Title: Chapter 12 Overview
Course: IN 2001 Principle of Information Assurance > Section: Module 12: Chapter 12

Information Security Maintenance
Introduction
1. Upon successfully implementing and testing a new and improved security profile, an organization might begin feeling more confident about the level of protection it is providing for its information assets.  This should not be the case.
2. By the time the organization has completed implementing the changes mandated by an upgraded security program, a good deal of time has passed.  In that time, everything that is dynamic in the organization’s environment has, by definition, changed.
3. Some of the factors that are likely to shift in the information security environment are:
  - New assets are acquired
  - New vulnerabilities associated with the new or existing assets emerge
  - Business priorities shift
  - New partnerships are formed
  - Old partnerships dissolve
  - Organizational divestiture and acquisition occur
  - Employees who are trained, educated, and made aware of the new policies, procedures and technologies leave
  - New personnel are hired, possibly creating new vulnerabilities
4. If the program is not adjusting adequately to change, it may be necessary to begin the cycle again.  That decision depends on how much change has occurred and how well the organization and its program for information security maintenance can accommodate change.
5. If an organization deals successfully with change and has created procedures and systems that can be adjusted to the environment, the security program will probably continue to work well.
6. The CISO determines whether the information security group can adapt adequately and maintain the information security profile of the organization or whether the macroscopic process of the SecSDLC must start anew and involve developing a fundamentally new information security profile.
7. It is less expensive and more effective when an information security program is designed and implemented to adapt to change.  It is more expensive to reengineer the information security profile again and again.
8. Once an organization has improved its security posture, the security group must turn its attention to the maintenance of security readiness.  To do so, the information security team must constantly monitor threats, assets, and vulnerabilities.
9. As the organization continues to function, the team constantly monitors its systems and the environments in which it operates.  The team also reviews external information to stay current of the latest general and specific threats to its information security.

Security Management Models

Digital Forensics