Re: CISO/Security Team roles and functions

i am skin a consanguineous issue of roles and job responsibilities. security analyst though reports to a non-it administrator vp role but so does, a database administrator, a software quality guts personnel and it manager(s).

Is this a correct organisational structure?Can DB Admin and QA function be made reporting to Security Analyst?If this senior security analyst has to hire a few helping hands, what are the usual ‘job titles’?

It’s still a one man shop being asked to expand into a department. If security analyst has to ask for a change in the job title in the expanded scheme of things but is still not ready for ‘CSO / CISO yet’, would IT security architect, IT security engineer be more appropriate?

—– Original Message —– From: <amatachick@gmail.com>To: <security-basics@securityfocus.com>Sent: Tuesday, February 05, 2008 1:02 AMSubject: Re: CISO/Security Team roles and functions

> This is an issue I’ve run into on every Information Security job. > Sometimes Information Security takes care of the firewalls and IDSs and > sometimes that job goes to the Network Administrators. I’ve worked in both > environments. I have to say from personal experience the later is much > more common, especially when you get to a management level. I am fine with > it being either way as long as Information Security can fully, and without > the Network Administrator’s prior knowledge, audit the Firewall and IDS > configurations and logs. I don’t believe that separation of duties and > responsibilities applies so much in this scenario as in the bigger > picture.>>> I’ve run into the most issue with segregation of duties and > responsibilities at the departmental level. The key question being, who > does Information Security report to? I, personally, don’t think it should > be Information Technology. I feel that Information Security should really > be its own department or at the least report to compliance or legal > departments.>>> To be succinct, I believe it is the job of Information Security to ensure > and/or report incidents, non-compliance to policies and procedures, > firewalls and IDSs are functioning properly, and conduct > audits/assessments.

Recently:

• I 500 snowmobile race
• Ann lee
• Ghost videos
• Wnba salaries
• Comcast porn clip
• Google ocean floor
• Flight of the conchords season 2 episode 3
• Michael phelps marijuana pictures
• Fun superbowl games
• Elmer gantry