- [Narrator] Implementing security controls
is only the beginning of the risk management journey.
Security professionals must perform
a variety of ongoing activities to ensure
that risks remain properly managed.
These include monitoring and assessing controls,
measuring control effectiveness, reporting,
and continuous improvement.
Risk assessments represent a point in time analysis
of the risks facing an organization
and the ability of controls to manage those risks properly.
The risk environment changes on a regular basis,
and organizations should routinely review
their risk assessments as well as perform periodic
control assessments designed to test
the correct functioning and effectiveness of those controls.
For example, most organizations use a firewall
to block unwanted network traffic.
A control assessment of the firewall
might use network scanning tools
to verify that the firewall is not allowing
any unwanted traffic through the network perimeter.
Organizations should also conduct routine measurement
of the effectiveness of their security controls
and use this information to inform management reporting.
For example, an organization might track
the number of compromised end user accounts
as a means to evaluate the effectiveness
of anti-phishing controls.
They might also track the number of vulnerabilities
detected in public-facing systems
as a means to evaluate the effectiveness
of operating system and application patching efforts.
Organizations seeking to assess the security
knowledge and skills of software developers
might use the number of critical findings
in initial scans of web applications.
Finally, organizations might use
the number of data breaches requiring notification
of individuals as a measure of the overall effectiveness
of their security program.
All of these measures provide valuable information
to management as they seek
to refine their information security programs.
All security programs should embrace
a spirit of continuous improvement
that seeks to enhance security controls
and improve the overall state of information security
in the organization over time.
The results of control effectiveness measures,
risk assessments, and expert knowledge
should feed this continuous improvement process.