董事会与高管的网络安全治理：第二版

需积分: 0 42 浏览量更新于2024-08-02 收藏 504KB PDF 举报

"信息安全治理第二版2006" 是一本由IT Governance Institute (ITGITM) 出版的书籍，旨在提升国际上对信息技术治理的思考和标准，确保企业IT支持业务目标，优化IT投资，并妥善管理与IT相关的风险和机遇。这本书面向企业领导层和董事会成员，提供原创研究、电子资源和案例研究，帮助他们在IT治理职责中发挥作用。在当今世界，网络犯罪的上升和对关键信息资产的威胁使得董事会和高级管理层必须积极参与到治理层面，以保障这些资源的安全性和完整性。如HARMAN INTERNATIONAL INDUSTRIES的董事会成员SHIRLEY M. HUFSTEDLER指出，这需要董事会和执行管理层的全力投入。为了实现安全的业务运营，一个组织必须拥有有效的安全治理策略。正如UNISYS CORP.的首席安全顾问兼管理合伙人SUNIL MISRA所述，信息安全性及其治理的复杂性和重要性要求将其提升到组织的最高级别。信息作为一种至关重要的资源，必须像任何对组织生存和发展至关重要的资产一样进行管理。EASYIGROUP的CEO TERRY HANCOCK强调，信息的安全治理需要被提升到最高组织层级，以确保其保护和管理的有效性。本书《信息安全治理》第二版，针对董事会和执行管理层提供了指导，深入探讨了如何制定和实施信息安全战略，以保护组织免受日益增长的威胁。它涵盖了如何建立有效的安全政策、风险评估方法、合规性要求以及如何将安全融入业务流程等方面。此外，书中可能还包含实际案例，展示了成功的安全治理实践，以帮助读者理解和应用理论知识。通过这本书，董事会和高级管理层可以学习如何制定全面的信息安全策略，包括但不限于：确立信息安全政策、设定明确的责任分配、实施风险管理框架、确保合规性、以及建立有效的应急响应机制。这些内容对于任何希望加强其信息安全治理的企业来说都是宝贵的参考资料。

8 Information Security Governance

Guidance for Boards of Directors and Executive Management, 2

Edition

Corporate Governance Task Force, ‘Information Security Governance: Call to Action’,

USA, 2004

Until recently, the focus of security had been on protecting the IT systems

that process and store the vast majority of information, rather than on the

information itself. However, this approach is too narrow to accomplish the

level of integration, process assurance and overall protection that is now

required.

To achieve effectiveness and sustainability in today’s complex,

interconnected world, information security must be addressed at the highest

levels of the organisation, not regarded as a technical specialty relegated to

the IT department.

An enlightened approach to information security takes the larger view that an

organisation’s information and the knowledge based on it must be adequately

protected regardless how it is handled, processed, transported or stored. It

addresses the universe of risks, benefits and processes involved with all

information resources. The security of information, as with other critical

organisational resources, must be addressed at the total enterprise level.

Information security is not only a technical issue, but a business and

governance challenge that involves adequate risk management, reporting and

accountability. Effective security requires the active involvement of executives

to assess emerging threats and the organisation’s response to them.

As organisations strive to remain competitive in the global economy, they

respond to constant pressures to cut costs through automation, which often

requires deploying more information systems. Whilst managers become ever

more dependent on these systems, the systems have become vulnerable to a

widening array of risks that can threaten the existence of the enterprise. This

combination is forcing management to face difficult decisions about how to

effectively address information security. This is in addition to scores of new

and existing laws and regulations that demand compliance and higher levels

of accountability.

The Data Governance Council, with a focus on the review and approval

aspects of board responsibilities, recently recommended that boards provide

strategic oversight regarding information security, including:

1. Understanding the criticality of information and information security to

the organisation

2. Reviewing investment in information security for alignment with the

organisation strategy and risk profile

3. Endorsing the development and implementation of a comprehensive

information security programme

IT Governance Institute 9

4. Requiring regular reports from management on the programme’s adequacy

and effectiveness

In this regard, governing boards and executive management should review:

• The scale and return of the current and future investments in information

resources to ensure that they are optimised

• The potential for technologies to dramatically change organisations and

business practices, thereby creating new opportunities and value whilst

reducing costs

They should also consider the associated ramifications of the:

• Increasing dependence on information and the systems and

communications that deliver the information

• Dependence on entities beyond the direct control of the enterprise

• Increasing demands to share information with partners, suppliers and

customers

• Impact on reputation and enterprise value resulting from information

security failures

• Failure to set the tone at the top with regard to the importance of security

Whilst executive management has the responsibility to consider and respond

to these issues, boards of directors will increasingly be expected to make

information security an intrinsic part of the enterprise’s governance efforts,

aligned with their IT governance focus and integrated with processes they

have in place to govern other critical functions. The purpose of this

publication is to provide boards and senior executives a basis, rationale and

acknowledged approach for protecting vital information assets that support

critical business processes.

This guide, prepared by one of the world’s leading institutions dedicated to

researching issues and principles of IT governance, is written to address

these concerns. It covers fundamental issues such as:

• What is information security governance?

• Why is it important?

• Who is responsible for it?

It also provides practical, pragmatic advice on:

• What information security governance should deliver

• Questions to ask regarding information security governance

• How information security governance is evolving

• How to measure an organisation’s maturity level relative to information

security governance

IBM, Data Governance Council, Oversight of Information Security, USA, 2005

剩余51页未读，继续阅读

leonchou81

粉丝: 0
资源: 2

董事会与高管的网络安全治理：第二版

第一章-信息安全治理与风险管理.docx

系统架构设计师教程第二版

CISSP-第二章信息安全治理与风险管理思维导图

操作系统及网络效劳器治理Windows2000Server.第二版.答案.pdf

《信息系统项目管理师教程第4版》第1章至第5章信息化发展、信息技术发展、信息系统治理、信息系统管理信息系统工程思维导图xmind

公司治理基本理论修定版.ppt

高级审计研究(第二版)习题答案.doc

专题资料（2021-2022年）HSE管理手册第二版.doc

2021年公司运算机治理制度(通用版).pdf

信息安全思考题.docx

最新资源