Bridging the gap between organizations policies and the network security and systems administration in SMEs
Conference Paper
Overview
Research
Additional Document Info
View All
Overview
abstract
The administration of systems and networks is a technical specialized complex task. If large organizations can have in their Information Technology (IT) departments systems and network security specialists, Small and Medium Enterprises (SMEs) typically can’t; they have only some
computers science broadband IT collaborators that respond by the maintenance of the IT resources, and, in some cases, accumulate with some software development. We make of this view the start point of our research, allying the growing need of securing the IT resources and the information sources which are becoming more and more valuable for every single organization.
For SMEs the solution for implement security is, many times, an outsourcing task. The problem is that implementing security is an exercise that overflows the common IT domain, but it starts by fully understanding the organization culture, policies and procedures. This knowledge is something that
collaborators learn day by day and not something that we can put on paper easily and tell some outsourced specialists to secure. Even if that could be done, the daily maintenance of the security would be a very hard task.
This paper makes considerations about security on SMEs reality and presents a framework that permit a high level approach for implement security, more focused on the organization vision of what we want to do than on a technical vision of how to implement it. The framework hard core is one
abstraction layer focused on the organizations perspective and a translator layer of them into technical rules capable of been applied on the IT resources, like servers, computers and network equipments.
