Customer demand

Cost and time to replace

Insurability tables

Risk of exposure

Ensure security budgets enable technical acquisition and resource allocation based on internal compliance requirements

Develop a culture in which users, managers and IT professionals all make good decisions about information risk

Provide clear communication of security program support requirements and audit schedules

Create security awareness programs that include clear definition of security program goals and charters

all organizational assets

critical business processes and /or revenue streams

intellectual property released into the public domain

against distributed denial of service attacks

Business Impact Analysis

Economic Impact analysis

Return on Investment

Cost-benefit analysis

Management Control

Technical Control

Training Control

Operational Control

Work with the IT group and tell them to put IPS in-line and say it won’t cause any network impact

Explain to the IT group that the IPS won’t cause any network impact because it will fail open

Explain to the IT group that this is a business need and the IPS will fail open however, if there is a network failure the CISO will accept responsibility

Explain to the IT group that the IPS will fail open once in-line however it will be deployed in monitor mode for a set period of time to ensure that it doesn’t block any legitimate traffic

Use asymmetric encryption for the automated distribution of the symmetric key

Use a self-generated key on both ends to eliminate the need for distribution

Use certificate authority to distribute private keys

Symmetrically encrypt the key and then use asymmetric encryption to unencrypt it

This makes sure the files you exchange aren’t unnecessarily flagged by the Data Loss Prevention (DLP) system

Contracting rules typically require you to have conversations with two or more groups

Discussing decisions with a very large group of people always provides a better outcome

It helps to avoid regulatory or internal compliance issues