ISACA Sacramento Web Log

I totally agree that COBIT is the best answer to t...

2011-04-20T05:25:17.066-07:00

I totally agree that COBIT is the best answer to the management requirement of IT industry. But can it work without affecting the efficiency?

@Encrypted Flash Guy So... is Federal management ...

2011-02-09T09:21:52.897-08:00

@Encrypted Flash Guy

So... is Federal management incapable? Personally, I think that the govt's efficiency issues originate at a higher level than agency management. The most talented managers executing against the most relevant metrics won't correct systemic policy and organizational shortcomings that lead to complacency, malignant redundancy, and fiefdom-building. Goals, carrots, and sticks are all misguided, and root causes are difficult at best, impossible at worst, to correct.

FISMA has allocated precise tasks to the groups Na...

2011-02-08T03:39:52.695-08:00

FISMA has allocated precise tasks to the groups National Institute of Standards and Technology (NIST) and Office of the Management and Budget (OMB). Metrics are a sine qua non situation of a capable management; in fact management cannot be based just leading perception, it has to be underpinned by figures. A Strategy-Focused association aligns its every day actions and communicates that approach during the enterprise.

The article doesn't intend to take a philosoph...

2010-12-20T21:48:07.893-08:00

The article doesn't intend to take a philosophical or religious stance, secularist or otherwise. If it insinuates that the problem of oil depletion will or will not be resolved by a competing technology, or that resources are or are not provided by grace of a deity, it is by accident.

I simply shared—through reference to recent environmental research and one scientific study with an amusing result—an emerging upward-trending demand for environmental accountants and auditors. Look for evidence in "green products" at retailers, sustainability certifications like LEED, buying and selling of energy credits by utilities, and governments inking carbon reduction legislation and regulation.

My use of the word "scarce" can perhaps be mistaken for a doomsday prophecy. By "scare", I simply mean "finite" in the context of resource economics. anonymous correctly affirms that copper, wood, and whale oil were all found to be finite at some time in history.

2010-12-20T21:46:47.121-08:00

This comment has been removed by the author.

Secularists, today’s heirs of Greek philosophy, ob...

2010-12-14T12:21:41.192-08:00

Secularists, today’s heirs of Greek philosophy, obsess irrationally on lack of resources. This, in spite of the fact that historical parallels ranging from Thomas Malthus' notorious 1798 "Essay on Population," all the way to my examples below, have proven to be needlessly hysterical.

America used to depend on whale oil for lighting. During the early 19th century, pundits warned that since whales were being harvested at an ever increasing rate, America would soon go dark. To conserve the remaining whale oil, they recommended extinguishing all lanterns no later than 10 p.m. They were right about running out of whale oil, but they were wrong about America going dark. In 1859, a railroad conductor called Edwin Drake struck oil in Titusville, Pa. America remained brightly lit by lanterns that burned paraffin.

Until the early 18th century, colonial homes were heated mostly by burning wood. Forests were vanishing and the rapidly growing colonies were running out of firewood. Eliminate immigration and ration firewood, was the call of the day. They were right about running out of firewood but it didn't matter because we soon found and began burning a far superior fuel called coal.

During the 1980s, fax machines became popular and people installed additional lines to accommodate these devices. Frightened “experts” like Paul Ehrlich, issued dire warnings about the price of copper. There was insufficient copper in the world to run two phone lines to every home.

They were right about there not being enough copper. They were wrong about its price. The miracle of God-given human ingenuity made copper as redundant as whale oil. We began sending data through impossibly thin glass filaments. Glass is made from sand and we are in no danger of running out of sand.

Lacking sufficient copper, whale oil or wood only seemed to be a problem. In reality, our God-given ingenuity developed exciting new technology that eliminated our need for each commodity just as it was becoming scarce.

Hi! Are you having problems finding right exam gui...

2010-11-01T23:17:07.195-07:00

Hi! Are you having problems finding right exam guide for cisa certification? I was having such problems few days ago. And I consulted with this site because their CISA certification program requires you to complete the Continuing Professional Education (CPE) Policy so that you can maintain a sufficient level of knowledge and expertise in the Information Systems audit, control and security field. This is proved to be really helpful to me. Thanks. . cisa

Yes! I totally agree with you folks. And this site...

2010-10-27T04:15:10.089-07:00

Yes! I totally agree with you folks. And this site also hosts professional seminars and conferences. Participating in non-ISACA activities like university courses, seminars, conferences, in-house corporate training and professional meetings can also count as CPE hours. And completing university courses in relative fields can earn you several CPE hours. This site is definitely helpful thanks. IT audit

Hello world! Do you know that If you successfully ...

2010-10-22T01:48:10.786-07:00

Hello world! Do you know that If you successfully adhere to the CPE policy, you can manage and assess an organization’s information security more effectively. And the information this site made me aware that i need to earn a minimum of twenty (20) CPE hours in a year and of course potential salaries. I can earn it by attending meetings organized by ISACA; an association that sponsors the CISA program. I thank them for this. cisa exam

These are some really good data points to know. As...

2010-09-13T14:02:07.336-07:00

These are some really good data points to know. As a manager, I think I neglect giving enough positive feedback so I am glad I came across this post.

thanks again 'AudMan'

2010-08-30T08:56:17.691-07:00

thanks again 'AudMan'

This made me smile. Well written!

2010-08-13T09:48:41.091-07:00

This made me smile. Well written!

I love it when you talk contrarian. There's m...

2010-08-03T09:15:33.074-07:00

I love it when you talk contrarian.

There's more to the art of info war that InfoSec can learn.

"The art of war, then, is governed by five constant factors, to be taken into account in one's deliberations, when seeking to determine the conditions obtaining in the field.

These are: (1) The Moral Law; (2) Heaven; (3) Earth; (4) The Commander; (5) Method and discipline."

Case in point: HP is releasing 9,000 back-office IT staff, replacing them with 6,000 front-line sales and delivery (i.e. business saavy) staff.

"'We think the next five to 10 years is going to be about who can best use technology to automate the delivery of services,' said Ann Livermore, executive vice president for HP Enterprise Business, during a conference call with analysts."

Kind of reminds me of Star Wars, Episode V. Only w...

2010-03-22T08:35:41.534-07:00

Kind of reminds me of Star Wars, Episode V. Only we don't have the Jedi, cool space ships, rebels, or other planets to go too to learn how to manipulate space-time or clone new tax payers.

Dark days indeed.

Deployment can be a huge factor. Many of the big ...

2010-01-25T13:43:38.485-08:00

Deployment can be a huge factor. Many of the big names in the industry have solutions that can take close to a year to fully deploy. By the time the application has been fully installed, the business's needs may have changed significantly. Meanwhile, our solution can be deployed in a matter of weeks making the BI implementation process much more likely to be successful overall.

Anonymous raises a good point. People, being human...

2009-08-15T22:02:00.194-07:00

Anonymous raises a good point. People, being human, will rationalize. They might even choose to equate legality with morality. The mindset is "if I cannot be identified as a wrongdoer, then I am ethical." This is precisely why organizations must take information security seriously.

I still have many pieces of intellectual property ...

2009-08-14T15:36:36.157-07:00

I still have many pieces of intellectual property from all my past jobs over the past 2 decades. Sometimes I even use it without permission.

Intellectual property is a legal monopoly. It is theft if it can be shown an individual has negatively impacted the monopoly. Until it can be shown that damage has been done to the monopoly, 'intellectual property theft' is just people living, learning, networking and gaining experience.

Hello all, I would also like to give my opinion on...

2008-07-14T04:00:00.000-07:00

Hello all, I would also like to give my opinion on Risk and Compliance.
IT governance, risk and compliance (IT GRC) is about striking an appropriate balance between business reward and risk. The maturity of IT GRC practices for managing reward and risk has a direct impact on the organization. IT GRC encompasses the practices for delivering: Greater business value from IT strategy, investment and alignment, Significantly reduced business and financial risk from the use of IT, and Conformance with policies of the organization and its external legal and regulatory compliance mandates. IT GRC energizes the entire organization to imagine what it can achieve, establishes methods for achieving their objectives, and demonstrates the practices that are proven to work for minimizing business and financial risk. Fundamentally, IT GRC is about striking an appropriate balance between business reward and risk, enabling an organization to more effectively anticipate and manage business risk while more effectively delivering value for the organization. IT governance, risk, compliance, IT GRC, White paper, compliance survey report, 2008 compliance report.
You can also get more information from http://www.compliancehome.com/symantec/

rybolov,

Very humorous sarcasm! That was...

2008-06-19T17:48:00.000-07:00
rybolov,

Very humorous sarcasm! That was sarcasm, right? Seriously, I’m so excited about your ideas that I’m going to link back to you.

Yes, NIST Risk Management Framework closely resembles—and in some cases borrows from—COBIT. It’s less structured and much more comprehensive, given all the Special Publications that comprise it. COBIT attempts to specify what you should do to achieve high-performing IT-driven operations. As I view it, the NIST framework attempts to tell you both what you should do and, in verbose detail, how you should do it.

When your smart friends figure out how to dismantle the barriers to quality and performance management in government, please include me in the celebration. I’ve been working on that problem most of my adult life.

I work in a large State government, so I can empathize with your plight. Sounds like the Fed faces conditions very similar to ours. I’m not sure that I can agree, though, that there are not enough skillfull/clueful people to meet demand. I find that a great many skillful—and clueful—people are chewed up and spit out by institutions that were purposefully designed not to change, evolve, or die. The theory of evolution does not hold true for government. Of course, DC is a very different place from Sacramento. Heck, LA is a very different place from Sacramento. California’s difficulty, I think, is:

1. Our constitution gives broad powers to individual agencies to manage as they see fit.

2. Influencers at the Executive level have two levers to shape the will of agencies: policy, i.e. administrative regulations, and law.

But...

3. Administrative regulation is largely ignored, with no ramifications befalling those in positions to know better.

4. Politics makes law impossible to effect.

A few years ago, the Governor commissioned a task force to find ways to improve operations. The group identified over 200 vectors in the problem space. But in short order, cold hard reality befell the naïve Governor’s best laid plans. Between a Legislature and public employees’ union bent on stonewalling all attempts to mandate change, and the utter inability of the Administration to apply pressure on agencies that had been ordained as kingdoms in the State Constitution, the initiative quietly died with only a handful of its recommendations realized.

Incidentally, I’ve been told that the Canadian government has been successful—you define success—at implementing the COBIT framework. I would sure like to visit Ottawa to see what everyone’s talking about.

Cavalcade of Risk #54 is up, and your post is in i...

2008-06-18T05:51:00.000-07:00
Cavalcade of Risk #54 is up, and your post is in it:

http://www.bargaineering.com/articles/cavalcade-of-risk-54.html

Yes, the government's metrics are broken right now...

2008-06-16T06:54:00.000-07:00
Yes, the government's metrics are broken right now. Some really smart people that I know are working on changing that, but it's slow because the culture of Government is to resist change.

I agree with you that PCI is the road to go down. In fact, I wrote a tongue-in-cheek rebuttal on my blog at FISMA: Better if PCI. WTF?

While COBIT makes some sense, the problem is that government is driven by a different set of laws and standards that the private sector. Looking through your description of COBIT, it's exactly what NIST has created in their Risk Management Framework.

The biggest problem that we have in the Government is one of scale:
1. We do not have information security models above the enterprise level.
2. We do not have enough skillfull/clueful people in the DC area to keep up with the demand.

No matter what the framework you use, you still will get the same results because it's not about the framework, it's about the people.

Have a look at the presentation I put together on security and the Government, I go through some of this.

This is really interesting. Gives us a picture of ...

2008-05-22T08:01:00.000-07:00
This is really interesting. Gives us a picture of the world to come. I had read a little about this. Strangely, it didn't get much press play in the US.

Incidently, Estonia was the first nation to allow Internet voting in a parlimentary election (2007).

ISACA Sacramento Web Log

I totally agree that COBIT is the best answer to t...

@Encrypted Flash Guy So... is Federal management ...

FISMA has allocated precise tasks to the groups Na...

The article doesn't intend to take a philosoph...

Secularists, today’s heirs of Greek philosophy, ob...

Hi! Are you having problems finding right exam gui...

Yes! I totally agree with you folks. And this site...

Hello world! Do you know that If you successfully ...

These are some really good data points to know. As...

thanks again 'AudMan'

This made me smile. Well written!

I love it when you talk contrarian. There's m...

Kind of reminds me of Star Wars, Episode V. Only w...

Deployment can be a huge factor. Many of the big ...

Anonymous raises a good point. People, being human...

I still have many pieces of intellectual property ...

Hello all, I would also like to give my opinion on...

rybolov,Very humorous sarcasm! That was...

Cavalcade of Risk #54 is up, and your post is in i...

Yes, the government's metrics are broken right now...

This is really interesting. Gives us a picture of ...

rybolov,

Very humorous sarcasm! That was...