Category:Information Security Management

From IT frameworks

The ITIL Map

ITIL overview

Click the [+] to expand and see
all ITIL categories and articles

[−] ITIL

[+] CSI

[+] ITIL Job descriptions

[+] ITIL functions

[+] ITIL life cycle phases

[+] ITIL-Images

[+] ITIL-Policies

[+] ITIL-definitions

[+] Service Design

[+] Service Operation

[+] Service Strategy

[+] Service Transition

 FreeCode ITIL Map

 ITIL implementation

 ITIL tools (free software)

 Information Technology Infrastructure Library

 Lessons learned from implementing ITIL

Information Security Management is a key process in the Service Design life cycle phase.

Goals & Objectives

CIA

• Confidentiality - exclusive information is only available to those allowed
• Availability - Information is available when necessary
• Integrity - information is correct and accurate

Terminology

• Preventive measures - Have security policy in place and implement Access management (Prevent)
• Reductive measures - Backup & testing (Limit)
• Detective measures - Detect through Event management (Detect)
• Repressive measures - Blocking (Suppress)
• Corrective measures - Rollback plans, redundancy (Repair)

Roles

• Information Security Manager
• Security Manager

Example of flow for the proactive part of the information security work.

Example of flow for handling a security breach.

Scope

Information Security Management must have access ainto all systems and information in the IT Organisation and the business.

All present and future policies and plans, especially secuity policies, must be managed.

Activities

Maintaining the Information Security Management System

• With effective and efficient design of the 4 Ps (Products, People, Partners & Processes), information security management can be implemented.
• CSI as always is continually applied.

Interfaces

Change Management process must at least keep the Information Security Manager informed (RACI) All changes to businees security requirements should trigger Information security management.

Inputs/Outputs

Inputs

• Changes from change management
• Updated business security requirements
• Need for updated security policies
• Supplier management security requirements
• Breaches of security

Outputs

• New or updated security policies
• Security controls
• Security advice
• Accurate information available to exclusive parties, when they need it
• Security policy

Value to the Business

Ensuring an agreed security policy is in place and being upheld.

Implementation

Strict Change Management must be in place for Information Security Management to be correctly implemented. On all services offered Information Security Management must be included as a key process in all service life cycle phases.

Value to the business must be clearly shown. Proper business Risk Management (MoR) should define the needs for security policies in place.

Challenges to implementation

Tips for exam

• CIA - Confidentiality, Integrity, and Availability.
• Information Security Management defines the security policies

References and resources

Service Design, OGC