Information Security Management, 2nd Edition

11.4 Information and Cybersecurity Management

As has been discussed throughout this text, information system security is about technologies and the humans that use them. Therefore, technical security management has both organizational and system components. At the organizational level, we are interested in addressing the organizational concerns presented in the first section of this text—policies, law, security behaviors, and the like, whereas the system component is concerned with the technological countermeasures. At the organizational level, we need to develop and address the items in the configuration management plan. This includes creating a “culture of change management” through the establishment of an organization-wide SeCM program that ...