Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 197
  • Last Modified:

Security


 Hi expsrts,

  I need your opinion in this question :-

  Do you think that IT Security Department can be   considered as either a part of the Corporate IT support department or as part of the Corporate Security department? and why ? please justify your chosen line ?
0
saeeddxb
Asked:
saeeddxb
1 Solution
 
geoffrynCommented:
It would depend on the business model.  The particular expertise required for IT security is most offt4en found in or related to IT, but security is a defense in depth concept that also requires physical security.  As a general rule I would say that it should be under IT with stronger connections to corporate security.
0
 
saeeddxbAuthor Commented:

 what do you mean with business model ? for example im
 an IT manager of a company of 2000 employee and for a budget reason you have been asked to consider the above question ?
0
 
geoffrynCommented:
For most companies up to a certain size, they may not have a well defined coporate security department, but almost all will have an IT department.  Therefore IT security fits well into IT in that business model.  Larger comapnies are more granular in their model and may have the resources to separate out this function.
0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 
SunBowCommented:
> IT Security Department can be considered as either a part of the Corporate IT support department or as part of the Corporate Security department?

No. No choice. It is first one, period.

> and why ?

This "Corporate Security department" is title for building security, guard at door, having employees wear badges, rules like that, even parking regultions and which doors can be used for coming and going, and what you can physically take in or out of a building or room. This is not what I call IT, also there'd be some overlap for situations involving employee badges that can also permit electronic access to rooms or computers.

> IT Security ...in... IT support

If no better reason here, These both have acronymn "IT"

Similar answer if acronymn is "IS"

These involve corporate information and how it is maintained electronically. The building people can use keys, sheets of paper and pen, do not need electronics. IS and IT can live without keys, or pens, but need the electronics for their tasks concerning corporate information.
0
 
SunBowCommented:
> For most companies up to a certain size,

yeah, in a big building, small company may have no choice on building security. But have the choice for their IT staff functions.

This could be farmed out, hiring contractor or consultants to run, but it remains same kind of function, using the electronics.
0
 
SunBowCommented:
> under IT with stronger connections to corporate security

I think this has changed, if for no other reason than worms, outlook, and firewalling. It used to be that any corporate security job was just making rules and delivering sheets of paper saying "obey rules".

But now, you really have to have a much better grasp on IT in order to understand how to make up rules, and which ones should be more prioritised.

For example, some old 'rules' would go simply "no personal email", "do not surf internet", very impersonal and impractical.

Now, they may need to learn forensics, or how to use computer-enabled tools to make discoveries.

So a more interesting question could be, how closely they are getting related to Network Administration these days.
0
 
geoffrynCommented:
A number of Fortune 500 companies rely on the (ISC)2 model for Information Security.  This model specifies that physical access is a strong requirement for IS.  It also specifies that process and human factors contribute IS breach.  To that end, they have consolidated their security.

Is the technology different , yes.  Is the point different, no.  The point is to preserve intellectual property and commany assets.  
0
 
SunBowCommented:
I'm not sure if this helps your situation, but I concur with geoffryn concerning inattentiveness to internal physical security. While a virus or worm gets headliner, substantial and perhaps more abuse can arise from disgruntled employees, or simply, from being too lax. Physical access (to buildings, to rooms, to keyboards) is among the more difficult to defend, and must be coordinated in effort with all others that are involved in aspects of security.

How to do that, remains open question, at least in USA I see they are making more and more agencies for something 'security'. I am supposing they are refining the how-to.
0
 
FlamingSwordCommented:
IT is IS is IT is.
0
 
SunBowCommented:
Thanx, &
Good Fortune!
0

Featured Post

The Firewall Audit Checklist

Preparing for a firewall audit today is almost impossible.
AlgoSec, together with some of the largest global organizations and auditors, has created a checklist to follow when preparing for your firewall audit. Simplify risk mitigation while staying compliant all of the time!

Tackle projects and never again get stuck behind a technical roadblock.
Join Now