View online
Others who downloaded this publication also downloaded ...
Abstract
In this IBM® Redguide™ publication, we first explore some of the concerns that characterize security requirements of, and threats to, business and information technology (IT) systems. We then identify a number of business drivers that illustrate these concerns, including managing risk and cost, and compliance to business policies and external regulations. We describe how security is a major consideration in the way that business and information technology systems are designed, built, operated, and managed.
In the past decades, industry groups and standards bodies have developed frameworks that serve as a baseline for some aspects of security. We discuss two common frameworks: CoBiT and ISO27002.
Security for information technology can be complex and confounding. Therefore, IBM has created a pair of complementary views to bridge the communication gap between the business and the technical perspectives of security to enable convergence in thought and process.
The IBM Security Framework addresses the business view, and the IBM Security Blueprint addresses the technical view.
The IBM Security Framework was developed to describe security in terms of the business resources that need to be protected, and looks at the different resource domains from a business point of view. It divides IT security into the following six resource domains:
- People and Identity
- Data and Information
- Application and Process
- Network, Server, and Endpoint
- Physical Infrastructure
- Security Governance, Risk Management, and Compliance
The IBM Security Blueprint expands on the business oriented view of the IBM Security Framework by mapping the domains into a core set of security capabilities and services. These capabilities and services serve as a starting point for design, development, integration, operation, and management of an enterprise IT environment that has security at its core.
With the security domains, capabilities, and services as a backdrop, this guide covers two business scenarios, the first concerning password management related costs, and the second discussing PCI compliance to illustrate how the IBM Security Framework and IBM Security Blueprint can be best used.
This guide is a valuable resource for business leaders, security officers, consultants and architects who wish to understand and implement enterprise security following architectural guidelines.
Table of contents
Executive overview
Business context for IT security
IT security management
IBM Security Framework
IBM Security Blueprint
Business scenarios
Summary
Other resources for information