ORGANIZATION OF THE FUNCTION — Start by identifying what real-life information security practitioners actually do. What are the key security responsibilities of an information security professional? Take a look at the function from the point of view of other organizational departments, and understand how other groups' perceptions of the security function affect your ability to get the job done. Learn the pros and cons of placing the security function at various organizational levels, and how organizational placement can increase — or hinder — effectiveness.

REQUIRED SKILLS — Learn which skills are most necessary and valuable for a practitioner in this field and how you can develop them. Identify sources of information to help build those skills, and evaluate the long-range career opportunities. Learn why this position emphasizes managerial, rather than technical skills, and how effectively written communication can make or break the security program. We'll also cover specialized terminology you should know for systems and network security, contingency planning and encryption.

STAFFING THE FUNCTION — One of your major challenges is finding qualified, motivated people. We'll analyze the advantages and disadvantages of different backgrounds for the IS security job and cite some successes and failures in bringing people into this discipline. Investigate what security tasks can reasonably be outsourced for your organization.

RESPONSIBILITIES — Compare the steps that different organizations have taken in building their security programs. Learn which steps from which methods would work for you. Find out why appropriate, well-crafted policies, standards and procedures build the foundation for an entire security program and why security awareness is such a vital element. Learn the components of a risk analysis and the difference between a qualitative and a quantitative risk assessment. Identify the three components of computer viruses; how they work and what you can do to protect your organization. Determine whether the information classification scheme in use at your shop is realistic, and discuss the renewed emphasis on physical security. Examine the three phases of activity for a business continuity plan and learn effective ways of building and testing a plan including critical parts of the client/server environment.

MANAGING SECURITY — Learn strategies for managing data security successfully, how to obtain support and commitment from all levels of the organization. Select strategies for goal setting and determining priorities that will support the mission of your organization. Investigate ways to measure your progress, pitfalls associated with the information systems security function and how to avoid them; and keys to the effectiveness of your program and your performance as a security professional.