Performance Measures - Assignment Example

Verizon - Performance Measurement Document Table of Contents Executive Summary Introduction 2 Approach to Monitoring and Log Analysis Measure Background3 Role and Responsibilities3.1 Chief Information Officer3.2 Senior Information Security Officer3.3 Program Information Security Officer4 Legislative and Strategic Drivers5 Measures Development Process6 Information Security Measurement ImplementationAPPENDIX: ReferencesExecutive SummaryThe organization has to change its approach regarding controlling of information security breaches within its information system.

It has to rely more on other defenses like monitoring processes and log analysis apart from ID/IPS. CIO, Senior and Program Information Security Officers are responsible to ensure that the performance of these defenses is according to the requirements and also bring adequate results.1 IntroductionMeasurement of performance is critical to the successful implementation of security recommendations provided in Verizon 2010 Report. The purpose of this document is to outline the measurement of the performance as post-implementation metrics of the recommendation, namely: “Change Organizational Approach to Event Monitoring and Log Analysis” (‘Verizon Report’, 2010).

The scope of this document includes role and responsibility of key people in an organization, background of the measure, legislative and strategic drivers, measure development process and its implementation. 2 Approach to Monitoring and Log Analysis Measure BackgroundAccording to Verizon Report 2010, maximum information security breaches in 2009 showed that in most of the breaches the data is compromised after lapse of several days of the breach. It takes effort and time until these breaches are found.

Significantly, people other than the victim makes such discovery. The victim upon information reacts immediately and uses the most important defense that is ID/IPS. However, this measure in most cases intensifies the situation rather controlling it. Furthermore, it is not the only defense that organizations have to curb this problem and relying upon it as a last resort does not solve the problem and eliminate it completely (Solms, 2000). 3 Role and Responsibilities3.1 Chief Information OfficerThe CIO is responsible to change the approach to tackle breach instance at the organization.

CIO should ensure that as a post-attack instance, ID/IPS should not be used instantly and as the only measure to control the situation. Instead, batch processing and log analysis should be undertaken with keen interest to identify any stack of viruses or breaches. The focus should be on ‘mass’ breaches rather ‘individual’. Therefore, proper policy and implementation guidelines have to be circulated to all users in the organization regarding the measures to be taken in case breach takes place and is discovered.

Additionally, the CIO has to prioritize and select performance measures and develop the targets for their achievement (‘NIST’, 2008).3.2 Senior Information Security OfficerThe role of Senior Information Security Officer is to ensure that the program manager uses the changed approach to tackle the breach instance. Additionally, he/she has to manage the checklist of performance measurement targets and ensure they are met.3.3 Program Information Security OfficerThe role of Program Information Security Officer is to apply the guidelines provided by CIO to tackle breach instances.

4 Legislative and Strategic DriversThe organization has to follow the legislative and strategic drivers to tackle the breach instance. The legislation governing information security including Government Performance Results Act and Federal Information Security Management Act should be relied on to measure the performance after implementation of the recommendation.5 Measures Development ProcessThe organization has to develop the approach to measure development, measure prioritization and selection and establish measurement targets.

These targets will be assessed against a checklist which will be available to Senior Information Security Officer to ensure that all targets are achieved. 6 Information Security Measurement ImplementationThe organization has to execute the process of monitoring and log analysis along with other defenses to ensure proper control over breach instances.APPENDIX: References‘NIST’, (2008). Information Security, Performance Measurement Guide. US Department of Commerce.Solms, B.V., (2000). Information Security- The third wave?

Computers & Security. Vol. 19, Pages: 615-620. Retrieved October 15, 2011 from http://www.tut.fi/units/tuta/tita/2006-2007/TITA-5300/the_third_wave.pdf‘Verizon Report’, (2010). Verizon 2010 Data Breach Investigations Report. USA.