How Can You Improve Information Security

ident that demonstrated system vulnerabilities. Some organizations were exploring new ways to improve operational efficiency and services to customers through information technology and were concerned about the security of these new systems.

Practice 2. Develop practical risk assessment procedures that link security to business needs. While the organizations explored a variety of risk management methodologies, they were generally satisfied with relatively simple risk assessment practices that could be adopted by different organizational units and that involved both technical people and those with knowledge of business operations. In one organization, simple automated checklists were used. Another organization established standard procedures for requesting and granting new network connections, requiring documentation of the business need for the connection and the risks associated with it. None of the organizations tried to quantify the risks precisely because of the difficulty of identifying such data.

Practice 3. Hold program and business managers accountable. The organizations studied felt that business managers should be held accountable for managing the information security risks associated with their operations, just as they are held accountable for other business risks. Security specialists in these organizations had an advisory role, including keeping the management informed about risks. Similarly, program managers in federal agencies are also considered to be in the best position to determine which of their information resources are the most sensitive and to assess the impact of security problems.

Practice 4. Manage risk on a continuing basis. The organizations studied emphasized continuous attention to security. The continuity of attention helped to ensure that controls are appropriate and effective, and that individuals who used and maintained information systems complied with the organizational policies.

Practice 6. Provide the central group with ready and independent access to senior executives. The organizations studied knew that security concerns could be at odds with the desires of business managers and system developers to develop new computer applications quickly and to avoid controls that might impede efficiency and convenience. Elevating security concerns to higher management levels helped to ensure that the risks were understood and taken into account when decisions were made.

Practice 7. Designate dedicated funding and staff. Unlike many federal agencies, the organizations studied defined budgets that enabled them to plan and set goals for information security programs. The budgets covered central staff salaries, training, and security software and hardware. In these organizations, information security responsibilities had been clearly defined for the groups carrying out the security programs, and dedicated staff resources had been provided to carry out these responsibilities.

Practice 8. Enhance staff professionalism and technical skills. The organizations studied had taken steps to provide personnel involved in information security programs with the skills and knowledge that they needed. Staff expertise was updated frequently to keep skills and knowledge current. Staff members attended technical conferences and specialized courses, connected with other professionals in the field, and reviewed technical literature and bulletins. Special training courses were provided for system administrators who are the first line of defense against security intrusions and often in the best position to notice unusual activities. Because of the strong demand for security professionals, these organizations made special efforts to attract and keep expert staff members.

Practice 10. Distinguish between policies and guidelines. Policies generally outlined fundamental requirements that managers considered to be mandatory, while guidelines contained more detailed rules for implementing the policies. By distinguishing between the two, the organizations studied were able to emphasize the most important elements of information security while providing flexibility to unit managers in implementing policies.

Practice 11. Support policies through the central security group. The organizations studied had central security management groups responsible for writing policies in partnership with other organizational officials. The central groups provided explanations, guidance, and support to the various units in the organization. This practice encouraged business managers to support centrally developed policies that addressed organizational needs and were practical to implement.

Practice 13. Use attention-getting and user-friendly techniques. The techniques used included intranet websites that explained policies, standards, procedures, alerts and special n

otices; awareness videos with messages from top managers about the security program; interactive presentations by security staff with various user groups; security awareness days; and products with security related slogans.

Practice 15. Use results to direct future efforts and hold managers accountable. Organization officials said that monitoring encourages compliance with information security policies, but the full benefits of monitoring are not achieved unless results are used to improve the security program. Results can be used to hold managers accountable for their information security responsibilities.