-leaders at PricewaterhouseCoopers have to say on the risks associated with data security.
» 7 Requirements of Data Loss Prevention
Incorporate best practices from many companies using DLP solutions as you establish your organization's requirements and safeguard confidential data.
» Ponemon Study: How Much Does a Data Breach "Cost"?
35 U.S. organizations that lost confidential information and had a regulatory requirement to publicly notify affected individuals are studied in this report.
Center sponsored by

 
 
ABCs
 

Just the basics, please. Sometimes we all need a refresher or we need to make sure our team and our colleagues are all on the same page.

Over 25 tutorials on everything from business intelligence to virtualization.

 
 
FEATURED SPONSORS
 
 
 
SPONSORED LINKS
 

Integrating ActiveRoles With IBM Tivoli Identity Manager 5.0

Quest Authentication Services: Simplify Identity Management

Check Point Endpoint Security - Unifying Essential Components

Gartner on Data Deduplication Cost Savings

Data Protection Options Explained

Unified Communications & Collaboration: Game-Changing Business Results

7 Requirements of Data Loss Prevention

Data Loss Prevention: Keeping Sensitive Data Out of the Wrong Hands

The Case for Business Software Assurance ~ Securing Your Applications

Get IDC's take on one company's foray into storage virtualization.

White Paper: Centralized Data Backup and Your WAN

White Paper: Accelerating the Next Phase of Virtualization

The Right and Wrong Master Data Management Strategies to Start Small and Grow Big

Find out why IDC thinks virtualization is changing operating environments.

Explore the impact virtualization can have on your bottom-line.

Save with 0% Lease Offer on HP Servers and Storage

How RFID Improves Data Center Efficiency

Find out how to manage virtualization's risks and reap the rewards.

Conquer the realities of managing virtualization

Improve Web-Enabled SAP Performance

Remote Infrastructure Management - What Your Peers are Thinking

Complementary BI: The New Approach to Business Intelligence

Expand High-Performance Computing (HPC) Capabilities

Power the Platform of Choice for Virtualization in the Enterprise

Boost your top- and bottom- lines.

Quest Authentication and IBM Tivoli Identity Management

Revolutionizing Endpoint Security with a Single Agent

Laptop Security: Where Do CIOs See Weaknesses?

Achieve a 50:1 Data Deduplication Ratio

Examine security implementations based on six key criteria.

E-LOAN Maintains Reputation as a Privacy Leader with Symantec

Information Security: Data Drains and How to Prevent Loss

Prudential Financial Protects its Brand with Symantec

Operational Excellence Is Key to Maximizing IT Investments

Data Protection: Challenges for the Traveling User

Learn how wide-area data services can help deliver the benefits of virtualization

Learn how companies are changing how they reach out to their most profitable customers.

Learn how to leverage virtualization for a 74% savings in TCO.

Find out how you can affordably consolidate applications with VMware.

ESG Research on Server and Storage Virtualization

Data Center ROI with RFID Asset Tracking

Get help navigating the management challenges of virtualization.

Narrow the gap between virtualization's benefits and the management risks.

Cash in on the promise of virtualization

Determine the ROI of Web Application Acceleration Managed Services

Webcast - "Into the Wild: Managing Laptops Outside the Office"

5 Steps to Successful IT Consolidation

High-performance computing is no longer just for Big Business

Leading university calls on Nokia for mobile unified communications.

Mobility is Growing: Survey Shows Why CIOs are Concerned