Chapter 16 - Information Technology Security Management

Abstract

Information technology security management can be defined as processes that support enabling organizational structure and technology to protect an organization's IT operations and assets against internal and external threats, intentional or otherwise. These processes are developed to ensure confidentiality, integrity, and availability of IT systems. There are various aspects to IT security in an organization that need to be considered. These include security policies and procedures, security organization structure, IT security processes, and rules and regulations. Security policies and procedures are essential for implementing IT security management—authorizing security roles and responsibilities to various security personnel; setting rules for expected behavior from users and security role players; setting rules for business continuity plans; and more. The security policy should generally be agreed to by most personnel in the organization and should have support from the highest-level management. This helps in prioritization at the overall organization level. The IT security processes are essentially part of an organization's risk management processes and business continuity strategies. In a business environment marked by globalization, organizations have to be aware of both national and international rules and regulations. Their information security and privacy policies must conform to these rules and regulations.