Shifting Information Systems Security Responsibility from User Organizations to Vendor/Publisher Organizations

摘要

An important redefinition of responsibility for information systems security is now underway. The problem is nobody's talking about it, much less planning for it. This shift impacts information security staffing plans, information security project plans, information security architectures, and many other aspects of the information security management process. Traditionally, information systems security has been primarily the user organization's responsibility. User organizations were responsible for doing risk assessments, for identifying and implementing the controls needed to address their organization's unique risks, and for administering and maintaining these controls. While these responsibilities will not disappear, in the future user organizations will orchestrate a team made up of both inside staff members and a variety of outside organizations. Beyond the increasingly large number of outsourcing firms and independent consultants that provide information security related services, these outside team members will be information systems product vendors and information content publishers.