Ashish Saxena

Network security professionals are in demand . Lay off in this domain is rare. If it has happened to someone then the person should improve his/ her skill set to meet the job requirements.

Information needed in setting up project deadlines are Scope of the project and availability of appropriate manpower. Project scope to be broken down into various activities and alignment of suitable resource on each activity required. It is possible that one resource can handle multiple activities based upon his/ her qualification and experience. Find out that which all activities can run in parallel. With this info either use CPM or PERT method to workout realistic timelines.

Effective Risk Management requires Identification of risk by conduct of Risk Assessment. Risk assessment takes in to account Asset value, Threat value on the asset, Vulnerability/ weakness in the asset, likely hood of threat exploiting vulnerability and Compliance to Regulatory requirements. Subsequently Risk needs to be treated, high risk first and then medium & low risk. Risk can never be made zero. There is always be residual risk which can’t be mitigated due to prohibitive cost of mitigation. Concept of cost benefit analysis needs to be followed .

At the outset, we need to have security operation centre ( SOC) for continuously monitoring of incidents/ events . These need to be responded based upon their criticality . Secondly, threat intelligence is required in the area business operations for necessary action. Collaboration with CERT and similar business entity.

Best practices in encrypting data in EMM are encrypting files with strong passwords and communicating password through alternate means of communication. Secondly SSL to be used for communicating data between the devices. Thirdly secure tunnelling could be done through VPN . Lastly strong password or MFA is needed for mobile devices.

IT Risk management varies from business to business. Knowledge of business and its critical or core processes is the first step before starting the formal risk assessment . Rest process of assessment and treatment can be done as per ISO 27001 or ISO 31000.