OUTSOURCING INFORMATION SECURITY

By DAVID HARRIS

CONTENTS OUTSOURCING AND INFORMATION SECURITY FIRST … SOME DEFINITIONS SECOND … A CLARIFICATION Y2K AS A TURNING POINT THE POST Y2K OUTSOURCING SPEED BUMP SHAKY MANAGED SECURITY SERVICES PROVIDERS A PROGNOSIS THE INFORMATION SECURITY MARKET REFERENCES INFORMATION SECURITY RISKS THREATS FROM INTERNAL SOURCES FROM EXTERNAL SOURCES REVIEW OF THREATS VULNERABILITIES COMPUTER SYSTEMS AND NETWORKS SOFTWARE DEVELOPMENT SYSTEMIC RISKS OPERATIONAL RISK OPERATOR AND ADMINISTRATOR RISK COMPLEXITY RISK LIFE-CYCLE RISK RISKS OF OBSOLESCENCE VENDOR VIABILITY RISK RISK OF POOR QUALITY SUPPORT CONVERSION RISK RISK OF DEPENDENCY ON KEY INDIVIDUALS SUMMARY JUSTIFYING OUTSOURCING PROFESSED REASONS TO OUTSOURCE THE BASIS FOR DECISION REASONS FOR CONSIDERING OUTSOURCING COST SAVINGS PERFORMANCE SECURITY EXPERTISE COMPUTER APPLICATIONS SUPPORT FINANCIAL ARRANGEMENTS THE OTHER SIDE OF THE OUTSOURCING DECISION RISKS OF OUTSOURCING LOSS OF CONTROL VIABILITY OF SERVICE PROVIDERS REASONS FOR ABANDONING SERVICE RELATIVE SIZE OF CUSTOMER QUALITY OF SERVICE TANGIBLES RELIABILITY RESPONSIVENESS ASSURANCE EMPATHY DEFINITIONS THE ISSUE OF TRUST PERFORMANCE OF APPLICATIONS AND SERVICES LACK OF EXPERTISE HIDDEN AND UNCERTAIN COSTS LIMITED CUSTOMIZATION AND ENHANCEMENTS KNOWLEDGE TRANSFER SHARED ENVIRONMENTS LEGAL AND REGULATORY MATTERS SUMMARY AND CONCLUSION CATEGORIZING COSTS AND BENEFITS STRUCTURED, UNBIASED ANALYSIS—THE IDEAL COSTS AND BENEFITS TANGIBLE VERSUS INTANGIBLE COSTS AND BENEFITS OBJECTIVE VERSUS SUBJECTIVE COSTS AND BENEFITS DIRECT VERSUS INDIRECT COSTS AND BENEFITS CONTROLLABLE VERSUS NONCONTROLLABLE COSTS AND BENEFITS CERTAIN VERSUS PROBABILISTIC COSTS AND BENEFITS FIXED VERSUS VARIABLE COSTS AND BENEFITS ONE-TIME VERSUS ONGOING COSTS AND BENEFITS TANGIBLE-OBJECTIVE-DIRECT COSTS AND BENEFITS TANGIBLE-OBJECTIVE-INDIRECT COSTS AND BENEFITS TANGIBLE-SUBJECTIVE-DIRECT COSTS AND BENEFITS TANGIBLE-SUBJECTIVE-INDIRECT COSTS AND BENEFITS INTANGIBLE-OBJECTIVE-DIRECT COSTS AND BENEFITS INTANGIBLE-OBJECTIVE-INDIRECT COSTS AND BENEFITS INTANGIBLE-SUBJECTIVE-DIRECT COSTS AND BENEFITS INTANGIBLE-SUBJECTIVE-INDIRECT COSTS AND BENEFITS NEXT CHAPTER REFERENCE COSTS AND BENEFITS THROUGHOUT THE EVALUATION PROCESS TRIGGERING THE PROCESS DIFFERENT STROKES ANALYSIS OF COSTS AND BENEFITS THE EVALUATION PROCESS REQUESTS FOR INFORMATION AND PROPOSALS—COSTS COSTS TO THE CUSTOMER COSTS TO THE SERVICE PROVIDERS REQUESTS FOR INFORMATION/PROPOSAL—BENEFITS BENEFITS TO THE CUSTOMER BENEFITS TO THE SERVICE PROVIDERS REFINING THE STATEMENT OF WORK (SOW) SERVICE LEVEL AGREEMENT (SLA) IMPLEMENTATION TRANSITION PHASE TRANSFERRING FROM IN-HOUSE TO OUT-OF-HOUSE MONITORING, REPORTING, AND REVIEW DISPUTE RESOLUTION INCIDENT RESPONSE, RECOVERY, AND TESTING EXTRICATION THE OUTSOURCING EVALUATION PROCESS—CUSTOMER AND OUTSOURCER REQUIREMENTS INVESTMENT EVALUATION METHODS INCLUDING ALL COSTS STRUCTURE OF THE CHAPTER THE GATHERING OF REQUIREMENTS BUSINESS REQUIREMENTS VIABILITY OF SERVICE PROVIDER FINANCIAL ANALYSIS MARKETPLACE AND BUSINESS PROSPECTS HEALTH OF THE ECONOMY MARKETPLACE MATTERS COMPETITIVE ENVIRONMENT STRUCTURE OF THE BUSINESS NATURE OF THE BUSINESS RELATIVE SIZES OF ORGANIZATIONS SERVICE REQUIREMENTS MEETING EXPECTATIONS CONCENTRATION AND DISPERSION OF BUSINESS OPERATIONS AND FUNCTIONS CUSTOMER VIEW OF SATISFACTORY SERVICE TECHNOLOGY REQUIREMENTS THE “BLEEDING” EDGE OUTSOURCING SECURITY FUNCTIONS AND SECURITY CONSIDERATIONS WHEN OUTSOURCING SECURITY MANAGEMENT PRACTICES SECURITY ORGANIZATION PERSONNEL SECURITY OTHER HUMAN-RELATED CONCERNS OF THE COMPANY AMELIORATING THE CONCERNS OF WORKERS ASSET CLASSIFICATION AND CONTROL INFORMATION SECURITY POLICY ADOPT CUSTOMER POLICY ADOPT SERVICE PROVIDER’S POLICY EVALUATE RESPONSES TO DUE-DILIGENCE QUESTIONNAIRE ENFORCEMENT AND COMPLIANCE ACCESS CONTROL AND IDENTITY PROTECTION APPLICATION AND SYSTEM DEVELOPMENT OPERATIONS SECURITY AND OPERATIONAL RISK SECURITY MODELS AND ARCHITECTURE SECURITY SERVICES—FRAMEWORK SECURITY INFRASTRUCTURE SECURITY MANAGEMENT AND CONTROL FRAMEWORK APPLICATION TO SERVICE PROVIDERS PHYSICAL AND ENVIRONMENTAL SECURITY TELECOMMUNICATIONS AND NETWORK SECURITY CRYPTOGRAPHY DISASTER RECOVERY AND BUSINESS CONTINUITY BUSINESS IMPACT ANALYSIS PLANNING IMPLEMENTATION AND TESTING LEGAL ACTION SUMMARY OF THE OUTSOURCING PROCESS—SOUP TO NUTS