Maximizing business information security's educational value

• Published in: IEEE security & privacy 2004-01, Vol.2 (1), p.56-60
• Main Author: Grimaila, M.R.
• Format: Magazinearticle
• Language: English
• Subjects: Business; Business continuity; Computer information security; Continuing education; Cost accounting; Cybersecurity; Data encryption; Disaster management; Education; Ethics; Information analysis; Information security; Network security; Policies; Professional communication; Recovery planning; Risk; Risk management; Security management; Strategic planning; Students
• ISSN: 1540-7993; 1558-4046
• DOI: 10.1109/MSECP.2004.1264855

A business information security course's goals and objectives are quite different from most traditional security courses, which focus on designing and developing new security technologies. Business information security primarily concerns the strategic, tactical, and operational management issues surrounding the planning, analysis, design, implementation, and maintenance of an organization's information security program. Core issues include asset valuation, auditing, business continuity planning, disaster recovery planning, ethics, organizational communication, policy development, project planning, risk management, security awareness education and training, and various legal issues such as liability and regulatory compliance. Because businesses can't afford to mitigate all security risks, students must learn methods to identify and justify the optimal amount of expenditures to ensure that their information assets are sufficiently protected. Students should also understand the technical components of security so they can appreciate the problems experienced by the people they manage. This paper describes my experiences in developing a business information security course that provides students the knowledge arid experience to succeed in today's competitive information-intensive corporate environment.