保障业务安全：2018年企业运营安全实践

需积分: 4 97 浏览量更新于2024-07-18 收藏 5.4MB PDF 举报

"《实现和保持安全业务运营——2018》是一本关于如何在创新和保护业务安全之间取得平衡的书籍。它提供了一个全面的框架和实践方法，旨在保护客户信息、防止未经授权的访问，以及保护公司的品牌和资产。书中强调了网络安全和相关犯罪的严重性，提出了一种全方位的方法，从上到下、从下到上、从横向考虑，以达到并维持一个安全的业务环境，同时持续创新以获得竞争优势。作者是Neelesh Ajmani和Dinesh Kumar。" 本书的核心知识点包括： 1. **安全业务运营框架**：书中介绍了一个全面的框架，它不仅关注技术层面的安全措施，还涵盖了组织文化、政策制定、员工培训等多个维度，确保业务运营的安全性。 2. **董事会级别的讨论**：书中强调，公司运营安全是高层决策者必须参与的话题，因为网络安全和相关犯罪对任何行业的公司都构成重大威胁，需要投入大量资源来应对。 3. **保护客户信息**：在数字化时代，客户数据的安全至关重要。书中的实践建议可能包括实施严格的数据加密策略、强化身份验证机制以及定期进行数据隐私审计。 4. **预防未经授权的访问**：这涉及到建立强大的访问控制机制，例如多因素认证、最小权限原则以及持续监控和日志记录，以及时发现和防止非法入侵。 5. **品牌和资产保护**：除了技术措施，还包括危机管理和公关策略，以在发生安全事件时迅速响应，减少对公司声誉和财务的影响。 6. **创新与安全的平衡**：在追求创新和竞争优势的同时，如何兼顾业务的安全性是现代企业面临的挑战。书中可能提供了如何在两者之间找到平衡点的策略。 7. **持续改进和适应性**：随着威胁环境的不断变化，安全措施需要不断更新和调整。书中可能探讨了如何建立灵活且适应性强的安全管理体系。 8. **案例研究和最佳实践**：书中可能会包含实际案例分析，展示成功的安全运营策略和应对措施，为读者提供参考和学习。 9. **法律法规遵守**：考虑到版权和商标问题，书中也会涉及遵守相关法律法规的重要性，特别是在数据处理和信息存储方面。 10. **技术解决方案**：除了管理层面的策略，书中可能还会介绍一些具体的技术解决方案，如防火墙、入侵检测系统、安全信息和事件管理（SIEM）等。通过阅读这本书，企业领导者和IT专业人员可以获取一套实用的方法，以更有效地规划和管理安全的业务运营，确保公司在快速发展的数字世界中既能保持竞争力，又能抵御各种安全威胁。

xvi

The next three chapters, Chapters 3-5, take you inside the body of the

framework for achieving and sustaining secured business operations.

The third chapter is about the business perspective on secured

business operations. The secured business model, described in this

chapter, introduces five performance domains (5 Ps)- Prevent, Protect,

Profile, Policy, and People. These 5 Ps allow business leaders to

understand, communicate, and manage the security needs based on

the business drivers and risk resilience required for the level of business

engagement. A clear understanding of the business risk and required

business capabilities provides a prescriptive guidance to business and

IT operations, ensures end-to-end alignment, and drives business

accountability for achieving and sustaining secured business operations.

In the fourth chapter, we get into the guts of what it will take to secure

business operations at the desired level of risk resilience. It explains

the secured operating model of the framework, addressing twenty-one

operational capabilities organized into six capability domains. The six

capability domains are- Business Management, Operations Management,

Risk Management, Compliance Controls, Master Data Management, and

Infrastructure Management. The secured operating model provides the

management bridge between business needs as defined by the secured

business model and various operational practices and technical solutions

required, implemented, and suggested by many security, risk, and

compliance frameworks. For people in the trenches who are responsible

for day-to-day security operations, an assessment using the secured

operating model can help them understand how well the operational

capabilities are aligned with business needs, address the gaps, and show

value of their efforts. On the other hand, the management can evaluate the

current state, identify the gap, prioritize what must be done, and monitor

progress against the plan.

In the fifth chapter, we describe the secured management model for

creating the discipline and culture of ensuring secured business operations

by design. Planning and implementing security is everyone’s job.

InTroduCTIonInTroduCTIon

xvii

Any change created by any project must have appropriate security

measures. Therefore, we have included a methodology to help

organizations operationalize the security mindset in every business/IT

project or initiative. The management model defines inputs, outputs, and

key activities across the life cycle of assessing, planning, improving, and

managing capabilities and solutions. The management practices in this

model are critical for sustaining secured business operations.

The sixth chapter describes key performance indicators (KPIs)

and methods for measuring effectiveness of security capabilities and

efforts. Most organizations have activity-based measures for compliance

reporting. Constantly, business leaders ask- are we doing the right thing?

Are we producing the desired outcomes? How do we know? Measuring

and ensuring effectiveness requires going beyond the activity-based KPIs.

It requires understanding how value flows from solutions to outcomes.

The chapter introduces techniques for creating a value flow map and

measuring value contribution along the way, knowing that security

effectiveness is key to overcoming planning by fear. It drives accountability

and effective decision making at all levels in the organization. Alignment

and measurement are core to the framework, and therefore, they are

described in Chapter 6.

The seventh chapter is a takeaway chapter. It includes key learnings

from the previous six chapters. The chapter also includes a few use cases,

how other organizations have used various aspects of the framework. Last,

it includes a set of recommendations on adopting the framework and

overcoming barriers and constraints in your organization.

Feedback and Follow-Up

We know we are not there yet, and we realize, there is always a next

maturity level to strive for, next practice to develop. As we make further

strides, we would like to collaborate with you in continuing this journey.

We are very keen to hear- what do you like about the framework and the

book? What can or should be revised or presented differently? What have

InTroduCTIonInTroduCTIon

The irony is that Cybersecurity has become an industry, a growth

industry. As it produces goods (software, hardware) and related services

within an economy, from technical benchmarks, it does meet the

definition of an industry. Since the Industrial Revolution, industries have

been created to improve the standard of living and to foster the growth

of a country or a global region. The security industry is growing as it has

become a mandatory expense to work and live in the connected and

interdependent world. The Information and Internet have many positive

outcomes, connecting people, processes, and organizations around the

world; creating millions of jobs; and adding trillions of dollars in the global

economies. Chief among the recent innovations include the Internet

of Things, Digitization, Social Media, Mobile, and Big Data; these are

collectively transforming the organizational culture and lifestyle of the

people. Personal identities to all owned assets at every level have either

already been converted to digital forms, or are in the process of being

converted to a digital form. The business processes are being digitized for

better transparency and agility. As an individual or as an organization, a

connected and transparent world is a blessing and a curse. How does a

growing investment in information security help you effectively manage the

potential vulnerabilities while being innovative in products and processes,

connected and collaborative with customers and partners, and open to

work from anywhere? Can you afford to continue to spend more money?

State oftheBusiness

As per the world economic forum, cybersecurity is costing businesses

$400B–$500B in damages per year. Much more damage is not reported

due to lack of appropriate understanding and quantification of impact,

compliance, or reporting regulations.

Understandably, board of directors or management officials do not

want to see the name of their organization in the news about a security

breach. What has surprised us is how these very people act in managing

Chapter 1 Current praCtiCes

剩余180页未读，继续阅读

白鸽-小蛋

粉丝: 10
资源: 166

保障业务安全：2018年企业运营安全实践

Simultaneously achieving self-toughening and self-reinforcing of polyethylene

Four-Model Approach

Bag of Tricks and A Strong Baseline for Deep Person Re-identification

Small but Mighty: Enhancing 3D Point Clouds Semantic Segmentation with U-Next Framework

Write a speech which can be read in 5 minutes, and the topic is"the power of self confidence"

A business component is the same as system component

Swin Transformer: Hierarchical Vision Transformer using Shifted Windows

UX is all about engagement, what are the user incentives used to promote engagement?

最新资源