Planning Security Services for IT Systems

Often the hardest job is to get business representatives to look at security as something that makes managing their risks and achieving their objectives easier, with security compliance as just part of that journey. This paper addresses that by making planning for security services a ‘business tool’. Recognising that no single approach for employing security services will ever meet every need, the authors focus on a high-level approach with low initial and ongoing resource cost. The result is a common basis for business representatives and security practitioners to discuss the ‘what’ and ‘how’ of protecting IT systems for the outyears. Business representatives are provided with a basis to assist in sourcing funding and the potential for grouping blocks of security work allows for saving on resource costs. During the development and refinement of the approach the authors unearthed other benefits that are also presented.