Title: Technical Topics of Implementation
Course: IN 2001 Principle of Information Assurance > Section: Module 10: Chapter 10

Technical Aspects of Implementation
1. Some parts of the implementation process are technical in nature and deal with the application of technology, while others are not and deal instead with the human interface to technical systems.
2. Conversion Strategies
  - As the components of the new security system are planned, provisions must be made for the changeover from the previous method of performing a task to the new method
  - The four basic approaches used for changing from an old system or process to a new one are:
    - Direct changeover: Also known as going “cold turkey,” a direct changeover involves stopping the old method and beginning the new.
    - Phase implementation: The most common approach, phase implementation involves rolling out a piece of the system across the entire organization
    - Pilot implementation: Pilot implementation involves implementing all security improvements in a single office, department or division, and resolving issues within that group before expanding to the rest of the organization.
    - Parallel operations: Parallel operations involve running the new methods alongside the old methods

The Bull’s-Eye Model
1. By reviewing the information security blueprint and the current state of the organization’s information security efforts in terms of the four layers of the bulls-eye model, project planners can determine where to lobby for expanded information security capabilities.
2. This approach relies on a process of evaluating project plans in a progression through four layers: policies, networks, systems and applications. The bull’s-eye model can be used to evaluate the sequence of steps taken to integrate parts of the information security blueprint into a project plan.
3. This means that:
  - Until sound and useable IT and information security policy is developed, communicated and enforced, no additional resources should be spent on other controls
  - Until effective network controls are designed and deployed, all resources should be spent to achieve that goal
  - After policy and network controls are implemented, implementation should focus on the information, process and manufacturing systems of the organization
  - Once there is assurance that policy is in place, networks are secure and systems are safe, attention should move to the assessment and remediation of the security of the organization’s applications

To Outsource or Not
1. Just as some organizations outsource IT operations, so too can organizations outsource part of or all of their information security programs.
2. When an organization has outsourced IT services, information security should be part of the contract arrangement with the outsourcer.
3. Because of the complex nature of outsourcing, it is best to hire the finest outsourcing specialists possible and then retain the best attorneys possible to negotiate and verify the legal and technical intricacies of the outsourcing contract.

Technology Governance and Change Control
1. Other factors that determine the success of an organization’s IT and information security are technology governance and change control processes.
2. Technology governance is a complex process that an organization uses to manage the impacts and costs caused by technology implementation, innovation and obsolescence.
3. Technology governance also facilitates the communication about technical advances and issues across the organization.
4. Medium or large organizations deal with the impact of technical change on the operation of the organization through a change control process.
5. By managing the process of change, the organization can:
  - Improve communication about change
  - Enhance coordination between organizational groups as change is scheduled and completed
  - Reduce unintended consequences by having a process to resolve potential conflict and disruption
  - Improve quality of service as potential failures are eliminated and groups work together
  - Assure management that all groups are complying with the organization’s policies regarding technology governance, procurement, accounting and information security