IT security professionals' effectiveness in an organization is influenced not only by how usable their security management tools are but also by how well the organization's security management model (SMM) fits. Finding the right SMM is critical but can be challenging — trade-offs are inherent to each approach but their implications aren't always clear. The authors present a case study of one ac...

The rapid development and wide application of computer network effectively promoted the development of China’s economy and information technology, but network and information security problems also came. In our view, we should focus on management on one hand and grasp network security technique on the other hand. Both are equally important. Without the support of management, even the best techn...

Information security governance dominates the senior management’s agenda in overall organizational informance technology (IT) governance. The globalization trends encompassing all businesses, and risks of information leakage forces organizations to institute mechanisms to protect it. In order to achieve adequate level of protection, organizations implement information security management system...

the computer industry has defined the ieee 802.16 family of standards that will enable mobile devices to access a broadband network as an alternative to digital subscriber line technology. as the mobile devices join and leave a network, security measures must be taken to ensure the safety of the network against unauthorized usage by encryption and group key management. ieee 802.16e uses multica...

The increasing dependence on information networks for business operations has focused managerial attention on managing risks posed by failure of these networks. In this paper, we develop models to assess the risk of failure on the availability of an information network due to attacks that exploit software vulnerabilities. Software vulnerabilities arise from software installed on the nodes of th...

Organisations are under constant pressure from governments and industry to implement risk management methods. There are various information security risk management methods available that organisations can implement, and each has different approaches to identifying, measuring, controlling and monitoring the information security risks. Organisations find it difficult to select an information sec...

Software errors can be introduced by disconnects and miscommunications during the planning, development, testing, and maintenance of the components. The likelihood of disconnects and miscommunications increases as more system components have to satisfy security requirements. Project managers should consider the additional communications requirements, linkage among life-cycle activities, and the...

The investigation in this paper takes a social and organizational approach to information systems security management and proposes a framework which illustrates three important issues in the process of security management through goal setting, these are: trust, culture, and risk communication. Three case studies show evidence that there is a chain reaction among these issues with a subsequent e...

1ms article concentrates on the development of an infonnation security strategy. An information security strategy needs to focus on an overall objective. usually the objectives laid out in an organization's business strategy and its derived information technology strategy. where it takes the status quo and reflects the main objectives derived and postulates how and when to close the identified ...

Teaching with case studies is an effective method that actively engages students. This paper describes two case studies we developed and our experiences teaching security management with these two case studies. The case studies were used to teach risk management and incident response planning. Each case study includes the learning objectives, one/more case scenarios and a series of case discuss...