Recently someone forwarded me a comprehensive survey of Canadian IT professionals that indicated there was a lack of information security guidance available for IT and security professionals to follow. I strongly disagree with the point of view that more guidance is needed to operate a secure environment and implement secure systems and solutions, although certainly more papers on various challenging subjects would always be beneficial.

Each week over the coming months, I plan to highlight leading security resources and initiatives that will support your efforts to improve security practices within your organization. Each column, I will highlight a half dozen leading security focused resources covering various aspects of information security management.

Finally, people learn in different ways. Some like to read, some like to hear, some like to see, some like to discuss, etc. Whichever method works for you is fine. My approach is to highlight leading resources to people and let them determine what is the best way to digest the knowledge and, more importantly, apply it in the their professional efforts. I have found considering how to apply the general guidance to the specific organizational situation is one of the best ways to obtain a deep understanding of the key concepts, methods, and recommendations being presented by the various resources. In other words — implementing change is always the best teacher.

Share this posting with your colleagues. Good luck and have a great week.

1. The ISF Standard of Good Practice for Information Security
The ISF standard is designed to help any organization, irrespective of market sector, size or structure, keep the business risks associated with its information systems within acceptable limits. It is a major tool in improving the quality and efficiency of security controls applied by an organization.