|  Home   |  Forums   |  News   |  Blog   |  Reviews   |
 Satellite   Digital TV   IPTV   Cable   HDTV   Computers   Apple   Games   Mobile Phones   Broadband   Internet   Security   Telecoms   USB   VoIP   Wireless   Science 

July 22, 2009

ISACA Leader Calls for Changes to Information Security

by ISACA

At ISACA’s International Conference in Los Angeles this morning, security professional John Pironti called for a sweeping change in how enterprises deal with information security.

“Security by compliance is no longer working,” said Pironti, who is president of IP Architects and an ISACA volunteer.

“The number and impact of security breaches have dramatically increased in the last couple of years, even though companies were in compliance with standards like PCI, GLBA, FFIEC, FISMA and others.”

If organizations continue to focus on security by compliance, he argues, the adversaries will continue to win as their attacks become more effective and more damaging.

“Compliance can be a good starting point for securing information infrastructure and data if an organization has not put anything in place previously, but it cannot be the end point of the conversation.”

“We need to change the fundamental approach to the way enterprises deal with information protection,” Pironti said in his “Information Security 2.0” presentation at ISACA’s conference.

“We need to stop thinking about information security and start thinking about information risk management.”

Information risk management requires more input from and decisions made by the business, instead of solely by security professionals and regulators.

Explaining the difference between the two, Pironti said, “Information security sets the tone for organizations that forces them to put measures in place that may actually end up preventing the business from being successful.

Risk management gives the organization the power to make the security decisions that align with its business requirements and then implement appropriate controls.”

Another critical change, according to Pironti, is to focus on protecting data and information instead of just technology.

“The technology is just a vessel for the data and has little value by itself. By focusing on the data, enterprises will be better prepared for the challenges that they may face from any adversary” Pironti said.

In addition to Pironti’s presentation, ISACA’s International Conference also featured the unveiling of Risk IT, a new IT enterprise risk management framework developed by ISACA. The framework will be publicly available as a free download in September.



Bookmark and Share

Story link: ISACA Leader Calls for Changes to Information Security

Discuss this in the Techwatch Forums

Related news to "ISACA Leader Calls for Changes to Information Security"



No Comments »

No comments yet.

Leave a comment

Connect with Facebook


Previous: «
Next: »

Tags:

Visited 375 times, 1 so far today