- Image via Wikipedia
Fighting Computer Crime: A New Framework for Protecting Information
Risk assessment demands due diligence, which makes business sense and derives organization mission. Due care care is also about applying the specific control that counts. In information security, due diligence means a complete and comprehensive effort is made to avoid a security breach which could cause detrimental effects and identify various threats that may be exploited for a possible security breach.
Donn Parker defines due care as a “use of resonable safeguards based on the practices of similiar organizations”
Fred Cohen defines “due diligence is met by virtue of compliance review.”
Organizations must: (i) periodically assess the security controls in organizational information systems to determine if the controls are effective in their application; (ii) develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational information systems; (iii) authorize the operation of organizational information systems and any associated information system connections; and (iv) monitor information system security controls on an ongoing basis to ensure the continued effectiveness of the controls.
(FIPS 200, Section 3, Minimum Security Requirements)
![Reblog this post [with Zemanta]](https://img.zemanta.com/reblog_e.png?x-id=313b8a37-86b7-420d-b8eb-24979016eeac)
