The more critical need of initiating and maintaining the SDLC Security as defined requires organization-wide change management, one of the most daunting aspects of getting any company-wide initiative to become part of the ongoing workflows of any organization (Beer, Nohria, 2000). The definition of security baselines (Huang, Lee, Kao, 2006) which arguably is more concerned with analytics than changing how people do their work, is often used within organizations as a barometer of how effective the security strategies are in attaining Guideline-based measures of security performance. In evaluating Guidelines such as these it is imperative to take a systemic view and evaluate their contents, procedures and processes in isolate, yet as part of a larger framework which can be measured and improved on over time through the use of continuous monitoring.
References
Michael Beer, Nitin Nohria. (2000). Cracking the code of change. Harvard Business Review, 78(3), 133-141. Retrieved July 8, 2008, from ABI/INFORM Global database. (Document ID: 53446328).
Burkhardt, Marlene E. (1985, July). Applying a System Development Cycle to Information Security. Security Management, 29(7), 32. Retrieved July 12, 2008, from ABI/INFORM Global database. (Document ID: 1309834).
Shuchih Ernest Chang, Chin-Shien Lin. (2007). Exploring organizational culture for information security management. Industrial Management + Data Systems, 107(3), 438-458. Retrieved July 13, 2008, from ABI/INFORM Global database. (Document ID: 1230562271).
John D. Chenoweth (2005). Information Security Policies, Procedures, and Standards: Guidelines for Effective Information Security Management:[1]....
Review of medium_being_reviewed title_of_work_reviewed_in_italics. Journal of Information Privacy & Security, 1(1), 43-44. Retrieved July 8, 2008, from ABI/INFORM Global database. (Document ID: 940833161).
Da Veiga, JHP Eloff. (2007). An Information Security Governance Framework. Information Systems Management, 24(4), 361-372. Retrieved July 14, 2008, from ABI/INFORM Global database. (Document ID: 1395622361).
Ken Doughty (2003). Implementing enterprise security: A case study. Computers & Security, 22(2), 99-114. Retrieved July 1, 2008, from ABI/INFORM Global database. (Document ID: 311054421).
Kwo-Shing Hong, Yen-Ping Chi, Louis R. Chao, Jih-Hsing Tang. (2003). An integrated system theory of information security management. Information Management & Computer Security, 11(5), 243-248. Retrieved July 6, 2008, from ABI/INFORM Global database. (Document ID: 520407451).
Shi-Ming Huang, Chia-Ling Lee, Ai-Chin Kao. (2006). Balancing performance measures for information security management: A balanced scorecard framework. Industrial Management + Data Systems, 106(1/2), 242-255. Retrieved July 9, 2008, from ABI/INFORM Global database. (Document ID: 1018763631).
Kenneth J. Knapp, Thomas E. Marshall, R Kelly Rainer, F Nelson Ford. (2006). Information security: management's effect on culture and policy. Information Management & Computer Security, 14(1), 24-36. Retrieved July 12, 2008, from ABI/INFORM Global database. (Document ID: 1016440851).
Shaun Posthumus, Rossouw von Solms. (2004). A framework for the governance of information security. Computers & Security, 23(8), 638-646. Retrieved July…
