Business Drivers That Influence Information Systems Development

#Business Drivers That Influence Information Systems Development pdf

Achieving this balance requires information assurance. Organizations strive to achieve the appropriate balance between security controls to protect business information, while also allowing their employees to be productive and share information easily. The situation describes a common struggle faced by most organizations. As a result of this security avoidance, new risks are introduced, however are not known to the security team and cannot be monitored and managed. This desire to avoid security is due to the perception that security is an obstacle. When security controls become overly intrusive to employees of a business, and in fact impede business operations, individuals will seek the means to bypass these controls. However, risk avoidance is a common practice within IT organizations, where security expenditures, policies, procedures, and technologies are not proportional to the risk appetite of the business. Security practitioners are challenged to consider security in the context of the business and understand the duality of risk: some risks represent business opportunities and should therefore be accepted. In order for a security program to be effective, it must demonstrate value to the business while avoiding the traditional pitfalls associated with the perception of security being an inconvenience and an obstacle to effective business operations. If a critical system is compromised, what will be the business impact? Conversely, an organization may question if there is sufficient protection for information that is to be shared with a new business partner, customer, or the general public. Many organizations find that their existing security controls are preventing them from getting something done or are reducing their effectiveness. This business-driven approach to enterprise security architecture can help organizations change the perception of IT security, positioning it as a tool to enable and assure business success, rather than be perceived as an obstacle to be avoided. An understanding of SeccurisвЂ™ approach will illustrate the importance of aligning security activities with high-level business objectives while creating increased awareness of the duality of risk.

The approach is derived from the Sherwood Applied Business Security Architecture (SABSA) methodology, as put into practice by Seccuris Inc., an information assurance integrator. Through a discussion of information assurance, this article makes a case for leveraging enterprise security architectures to meet an organizations' need for information assurance. A balanced approach to enterprise security architecture can create the important linkages between the goals and objectives of a business, and it provides appropriate measures to protect the most critical assets within an organization while accepting risk where appropriate. This article presents a business-focused approach to developing and delivering enterprise security architecture that is focused on enabling business objectives while providing a sensible and balanced approach to risk management. We will bankrupt ourselves in the vain search for absolute security.ДЈ4 th President of the United States Abstract

#Business Drivers That Influence Information Systems Development pdf

Brian Ritchot Download this article as a PDF