CISO AppSec Guide: People and Organisation - Revision history

Tgondrom: /* V-2 Organisation */

2016-08-18T21:29:08Z

‎V-2 Organisation

Tgondrom: /* V-2 Organisation */

2016-08-18T21:28:17Z

‎V-2 Organisation

Tgondrom at 21:19, 18 August 2016

2016-08-18T21:19:48Z

Tgondrom at 21:12, 18 August 2016

2016-08-18T21:12:15Z

Tgondrom: adding chapter V: people and organisation

2016-08-18T20:43:19Z

adding chapter V: people and organisation

New page

[[Application Security Guide For CISOs|< Back to the Application Security Guide For CISOs]]
__NOTOC__
= Part V: People and Organisation =

== V-1 Executive Summary ==
After setting up the program, strategy, risk management and policies, let's turn to the people and the organisational structures that can support and enhance the Application Security Strategies.

== V-2 Organisation ==

== V-3 People and Education ==

[[File:VA_Metrics.jpg]]

[[ File:Issue_SDLC_metrics.jpg]]

[[Category:OWASP_Application_Security_Guide_For_CISO_Project]]

@@ Line 26: / Line 26: @@
 * Customer Value
 * Avoid conflicts of interest
 == V-3 People and Education ==

← Older revision		Revision as of 21:28, 18 August 2016
Line 10:		Line 10:
	== V-2 Organisation ==		== V-2 Organisation ==

		+	=== Organisation Structures Variance ===
		+
		+	In order to analyse what would be good and effective organisation structures, it is useful to analyse the different dimensions of various best practices and their success criteria, strengths and weaknesses.
		+	Organisation Structures can vary greatly from one organisation to the other. And further reviews did show that even if functions my carry the same name, they may still not actually carry the same responsibilities, capabilities or capacites.
		+
		+	Such criteria for organisational structures can be based on
		+	* historical reasons (e.g which department first started to care about Security or simple political calculations).
		+	* company culture (what organisational structure fits best with the company culture)
		+	* individual leader’s abilities and preferences (often if some department leader has a background in one specific area, that may be randomly added into the security functions and equally if the leader is sceptical about some areas, he may decide to leave such functions separately...
		+
		+	=== Frameworks: Organization Design Principles ===
		+
		+	Synergies
		+	* Maximise synergies with related functions
		+	* Customer Value
		+	* Avoid conflicts of interest

	== V-3 People and Education ==		== V-3 People and Education ==

@@ Line 6: / Line 6: @@
 After setting up the program, strategy, risk management and policies, let's turn to the people and the organisational structures that can support and enhance the Application Security Strategies.
-[[File:CISO-Guide-PPT-org.png]]
+[[File:CISO-Guide-PPT-orga.jpg]]
 == V-2 Organisation ==