Re: What are the costs of an ISMS?

[James Alcasid <james.alcasid () macinfosec com>]

Also consider what your security baselines and metrics would be. What are
you protecting and to what extent? How much risk are you willing to assume
and as Mr Ruiz mentioned, what is the applicable scope. Analyze and plan
before throwing money and people otherwise you will have a security
infrastructure that dwarfs the people, systems and processes they are
entrusted to serve and protect.

It would also be good to consider sec

On 7/12/11 12:54 PM, "Omar Salvador Alcalá Ruiz" <oalcala () scitum com mx>
wrote:

> The question is broad, but first define a scope. Will it be the entire
> organization? A process? 3 processes? Based on that, and how many people
> and approximate assets you have, you can define a good scope and the
> effort needed.
>
> One more thing to consider: certification. Is the organization in the
> need of the ISO 27K certification? Will you be helping during the
> certification of the process (I think yes)? Will you fix or help fixing
> the observantions made by an auditor (I think no)?
>
> The operation should be taken into account based on the number of
> processes defined in the scope.
>
> Its hard to tell numbers with the info given, I'm trying to give you the
> input I'd start to look for. # of employees is only a part of the input.
> HTH
>
>
> ----- Original Message -----
> From: Mikhail A. Utin [mailto:mutin () commonwealthcare org]
> Sent: Tuesday, July 12, 2011 10:12 AM
> To: gatnjef <gatnjef () googlemail com>; security-basics () securityfocus com
> <security-basics () securityfocus com>
> Subject: RE: What are the costs of an ISMS?
>
> I would consider 2 per 100 employees, but with the size of enterprise
> increasing, this ratio should increase as well. It will reflect the
> increase of complexity of IT infrastructure and IT security functions .
> It would not hurt having 3 per 100.
> Regards
>
> Mikhail A. Utin, CISSP
> Information Security Analyst
> Commonwealth Care Alliance
> 30 Winter St.
> Boston, MA 
> TEL: (617) 426-0600 x.288
> FAX: (617) 249-2114
> http://www.commonwealthcare.org
> mutin () commonwealthcare org
>
> -----Original Message-----
> From: listbounce () securityfocus com [mailto:listbounce () securityfocus com]
> On Behalf Of gatnjef
> Sent: Sunday, July 10, 2011 4:11 AM
> To: security-basics () securityfocus com
> Subject: What are the costs of an ISMS?
>
> Hello List,
>
> I do have a broad and a rather non-technical question: What are the costs
> of implementing and operating an Information Security Management System
> in medium- and large-sized enterprises?
>
> More specifically:
> - How many FTEs should be assigned to the CISO/Information Security
> Department (per number of employees/IT-employees)?
> - How many FTEs should be working on operating the ISMS?
>
> I know this depends also on a number of other factors like the current IT
> security maturity level and nature of the business.
>
> It would be really helpful you can comment on these questions.
>
> I'm looking forward to having a constructive discussion.
>
> Thank you,
> Patrick
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate In this guide
> we examine the importance of Apache-SSL and who needs an SSL certificate.
> We look at how SSL works, how it benefits your company and how your
> customers can tell if a site is secure. You will find out how to test,
> purchase, install and use a thawte Digital Certificate on your Apache web
> server. Throughout, best practices for set-up are highlighted to help you
> ensure efficient ongoing management of your encryption keys and digital
> certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f7
> 27d1
> ------------------------------------------------------------------------
>
> CONFIDENTIALITY NOTICE: This email communication and any attachments may
> contain confidential
> and privileged information for the use of the designated recipients named
> above. If you are 
> not the intended recipient, you are hereby notified that you have
> received this communication
> in error and that any review, disclosure, dissemination, distribution or
> copying of it or its
> contents is prohibited. If you have received this communication in error,
> please reply to the
> sender immediately or by telephone at (617) 426-0600 and destroy all
> copies of this communication
> and any attachments. For further information regarding Commonwealth Care
> Alliance's privacy policy,
> please visit our Internet web site at http://www.commonwealthcare.org.
>
>
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an
> SSL certificate.  We look at how SSL works, how it benefits your company
> and how your customers can tell if a site is secure. You will find out
> how to test, purchase, install and use a thawte Digital Certificate on
> your Apache web server. Throughout, best practices for set-up are
> highlighted to help you ensure efficient ongoing management of your
> encryption keys and digital certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f7
> 27d1
> ------------------------------------------------------------------------
>
>
> ------------------------------------------------------------------------
> Securing Apache Web Server with thawte Digital Certificate
> In this guide we examine the importance of Apache-SSL and who needs an
> SSL certificate.  We look at how SSL works, how it benefits your company
> and how your customers can tell if a site is secure. You will find out
> how to test, purchase, install and use a thawte Digital Certificate on
> your Apache web server. Throughout, best practices for set-up are
> highlighted to help you ensure efficient ongoing management of your
> encryption keys and digital certificates.
>
> http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f7
> 27d1
> ------------------------------------------------------------------------



------------------------------------------------------------------------
Securing Apache Web Server with thawte Digital Certificate
In this guide we examine the importance of Apache-SSL and who needs an SSL certificate.  We look at how SSL works, how 
it benefits your company and how your customers can tell if a site is secure. You will find out how to test, purchase, 
install and use a thawte Digital Certificate on your Apache web server. Throughout, best practices for set-up are 
highlighted to help you ensure efficient ongoing management of your encryption keys and digital certificates.

http://www.dinclinx.com/Redirect.aspx?36;4175;25;1371;0;5;946;e13b6be442f727d1
------------------------------------------------------------------------