Proceedings

Of special interest are the various threats and vulnerabilities in information
technology, as these present a unique aspect of the sector, while the rest are applicable
to other domains as well.
Table 1. Key aspects and focus which define IT management and monitoring
proposals
Aspect Focus
Security
Management
(enterprise-wide)
Critical Business
Applications
Computer
Installations
Security management
at enterpise level.
A business
application that is
critical to the success
of the enterprise
A computer
installation that
supports one or more
business applications
Networks A network that
supports one or more
business applications
Issues
Probed
The commitment provided by
top management to promoting
good information security
practices across the enterprise,
along with the allocation of
appropriate resources. The
aspect in question deals with
vulnerabilites caused by
inadequate security policies
adopted by security
management, as well as their
ability to expose and encounter
threats.
The security requirements of
the application and the
arrangements made for
identifying risks and keeping
them within acceptable levels.
Typical vulnerabilities for this
level include holes left by
programmers in the source
code of the applications in
question and bugs, and threats
come from inconsistencies
between data collection and the
application, as well as
unauthorised copying of the
source code by competitors and
illegal users.
How requirements for
computer services are
identified, and how the
computers are set up and run in
order to meet those
requirements. Typical
vulnerabilities for computer
services include storage
devices and hardware
frameworks that can be stolen
or damaged.
How requirements for network
services are identified; and how
the networks are set up and run
~ 450 ~
How they affect the perspectives
set in BSC
User perspective: through the
enterprise’s policy towards user
requests relevant to its systems
Internal process: perspective
through the effectiveness of its
quality control policies and its
quality manual developed with the
help of the internal audit.
Financial perspective: through
costs linked with a decision made
to mentain a decent level of
security for the enterprise’s
systems.
Learning and innovation: through
policies which encourage the
development of a securityconscious
culture, regarding data
handling that promotes individual
actions
User perspective: through
applications which are able to
identify and block requests from
unauthorised users
Internal process perspective:
through procedures and functions
which allow the rapid compiling of
update packages
Financial perspective: through
financial-accounting applications
that don’t distort user inputs
Learning and innovation: through
interactive simulation technologies
as well as evolving programming
enviroments.
User perspective: through
satisfaction pertaining to the
technology used by the enterprise
Internal process perspective:
through the wear and depreciation
of the computer installations and
their compatability with various
equipments
Financial perspective: through their
amortisation rate during operations
Learning and innovation: through
technologies’ adaptive potential.
User perspective: by the
connection speed recorded while
servicing their needs.