Information Security Management and Security Reporting

Background

The basic goal of ISM is to ensure security properties – such as the confidentiality, integrity, and availability – for an organization’s assets, i.e., any material or immaterial goods that are of value to the specific organization. IT assets typically include data, such as a customer database, software-based services like a web server, and hardware, e.g., the physical web server machine. Whereas any specific security measure, such as a network firewall, only has a limited scope – i.e., it protects only selected security properties of a subset of all assets – ISM takes a holistic approach and typically covers IS on an organization-wide scale (Whitman & Mattord, 2010).

Given the current state of the art in ISM, we basically need to consider three complementary building blocks:

• 1.

  ISM takes a risk-driven approach. In practice, perfect security can never be achieved. Due to the large number of assets, one needs to prioritize the measures that should be taken to ensure the best possible security level with the given personnel, time, and budget constraints (Roper, 1999).

• 2.

  ISM gives us a large pool of security measures to choose from. Security measures can be categorized as either technical or organizational, and considering their relationship to security incidents, they can be categorized as preventing, detecting, or reacting.

• 3.

  ISM applies the principle of continuous improvement. Only a limited number of deliberately chosen security measures can be implemented within a given period. These measures then must be analyzed for effectiveness, refined, and eventually complemented by additional measures (Cazemier, 2010).