World Library  
Flag as Inappropriate
Email this Article

Security management

Article Id: WHEBN0000041686
Reproduction Date:

Title: Security management  
Author: World Heritage Encyclopedia
Language: English
Subject: Event correlation, List of acquisitions by Hewlett-Packard, Enterprise resource planning, Network management, Management
Collection: Computer Security Procedures, Management, Network Management
Publisher: World Heritage Encyclopedia
Publication
Date:
 

Security management

Security management is the identification of an organization's assets (including information assets), followed by the development, documentation, and implementation of policies and procedures for protecting these assets.

An organisation uses such security management procedures as information classification, risk assessment, and risk analysis to identify threats, categorise assets, and rate system vulnerabilities so that they can implement effective controls.[1]

Contents

  • Loss prevention 1
  • Security risk management 2
    • Types of security threats 2.1
      • External 2.1.1
      • Internal 2.1.2
    • Risk options 2.2
      • Risk avoidance 2.2.1
      • Risk reduction 2.2.2
      • Risk spreading 2.2.3
      • Risk transfer 2.2.4
      • Risk acceptance 2.2.5
  • Security policy implementations 3
    • Intrusion detection 3.1
    • Access control 3.2
    • Physical security 3.3
    • Procedures 3.4
  • See also 4
  • References 5

Loss prevention

Loss prevention focuses on what your critical assets are and how you are going to protect them. A key component to loss prevention is assessing the potential threats to the successful achievement of the goal. This must include the potential opportunities that further the object (why take the risk unless there's an upside?) Balance probability and impact determine and implement measures to minimize or eliminate those threats.

Security risk management

Management of security risks applies the principles of risk management to the management of security threats. It consists of identifying threats (or risk causes), assessing the effectiveness of existing controls to face those threats, determining the risks' consequence(s), prioritising the risks by rating the likelihood and impact, classifying the type of risk and selecting and appropriate risk option or risk response.

Types of security threats

External

  • Strategic: like competition and customer demand...
  • Operational: Regulation, suppliers, contracts
  • Financial: FX, credit
  • Hazard: Natural disaster, cyber, external criminal act
  • Compliance: new regulatory or legal requirements are introduced, or existing ones are changed, exposing the organisation to a non-compliance risk if measures are not taken to ensure compliance

Internal

  • Strategic: R&D
  • Operational: Systems and process (H&R, Payroll)
  • Financial: Liquidity, cash flow
  • Hazard: Safety and security; employees and equipment
  • Compliance: Actual or potential changes in the organisation's systems, processes, suppliers, etc. may create exposure to a legal or regulatory non-compliance.

Risk options

Risk avoidance

The first choice to be considered. The possibility of eliminating the existence of criminal opportunity or avoiding the creation of such an opportunity is always the best solution, when additional considerations or factors are not created as a result of this action that would create a greater risk. As an example, removing all the cash from a retail outlet would eliminate the opportunity for stealing the cash–but it would also eliminate the ability to conduct business.

Risk reduction

When avoiding or eliminating the criminal opportunity conflicts with the ability to conduct business, the next step is the reduction of the opportunity and potential loss to the lowest level consistent with the function of the business. In the example above, the application of risk reduction might result in the business keeping only enough cash on hand for one day’s operation.

Risk spreading

Assets that remain exposed after the application of reduction and avoidance are the subjects of risk spreading. This is the concept that limits loss or potential losses by exposing the perpetrator to the probability of detection and apprehension prior to the consummation of the crime through the application of perimeter lighting, barred windows and intrusion detection systems. The idea here is to reduce the time available to steal assets and escape without apprehension.

Risk transfer

Transferring risks to other alternatives when those risks have not been reduced to acceptable levels. The two primary methods of accomplishing risk transfer are to insure the assets or raise prices to cover the loss in the event of a criminal act. Generally speaking, when the first three steps have been properly applied, the cost of transferring risks are much lower.

Risk acceptance

All remaining risks must simply be assumed by the business as a risk of doing business. Included with these accepted losses are deductibles which have been made as part of the insurance coverage.

Security policy implementations

Intrusion detection

Access control

Physical security

Procedures

See also

References

  1. ^ "Manage IT Security Risk with a Human Element". Dell.com. Retrieved 2012-03-26. 
  •  This article incorporates public domain material from the General Services Administration document "Federal Standard 1037C" (in support of MIL-STD-188).
  • BBC NEWS | In Depth. BBC News - Home. Web. 18 Mar. 2011. .
  • Rattner, Daniel. "Loss Prevention & Risk Management Strategy." Security Management. Northeastern University, Boston. 5 Mar. 2010. Lecture.
  • Rattner, Daniel. "Risk Assessments." Security Management. Northeastern University, Boston. 15 Mar. 2010. Lecture.
  • Rattner, Daniel. "Internal & External Threats." Security Management. Northeastern University, Boston. 8 April. 2010. Lecture.
  • Asset Protection and Security Management Handbook, POA Publishing LLC, 2003, p358
  • ISO 31000 Risk management — Principles and guidelines, 2009, p7
This article was sourced from Creative Commons Attribution-ShareAlike License; additional terms may apply. World Heritage Encyclopedia content is assembled from numerous content providers, Open Access Publishing, and in compliance with The Fair Access to Science and Technology Research Act (FASTR), Wikimedia Foundation, Inc., Public Library of Science, The Encyclopedia of Life, Open Book Publishers (OBP), PubMed, U.S. National Library of Medicine, National Center for Biotechnology Information, U.S. National Library of Medicine, National Institutes of Health (NIH), U.S. Department of Health & Human Services, and USA.gov, which sources content from all federal, state, local, tribal, and territorial government publication portals (.gov, .mil, .edu). Funding for USA.gov and content contributors is made possible from the U.S. Congress, E-Government Act of 2002.
 
Crowd sourced content that is contributed to World Heritage Encyclopedia is peer reviewed and edited by our editorial staff to ensure quality scholarly research articles.
 
By using this site, you agree to the Terms of Use and Privacy Policy. World Heritage Encyclopedia™ is a registered trademark of the World Public Library Association, a non-profit organization.
 


Copyright © World Library Foundation. All rights reserved. eBooks from Project Gutenberg are sponsored by the World Library Foundation,
a 501c(4) Member's Support Non-Profit Organization, and is NOT affiliated with any governmental agency or department.