Lecture 3

1. Risk Management Process

2. Security Frameworks
3. Access Control
1

Security Management
Due to the increasing use of computer and network
technology the risk of exposure to information system attacks
is increasing.
It is important for the enterprise to protect all its assets, such
as resources and information.
It is not possible to ensure complete security of all assets, but
the possibility of an attack can be reduced by having security
measures in place.
Security management includes

risk management,
information security policies,
procedures, standards, guidelines, baselines,
information classification,
security organisation, and
security education

The objective of security, and a security program, is to

protect the company and its assets.

Core aspects of security management

Restricting
network.

access

to

computer

system

or

Identifying vulnerability points of the assets of an

organisation, possible threats that can exploit these
vulnerabilities, impact of these threats and
strategies that will help mitigate these threats.
Understanding training needs of all employees
about these strategies.
Goals of security management:
information by ensuring:

Confidentiality
Integrity
Availability

To protect