The 10 deadly sins of information security management

As the winter nights begin to close in, the family gathers around the fireplace for warmth and we’ll tell each other stories. My current favorite is an old one entitled “the 10 deadly sins of information security management.” This was written by Basie and Rossouw von Solms and published in Computers & Security Journal, July 2004.

Here are the ten sins as they are written…

1. Not realizing that information security is a corporate governance responsibility (the buck stops right at the top)

2. Not realizing that information security is a business issue and not a technical issue

3. Not realizing the fact that information security governance is a multi-dimensional discipline (information security governance is a complex issue, and there is no silver bullet or single ‘off the shelf’ solution)

4. Not realizing that an information security plan must be based on identified risks

5. Not realizing (and leveraging) the important role of international best practices for information security management

6. Not realizing that a corporate information security policy is absolutely essential

7. Not realizing that information security compliance enforcement and monitoring is absolutely essential

8. Not realizing that a proper information security governance structure (organization) is absolutely essential

9. Not realizing the core importance of information security awareness amongst users

10. Not empowering information security managers with the infrastructure, tools and supporting mechanisms to properly perform their responsibilities

Yes, the old ones are still often the best. How those long dark nights are going to just fly by!

Join the conversation

1 comment

Send me notifications when other members comment.

Please create a username to comment.

Nice article! The one additional thing I think many IT professionals forget about is the post-it at their desk or on the back of a napkin that has their database login or email password on it. Those things can take on legs and should be part of a good IT security policy as well. I found this article on the Fellowes website about how shredding secure documents should be an additional part of an information security policy as well:here Keep posting! Thomas
Cancel

-ADS BY GOOGLE

SearchCIO

SearchSecurity

SearchNetworking

SearchDataCenter

  • How do I size a UPS unit?

    Your data center UPS sizing needs are dependent on a variety of factors. Develop configurations and determine the estimated UPS ...

  • How to enhance FTP server security

    If you still use FTP servers in your organization, use IP address whitelists, login restrictions and data encryption -- and just ...

  • 3 ways to approach cloud bursting

    With different cloud bursting techniques and tools from Amazon, Zerto, VMware and Oracle, admins can bolster cloud connections ...

SearchDataManagement

Close