Sponsored By

Share Your Thoughts On IT Risk Management

In today's interconnected world, filled with increasingly sophisticated yet generally anonymous malefactors, IT <em>must</em> have a risk management program. Most of us have heard this so many times it goes in one ear and out the other, making about as much impression as your grandmother's homespun advice to always brush after meals and never run with scissors. But we all know grandma was right.

Kurt Marko

December 22, 2010

2 Min Read

"In today's interconnected world, filled with increasingly sophisticated yet generally anonymous malefactors, IT must have a risk management program." Most of us have heard this so many times it goes in one ear and out the other, making about as much impression as your grandmother's homespun advice to always brush after meals and never run with scissors. But we all know grandma was right.Although security spending consistently ranks at the top of most lists of IT spending priorities, it's often easier to sell senior management on tangible new products, where the promised results are immediate and quantifiable, rather than an amorphous, drawn out process, which might not show tangible results for a year or more. Yet without some form of structured risk management program, most IT organizations don't have a good handle on where that technology spending will be most effective.

Do you know the applications most critical to your business success? Have you quantified the cost of downtime or information loss due to a security incident? Do you know where these applications are most vulnerable? The security dependencies on other IT infrastructure, like remote network access, VPNs, or shared storage? Did you use a formal security audit to arrive at these conclusions, and do you have ongoing audit and logging processes in place to verify continued security compliance? A sound risk management program promises answers to these questions and more; information that will maximize the return on your IT security investment.

InformationWeek is taking the pulse of our readers' risk management practices in our latest Risk Survey. We want to see not only how many of you have programs in place, but how you've implemented them, including the methods, organizational changes, and tools used. We'll use the data and any written comments (always one of the most interesting parts of any results) as part of an InformationWeek cover story and full Analytics report that will lay out the key steps in building an IT risk management program.

The survey, available here runs through January 3 and will take under 10 minutes to complete. You'll then be eligible to enter a drawing for an Apple 16GB, Wi-Fi iPad, so if Santa didn't come through, here's a second chance to score the gadget on everyone's wish list. If you're nervous about your responses showing up on Wikileaks, rest assured that everything's confidential and responses are only reported in aggregate.

If taking the survey leads to a resolution to make 2011 the year you take control over your IT security portfolio, a great starting place is the NIST Risk Management Guide for Information Technology Systems [pdf]. Slap this on your iPad (Santa willing) and take a gander during half time of one of those many bowls we'll all be dozing through.

Read more about:

20102010

About the Author(s)

Kurt Marko

Contributing Editor

Kurt Marko is an InformationWeek and Network Computing contributor and IT industry veteran, pursuing his passion for communications after a varied career that has spanned virtually the entire high-tech food chain from chips to systems. Upon graduating from Stanford University with a BS and MS in Electrical Engineering, Kurt spent several years as a semiconductor device physicist, doing process design, modeling and testing. He then joined AT&T Bell Laboratories as a memory chip designer and CAD and simulation developer.Moving to Hewlett-Packard, Kurt started in the laser printer R&D lab doing electrophotography development, for which he earned a patent, but his love of computers eventually led him to join HP’s nascent technical IT group. He spent 15 years as an IT engineer and was a lead architect for several enterprisewide infrastructure projects at HP, including the Windows domain infrastructure, remote access service, Exchange e-mail infrastructure and managed Web services.

Never Miss a Beat: Get a snapshot of the issues affecting the IT industry straight to your inbox.

You May Also Like


More Insights