Computer and IT Security Controls
Quality security is changing the way people do security. Business and IT security is organized around defining risk in a way that's measurable. ... Instead of measuring risk in a company, it should be measured in the world, an actuarial sort of thing. Some business security models don't believe in things like doing a risk assessment at a company or doing vulnerability testing.
What could be set out to do is figure out what percent of vulnerabilities represents real risk and how to go about figuring [the risk] out.
All the firewalls, all anti-virus products, all spyware scanning and all those things are there. Look at services that measure where a company is in relation to things we call "essential practices."
Most companies can now buy a security subscriptions, and during that time, they are given a very, very broad array of security services. They get testing, they get alerts, [and] they get decision support. They get what amounts to a help desk.
While everybody else is sitting at home fretting about the crime rate, many security sebscription providers are out patrolling the IT neighborhood.
They indeed are actually out fixing things... testing every anti-virus and anti spyware product every day against every threat that's ever happened in the entire world. This is done by making market-driven mechanisms where people give the knowledge needed to figure out what's really going on in the world.
For example, because Cisco may hate Check Point, Cisco would be glad to provide an attack that they think Check Point will fail. If it is run and Check Point fails it (or any of the other firewall vendors), then [the vendors] have 10 days to fix it and ship it, or they lose the ICSA Lab certification. That same sort of dynamic model gives us all kinds of inroads to figure out what really is going on in the computer security space.
You will find much more on this topic at WorldsLargestNetwork.com
| |||||||
 | |||||||
| |||||||
| |||||||
| |||||||
|
WorldsLargestNetwork.com
