| |
| SANS' webcast series aims to empower SMEs to make good risk management decisions |
"Millions of small businesses assume that Information security is just too complex," explains Jim Herbeck, an instructor for the SANS Institute. "But by breaking down the complete process into smaller, bite sized chunks using the same best practice favoured by larger organisations, SMEs (Small Medium Enterprises) should understand that having good information security is a very realistic goal."
SME managers need to be informed consumers. Because many information security products and services are targeted for large, multi-national organisations, they may not scale to the budgetary or staffing constraints at SMEs. One of the goals of this webcast series is to make SMEs aware of the many options they have for managing information security risks, and empowering SMEs to make good risk management decisions.
Herbeck's approach to information security is very business-centric. As part of his ongoing research at the Business Information Security Competency Center at the Geneva School of Business Administration, he developed a simplified version of the ISO 27001 information security standard for SME's to use. "The Information Risk Framework is a combination of ISO 27001, ISO 27005, and the SANS Institute 20 Critical Security Controls," says Herbeck. "The Framework includes 33 risk areas organised into eight common business functions. While half the Framework covers IT-related risk areas, the rest specifies non-IT-related risk. This underscores my belief that information security is a business risk, not just an IT risk."
In addition to his work co-founding the Business Information Security Competency Center and teaching for the SANS Institute, Herbeck is a security consultant who has spent over 20 years working with information systems in commercial, government, academic, and research environments, both in the US and Europe. His most recent work with large multi-national organisations has given him some unique insights. "Many large multi-nationals look and behave like a large multi-national when you're sitting in the headquarters building," Herbeck explains. "However, when you visit the subsidiary business units, they look and behave like an SME. My work for several clients involved tailoring large information security programs to work within the constraints of smaller business units. I quickly realised that this approach could have wide ranging application with SME's in general."
The last installment of the SME webcast series took place on February the 21st, when Herbeck offered a session to help SMEs create an information security policy in a compact and risk driven fashion in a fraction of the time required by bigger organisations. In March, Herbeck will present a webcast on Managing Network-related Risk, and April's session will cover Managing Legal, Regulatory, and Compliance Risk.