Managing for Enterprise Security

Security has become one of the most urgent issues for many organizations. It is an essential requirement for doing business in a globally networked economy and for achieving organizational goals and mission. But it is no small task. The technical and environmental complexity of today's organizations and the ever-increasing dependence on technology to drive and automate processes and create competitive advantages make security a challenging activity. Adding to this complexity is a growing list of vulnerabilities and increasingly sophisticated threats to which organizations are subjected on a daily basis. Organizations can no longer be effective in managing security from the technical sidelines. Security lives in an organizational and operational context, and thus cannot be managed effectively as a stand-alone discipline. Because security is a business problem, the organization must activate, coordinate, deploy, and direct many of its existing core competencies to work together to provide effective solutions. And to sustain success, security at an enterprise level requires that the organization move toward a security management process that is strategic, systematic, and repeatable—in other words, efficient at using security resources and effective at meeting security goals on a consistent basis. Managing for enterprise security defines a disciplined and structured means for realizing these objectives. This report presents the interim results of work done by members of the Networked Systems Survivability Program at the Software Engineering Institute in exploring these issues. The authors offer a view of the changing environment in which security must be performed and, from their field work and research, itemize characteristics of common existing approaches to security that limit effectiveness and success. A "desired state" as a security target for the organization is outlined, and the organizational transformation that the authors believe is essential for approaching security as a business problem is presented. Finally, the authors describe their current work in exploring solutions that they believe will enable this transformation.