Free Essay on Fitting the Security Team into the Company Hierarchy

Recently, the number of security incidents witnessed by organizations has increased to create the need for a coordinated approach to handling the associated security risks efficiently. However, most computer security teams operate from various areas of the organizations hierarchy leading to inefficiencies in the protection of the companys information from unauthorized access, use, exposure, modification, or deletion. In light of this, many businesses have sought to build a formalized security hierarchy of command to protect their information assets. This paper explains how to fit a computer security team into the companys hierarchy of command for adequate management of the inherent security risks.

Is your time best spent reading someone else’s essay? Get a 100% original essay FROM A CERTIFIED WRITER!

Order now

There lacks a standard hierarchical location of a computer security team. The teams can be part of the information technology (IT) group. Operating in the IT department establishes communication and timely dissemination of information. The IT department also hosts computing, networking and communications equipment that can be jointly used to maximize their utilization. The security team can also operate under the physical security group. This provides a holistic view of the companys security situation. Nonetheless, it is challenging to integrate physical and IT security due to the divergence between the two. For example, physical security teams use guns while computer security teams may use firewalls. Finally, the security team may be distributed in all the major departments to heighten safety. However, such a structure can lead time wastage since vulnerabilities detected in one part of the organization have to be discussed and analyzed by team members from other departments.

The key stakeholders have the fundamental responsibilities of committing the required resources, training workers and evaluating the security project. They include customers who are interested in the companies security policies to guarantee the confidentiality of their information. Legal staffs also play a significant role in a security project as through prosecution of the culprits. The government as a stakeholder in a security program seeks to ensure that organizations adhere to the accepted safety laws and regulations. Investors put their money in companies with reduced safety risks to guarantee returns, thus, consider the security projects in place. Finally, the employees are major stakeholders in a security project as they ensure that the organizations computers and networks are safe from malicious attacks that may cause the business to incur losses.

The CISO should also engage customers to determine their security needs. He should ensure the provision of information to customers on how to avoid security breaches such as keeping credit card information secret. The CISO should also provide adequate information on computer security to push investors not only to invest in the business but also in its security systems. Additionally, lobbying for the institution of stricter laws to limit breaches can help the government and the company lawyers to promote safety. Finally, the CISO should assist the employees in understanding their roles and responsibilities in safeguarding sensitive business data. Therefore, he should develop and implement work policies that promote security and training the workers on how to identify and prevent risks.

The CISO should establish a vision strategy to protect information assets. Employees should be involved in the formulation to own up the vision and work towards its fulfillment. For example, a vision statement such as ensuring the protection of company and stakeholder information through prevention, surveillance, and early intervention gives direction to the staff thus promoting the success of security projects. The CISO should also obtain IT management support and buy-in for information sharing and exchange. For example, by equipping the IT department with alerting capabilities, it can detect breaches and forward them for timely correction. The CISO should also establish training requirements for employees to equip them with skills to implement the security programs. For example, unauthorized access can be prevented by ensuring that all staff knows how to manage their passwords.

In conclusion, computer security teams are necessary for the success of any organization. They protect company and stakeholder information from breaches. They also control and lessen damages in case of a breach, preserve evidence, ensure rapid and efficient recovery, and put mechanisms in place to prevent similar future events through the threats identified against the organization. These teams should, therefore, be fitted properly into the companys hierarchy so as ensure their efficiency in data protection. Wherever the location, the security team should collaborate with all the departments and stakeholders for its success. Additionally, it is vital that the security team the support of the CISO to receive authority and the required resources to do its work.