In the Open IT Security Project, I have served in the role as the "thought leader," providing guidance to the member CIOs and their staffs on enterprise information security issues. I am pleased to say that our Security Project Team has made a significant step forward in demonstrating the methodology of Open IT by successfully completing a baseline assessment of security readiness and using it to establish working priorities for the coming year.
The process of initiating and executing a project within Open IT is pretty much the same for all areas of information technology. It starts with a baseline assessment. The assessment, or framework, is structured so that CIOs self assess their readiness and can derive a numeric score from the results. Their scores, like a report card from school, can give them an overall assessment that allows them to compare their status with those of their peers, both today and as they improve over time. They also contain detailed scores in a variety of areas about people, processes, and technology, so that the CIOs can identify areas of common weakness and prioritize activities that could benefit from collaboration while fitting into their budgetary plans. Once the priorities are set, roadmaps of tasks are planned and implemented, producing IP that ranges from code to product evaluations to policies.
In the case of the Security Project, the baseline assessment was derived from the book I wrote with Tim Mather, "The Executive Guide to Information Security: Threats, Challenges, and Solutions." The scorecard includes detailed questions in 50 areas, but it was designed to be completed in under an hour. The results from our member companies, which were disguised to ensure anonymity, ranged from a low of 47 to a high of 81. But there were clearly areas in which all of the companies fell below satisfactory scores.
The initial review of the scorecard established three top priority areas for work this year: Vulnerability Analysis and Management, including white hat security techniques, penetration testing, and server hardening, Authentication, Authorization, and Accounting (AAA), including identity management, directory services, coordination between multiple enterprise departments, and management of contractors and temporary employees, Security Training Programs, which reflects the requirement that all employees, administrators, and managers need to be trained on security issues; a collaborative evaluation of web-based training programs would allow the companies to divide and conquer using common evaluation criteria.
I am looking forward to working with the group on planning the specific tasks to accomplish these objectives and I will report back from time to time on their progress. In the meantime, I would be delighted to hear comments from readers about what their top security problems are and hear their ideas on how collaborative work can help them solve those problems.
If you would like to have your company's security readiness assessed using this methodology, Open IT Works stands ready to process it anonymously and share with you the summarized results from all the other companies. Contact Hal Jespersen, CTO, hal.jespersen@openitworks.com.
Mark Egan of the Stratafusion Group is the former CIO of Symantec.
A recent study (cited by Tom's Hardware) in London showed that an attractive “researcher” and promises of a chocolate bar after completing a survey showed that 64% of workers gave up their passwords. Amazing! What was surprising is that even 22% of IT workers gave up their password.
Recent Comments