Security

Ask something
Discussion Locked

Security Manager

0 helpful
6 replies

by r.nair

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Hi, I have recently been appointed as a Security Manager to a call center.

I want to drive security into this system. I want to incorporate security in every aspect be it business or technology or projects.Even in the vision and business focus ofthe company I want security to play a major role.
Can someone suggest me in what ways can I do this,keeping in mind that it needs to be done from a call centers perspective.
PLs help me broden my view and give suggestions on this.

Thank you,

6 replies

by james r linn

If its a recently established operation, you may be in a good position to drive change.

If it is a long operating group, you may have to start slower.

Don't forget the human element - there is no point in making technology secure if your staffdon't care.

Start with driving security awareness - let everyone know how and why security is important. Have speakers in, show videos, get the message across.

And get yourself involved in the processes, especially the project processes. As a security manager you should be a stakeholder on many if not most technology projects - make sure you contribute, but the important thing is to show that you are reasonable, rational and pragmatic. You can't ever make everything totally secure - so you have to pick your battles. If you begin your term coming across as a hard case, paranoid and over dramatic, then you will have a hard time selling your cause.

My experience with call centres is that alot of information is shared because of the environment - open concept groups working together over low or no walls, people sharing passwords etc.

Don't think at first about big wins unless they are easy. Think instead about a course of gradual but continual improvement on security.

Goodluck.

James

by admin

I really liked your reply here :)

I was also struck by one of your ideas: "Start with driving security awareness - let everyone know how and why security is important. Have speakers in, show videos, get the message across." which also helps me currently in my career.

I have not sought after these kinds of resources yet, but they would be very helpful to me. I do have a very limited budget ( US 120$ a year ) that could be used for this currently and was wondering if you were willing or ina position where you could share if there are any resources that may be free or close to it. I have never had a vendor come forward and ask to do this, but they are the first people I thought of. The training facilities I have worked with are out ofour price range. Any thoughts will be appreciated!

~Thanks :>

by james r linn

We are a government agency, and our appropriate federal agencies have videos and provide speakers free of charge. Vendors might as well but they have an agenda.

I would think some federal agencies might do the same for private companies too as a public relations gesture.

Most corporate videos tend to be pricey, but it can't hurt to look into renting one.

We have about 1500 people per site at 2 main sites and we had vendors in for awareness days - Compaq showed their keyboards with fingerprint readers, our PKI vendor came in, etc. We showed videos, gave presentations on Internet monitoring, passwords, social engineering, all kinds of topics. Many vendors donated small prozes which increased the attendance.

I wouldn't take people offsite - we gave big presentations during lunch hours in the cafeteria - well attended :).

Hope that helps.

James

by madmark

Advice is free, and here comes your money's worth... Create an action plan. Jumping right into the security conundrum without a clear picture the end result could be a big CLM. A well thought out approach could save your job. Security is the gaining of control at the cost of convenience.

Start out with a big picture "vision" of what a secure environment should look and feel like. Want to lock down every icon on the desktop, log all traffic, or do you just want to ensure that passwords are not shared, and users are aware of social engineering?

Next, talk to Supervisors and Managers about their business needs, and consider the impact that your vision would have on them.

Research ways to overcome issues and concerns. There isa product for just about everything these days, and plenty of consultants out there that can do the grunt-work and provide the expertise. Budget for it.

VERY IMPORTANT: Gain management support for anything that you do regarding security. If the big-boys aren't going to bother, then these are just 'good ideas'. Have management turn your ideas into policy.

Implement an approved step-by-step plan according to the policies and procedures that you have helped build along the way.

Once again, the concepts and outcomes should be clearly defined, like in any project. Make SMART Objectives with clear deliverables. Failing to plan is planning to fail.

As for security awareness, Tech Republic is a great source of info. Also, engageconsultants to do some presentations. Most will do this to establish a relationship with you. ISC2's website has a contact page that lists CISSP's and SSCP's that may deliver a security awareness presentation for the experience, or a nominal fee.(I know, I'm listed, and looking for work!)

by r.nair

thanks for the suggestions. I guess my most imp. work as a Security Manager would be to know my management and the resources available with them. Cause Security must necessarily have the management's support to push it down through the organization.

by alon

We are secuirty specialists, call us and we can help you prepare the stratergy you need as well as implement this stratergy.

Contact me on: alon@moozatech.com www.moozatech.com

This discussion is closed to new replies.