Chapter 5, Problem 6RQ

Program Plan Intro

Information Security (InfoSec) program:

• The information security program defines structure and format of controlling the risks related to the information security of a company or an organization.
• This program includes all objectives, planning and policies of the information security.
• It includes three principles namely, confidentiality, integrity and availability.

 Functions of a complete InfoSec program:

• A complete InfoSec program includes different functions like, risk management, risk assessment, system testing, policy, legal assessment, training and many others.
  • Risk management implements the controls to reduce the threats.
  • Risk assessment identifies or predicts the threats in the technology or system.
  • Policy promotes the policies related to information security.
  • Planning method includes creation, maintenance and monitoring of the plans related to information security.
  • Measurement predicts the risks using the existing systems or technologies.
  • Legal assessment includes all the legal issues related to company.
  • System testing check for vulnerabilities like hackers and attackers and secures the new technologies from the unauthorized users.
• InfoSec program includes some other functions like centralized authentication, system security administration, network security administration, incident response, vulnerability assessment and many others.