The Laws, Statutes, Rules, and Regulations-IT World

11-9-2017

Unit 5 Discussion 1 Response 1 Steward

Response from: Miss. Bayo Elizabeth Cary, AA, BA, MLIS

Everyone wants to feel safe at work, at home, and when they are on the computer.  Being safe on the computer can be a large and daunting task.  We are not exactly sure how we can be safe when we are on the computer and internet.  We need to make sure that we are making the network and computer environment safe, and we need to communicate that and make it clear to all employees.  I just read an article titled “Eight Ways to Communicate Security Benefits to Executive Management.”  This article was very helpful in giving me ideas of ways that the information security department can communicate what we need to do with both management and employees.

One thing that really hit home in this article was that as information security people we tend to put out too much information.  The information may make sense to us but it may just confuse and invoke fear in employees.  Especially when it comes to a global audience we need to be short and concise in our presentations.  They do not need to know everything.  They just need to know how it is going to affect them and what it is trying to prevent.  Also, a formalized program is a good thing to have and will help employees and management see where we are and what we are trying to do.  We also need to link the risk initiatives to business goals.  Executives want to know the business value of information security.  They don’t want all of the fear and what if’s they just want to know the business value of investing in information security. 

The last thing that I took from this article is to clearly communicate what works and what doesn’t.  They want to know what their risk is and how do they fix it.  Especially when you are talking globally they need to know what is going to work.  If you let them know of the things you have tried and what hasn’t worked then they will feel better about information security.  Again, with any audience but especially a global one, communication is key.  Don’t communicate to invoke fear, but communicate to invoke education and what you are doing in information security and how it is going to help.

Reference:

Moore, Susan (August 25, 2014) Eight ways to communicate security benefits to executive management. Gartner www.gartner.com/newsroom/id/2830017

Response: Miss. Bayo Elizabeth Cary, AA, BA, MLIS

      In difficult situations, and in awkward moments, it may seem better-not to discuss, the discomfiture, that one is experiencing. However, in-regards-to the US, and to a business, it is illegal, to fail to communicate, to employees, and to investors-when an actual problem exists. I understand, the need, not to support a: “false fear,” in light, of the realities attendant, with: Intl terrorism, and the culture of cyber warfare, and hacker attacks-it is necessary, to share those truths. When, explaining to office staff, and to investors, why additional funds need to be spend, on upgrading: IT security-the recent, US and Intl risks, and breach management needs, must be communicated. Additional computers, software, and IT specialist, to constantly rebuild, a company’s defense network, is costly, and never-ending (Smith, 2005, p. 13-15).

        There are current SEC, rules, and regulations, that are tied to, US companies, sharing any- and-all pertinent, information with investors. It is the legal obligation, of US companies, to inform investors, in: “risks,” related to their financial investments. A security breach, and massive information loss-which is possible, in the Intl business climate, damages the integrity of a company, and causes a huge financial debt-as confidence, on Wall Street-declines. The US, takes: NASDAQ, Wall Street, and other Intl financial markets seriously, it is illegal to deny investors, information, about how their money is being spent, and about all the valid risks-to that investment.

         IT security issues, will never be resolved. A new approach, from hackers, is on every horizon. People, who act, and support Intl terror, do not give-up, on terrorizing people, because a new software, has been invented. As an IT company, or a business, that has invested heavily, in IT-new software, to protect data, and any other applicable defense, will have to be tried, and applied-Paul Brooke, in his article: “Building an in-Depth defense,” writes about something called a: DMZ buffer zone-a new concept in 2001, to protect companies, internal networks, and a limit, for out-bound, data (Brooke, 2001, p. 75-77). Defense-in Depth, the new defensive security method, and theory-for protecting IT data and information, with a more comprehensive, and aggressive management protocol. Defense-in-Depth, is not a strict application, of methods, or reactions-critical thinking, needs to be engaged, to use the theory, to the best advantage.

References

Brooke, Paul. (2001). Building and In-Depth Defense. Network Computing. Vol. 12, No. 14. p. 75-77. Retrieved from www.networkcomputing.com

Smith, Randy Franklin. (2005). Defense in Depth. Windows IT Security. Vol. 5, No. 11. p. 13-15. Retrieved from www.windowsitpro.com/windowssecurity