資安管理十誡 - The 10 deadly sins of information security management

近日查閱資安管理（information security management）資料，不時看到 Ten Deadly Sin 字眼出現，今晨看過往Business Management 雜誌對現在公司所在領域的幾個原廠總字輩大佬的專訪，又看到文末列出這十宗罪（十宗罪好像是大陸習慣用法？）。

透過谷歌，很快就查到，原來這十誡典出學者 B. von Solms and R. von Solms 於 2004年7月發表在 Computer & Security 的文章。此十誡言簡意賅，強調資安管理不是技術部門獨有的責任，旨哉斯言，爰執鍵（盤）為之記。

1. Not realizing that information security is a corporate governance responsibility (the buck stops right at the top)
2.  Not realizing that information security is a business issue and not a technical issue
3. Not realizing the fact that information security governance is a multi-dimensional discipline (information security governance is a complex issue, and there is no silver bullet or single ‘off the shelf’ solution)
4. Not realizing that an information security plan must be based on identified risks
5. Not realizing (and leveraging) the important role of international best practices for information security management
6. Not realizing that a corporate information security policy is absolutely essential
7. Not realizing that information security compliance enforcement and monitoring is absolutely essential
8. Not realizing that a proper information security governance structure (organization) is absolutely essential
9. Not realizing the core importance of information security awareness amongst users
10. Not empowering information security managers with the infrastructure, tools and supporting mechanisms to properly perform their responsibilities

[書目資訊]

B. von Solms and R. von Solms, "The 10 deadly sins of information security management," Computers & Security, vol. 23, no. 5, pp. 371-376, Jul. 2004. [Online]. Available: http://dx.doi.org/10.1016/j.cose.2004.05.002