Managing Information Technology Security Risk

Abstract

Information Technology (IT) Security Risk Management is a critical task for the organization to protect against the loss of confidentiality, integrity, and availability of IT resources and data. Due to system complexity and sophistication of attacks, it is increasingly difficult to manage IT security risk. This paper describes a two-pronged approach for managing IT security risk: 1) an institutional approach, that addresses automating the process of providing and maintaining security for IT systems and the data they contain; and 2) a project life cycle approach that addresses providing semi-automated means for integrating security into the project life cycle. It also describes the use of a security template with a risk reduction/mitigation tool, the Defect Detection and Prevention (DDP) tool developed at the Jet Propulsion Laboratory (JPL).KeywordsSecurity RiskSecurity PlanRisk Management ProcessCapability Maturity Model IntegrationSoftware Engineer InstituteThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.