Domain 01 - Information Security Governance

75. Business Case Development Part3

Now, a business case should be evaluated and reviewed to be able to determine if it actually has value and importance, or is it just some kind of cool fad? That sounds like a good idea. The case should be reviewed to determine if it will be managed properly. Can the benefits really be delivered? Are there dedicated resources we can use in achieving this business case? Are there interdependent projects being undertaken that need to be done in the correct sequence? Again, a business case might be an idea based on our achieving other objectives. And so we have to ask that question: are those other sorts of reporting projects going to be done? Are they being undertaken? Will it be finished so we can move forward with this next case that we're talking about?

76. Business Case Objectives

The business case process should be one that's adaptable, meaning it should be tailored to the size and risk of the proposal. There should be some consistency. The same basic business issues should be addressed by each project. It should be business-oriented concerning the business's capabilities and the impact on the business. Your business case process should be comprehensive. It should include all relevant factors for the proper evaluation of the business case. It certainly needs to be understandable. It needs to be relevant, logical, and simple to be able to evaluate. It needs to be measurable. At the very least, key elements of it should be quantifiable. The transparency of the case means that the key elements should be justified directly, not through a bunch of roundabout ways of reasoning to get to a certain point. And of course, there has to be accountability where the costs are clearer. Bye.

77. The Desired State

Now in the goal of our strategies, we said, "Of course, there needs to be a goal, right?" There has to be a target. We just don't do these things ad hoc. We want to get to a certain objective, and we often call that the desired state. Now, the desired state is really a reference to a snapshot of conditions at a particular point in the future. So the state of security can't necessarily be quantitatively defined. Therefore, to get to those states, we have to sometimes put them in qualitative terms regarding some of the attributes or characteristics or outcomes. In other words, I might say, "Look, we're being hit 150 times an hour with a port scan." So if we put in an intrusion detection system, which by the way, could or could not work, I'm just throwing that out as an example that we're going to say we're going to go from 15,000 down to 5000. You know what, I can't quantitatively say that. In fact, you never know, we may suddenly come under the attack of a group of people from overseas that have just picked us randomly. I mean, I can't do that, but I can quantitatively look at some of the attributes, such as how many of these port scans are getting through the network, what are the characteristics of the traffic, and the outcomes of putting it in? Am I getting fewer intrusions or less attacks against my servers? Again, I can't give you a quantified number of how many fewer, but we can look at it qualitatively and see if we're meeting some of those goals. Now we do want to try to make these as well defined as possible, but it is an important process to remember that we can't promise quantitatively the actual dollar amounts of savings or the numbers of things, but we can describe what the conditions of that desired state are. And that was done again through the attributes, characteristics, and what the eventual outcomes should be.

78. COBIT

COBIT focuses on its related processes from governance, management, and control perspectives. COBIT has a framework of supporting tools to be able to help you bridge the gap between technical issues and business risks. Now, with regards to what we're doing with CIS, the controlled objectives and procedures should extend beyond IT activities to include any activity that could impact information security. So what are we talking about here? As we're building up these strategies and we're looking for frameworks, it's important to remember that we don't necessarily want to focus on just IT-related processes where Cobett has a great framework for doing that. The goal of CIS M is to take a larger view of the architecture, as we said. And that is, again, remembering the data from its entire life cycle, from when it was first created or first entered, being transmitted, how it's being stored, how it's being reviewed. reviewed for accuracy all of these little pieces or places where the data could be touched. We kind of want to look at it from that aspect.

79. COBIT Controls

COBIT controls are typically defined as policies or procedures, practices, and organisational structures that are intended to provide some reasonable assurance that business objectives are met. COVID will define your enterprise governance as a set of responsibilities and practise offices that are exercised by the board and executive management. Now, again, what are we talking about? Controls are ways in which we try to deal with risk management. And yes, policies that sound like written pieces of paper, in fact do act as controls, as do the procedures that make up the purview of those policies. What we want you to do, the way we define practices, how the organisation is structured, all of that works together to be able to exercise control over the security of your assets. Now, some of those procedures, some of those policies may certainly talk about different applications of countermeasures or acceptable use or physical security, but they all fall under the guidelines of controls.

Prepared by Top Experts, the top IT Trainers ensure that when it comes to your IT exam prep and you can count on ExamSnap Certified Information Security Manager certification video training course that goes in line with the corresponding Isaca CISM exam dumps, study guide, and practice test questions & answers.