The new guide is aimed at helping readers scope, plan and justify their security awareness programs to management. Starting with an explanation of the need for, and value of, information security awareness (parts of which I contributed), it describes techniques to obtain management support and funding. It delves into ROI or ROSI (Return on [Security] Investment) using standard financial investment appraisal techniques to develop the business case for information security awareness, pointing out the difficulties of defining the benefits part of cost-benefit analysis for risk avoidance initiatives. It offers worthwhile tips on communicating security needs to management, especially by aligning security with other strategic objectives. This gets right to the heart of a key issue: without senior management's understanding and proactive support, information security initiatives are severely constrained if not doomed from the start. Whereas IT security can be handled primarily within IT Department, the scope of information security extends across the entire enterprise and necessarily involves a wide tranche of managers. Raising management's security awareness is therefore an important starting point.
Another good reason for developing business cases for investments in information security is that they naturally suggest a suite of metrics that can be used not only to assess the value of the investment but also to drive further security improvements. I heartily recommend taking a good look at ISACA's ValIT framework for more on this.
A fine international team of acknowledged awareness experts collaborated to produce the document using email, telephone conferences and Google Docs (which proved ideal for me, being based on the far side of the globe from Europe!). Credit is due to the editors from ENISA who kept us all in line and worked wonders on the formatting and presentation. Nice job!
Suppose i run passwd via bash shell. It is a suid program, which temporarily runs as root(owner) and modifies the user entries.
However, when i write a C file and give 4755 permission and root ownership to the 'a.out' file , it doesn't run as root in bash shell. I verified this by... (2 Replies)
Are the programs written on schedulers ,thread library , process management, memory management, et al called systems programs ? How are they different from the programs that implement functions like open() , printf() , scanf() , read() .. they have a prefix sys_open, sys_close, sys_read etc , right... (1 Reply)