How does the hottest CIO clear the dead corner of

  • Detail

CIO how to eliminate the dead corner of information security

with the continuous expansion of network scale and the strong demand of business for network robustness, information security has become one of the hottest topics for CIO at present. The new regulation does not require absolute error of deformation index. Remember the "shock wave" two years ago? This virus has paralyzed countless enterprises at once, and the direct economic losses caused are astonishing in scale. Nowadays, enterprises are facing the choice of whether to informatization, and information security has also become an important part of informatization. It is puzzling that many enterprises prefer to spend a lot of money on servers and switches, but few are willing to pay the right price. However, due to the huge use of wood packaging materials at present, strengthening the security measures of enterprise networks, is information security useless to enterprises

few users dare to say that they have an impeccable information security plan. In fact, users from all walks of life are facing big or small challenges in ensuring the availability, integrity and confidentiality of business information

with the increasing and complex security threats, more and more users begin to take a more proactive approach to information security: compare and analyze the current security situation with the security objectives required to ensure business continuity, so as to identify the existing problems and deficiencies, and actively take targeted measures, so as to take an important step towards creating and realizing a reliable architecture required to protect key assets

clarify business requirements

If an information security plan wants to be effective, it must fully consider the three elements of personnel, process and technology. Therefore, users also need to consider these elements when determining that there is a security gap

when determining the gap, users first need to determine key business goals, and then summarize the security conditions required to achieve these business goals. These business goals and requirements will become the benchmark for enterprises to formulate information security plans. Next, users need to determine the long-term strategic objectives of the company, the business environment, and the possible changes of the loading device. They also need to regularly detect the changes in production, high priority security issues, and other strategic and tactical issues

the quick drying performance of the subdivision evaluation process is comparable to that of polyester.

based on the business needs analysis, users need to compare the current security architecture of the enterprise with the objectives of the information security plan. This is a time-consuming and laborious process. This process will be greatly simplified if people, processes, and technology assessment are subdivided into three key areas strategy, components, and management

using a simple scoring method to grade key areas can make the evaluation easier. For example, zero indicates no implementation at all, 1 indicates partial implementation, and 2 indicates full implementation. However, for many users, determining the evaluation criteria is the key to the problem

answering some key questions can help users effectively determine evaluation standards and classify information security plans. The answers to each question are scored using the same evaluation criteria, so that users can identify areas for improvement

when evaluating the strategy of personnel elements, users can ask the following questions: whether the information security strategy has been formulated in writing, whether the strategy is updated regularly, whether it involves consistency detection or certification, and whether the company defines the information security strategy as passive or active

when evaluating the components of personnel elements, users can ask the following questions: whether there are full-time information security personnel, whether they are led by competent personnel, whether there is a training plan being implemented, etc

when evaluating the management of personnel elements, the following questions can be used to determine: whether to regularly submit status reports to administrative personnel, whether administrative personnel have an information security plan, whether the information security plan can be enforced, etc

when evaluating the process and technical elements of the information security plan, you can ask the following related questions: is the information security process and strategy easy to view through the company's internal? Are the security process components in place? (security process components include account management, security awareness, emergency response, security vulnerability scanning and acceptable use components.) Has the security technology been deployed in place? (security technology includes anti-virus software, firewall, security vulnerability management and intrusion detection system.)

develop a roadmap and implement

once the gap between the current situation of information security and the ideal state is determined, users can start to develop a roadmap to fill the gap between current and future information security plans. Using the information obtained from business requirements analysis and gap analysis, users can develop the desired security architecture

an effective roadmap usually provides a variety of solutions to bridge the information security gap. The road map should include a strategic plan for the next two years and a longer-term plan. Users can choose routes that meet business priorities. The company shall closely monitor the progress to ensure continuous improvement and continuous support from the management

by identifying key business needs, analyzing the current situation of the information security architecture, delineating areas that need to be improved in the future, and formulating a flexible roadmap to achieve information security goals, users can greatly enhance their security advantages

with the deployment of personnel, processes and technologies to protect information assets, users have the resources they need to ensure the confidentiality, integrity and availability of information. (end)

Copyright © 2011 JIN SHI