Previous

Page - 2

Similarly, with sectors like banking and insurance which are highly sensitive to information security and other risks, molding one's business to incorporate secure best practices is imperative. This will ensure the customer's confidence in
competence and the products or services offered.

The financial sector too forms one of the most critical sectors of the economy, and it is also the most vulnerable to security breaches. Now-a-days, with all transactions being made electronically, technology, the great enabler, has also made it easy to subvert the system for illegal and unethical practices. Risk mitigation and avoidance, therefore, must be included in the operational processes to ward of any mishap.

Similarly, with the hospitality industry, which needs to maintain high levels of customer security and privacy, establishing an aware and alert workforce and a competitive system to manage security remains a challenge.

The prevailing approach used by most organizations today is to build new solutions and adopt operational practices based on functional requirements, security invariably comes afterwards. Unfortunately, security cannot be separated from the product or operational process, if customers want to minimize potentially painful trade-offs among functionality, cost, schedule, and security. This flawed "build then evaluate" approach has lead to a perception that a secure solution is not a functional solution. Therefore, the requirement of a formal framework which would help integrate secure best practices into the operational processes of the organization.

The SSE-CMM Armour

Both customers and suppliers are interested in improving the development of security products, systems, and services. The SSE-CMM provides a way to measure and improve performance in the application of security engineering principles to product development and operational practices.

What is SSE-CMM?

SSE-CMM stands for System Security Engineering Capability Maturity Model and it is a process reference model for the security engineering processes.

"SSE process is the process of discovering stakeholders', customers' and users' information protection needs and then designing and making information systems, with economy and elegance, so that they can safely resist the forces to which they may be subjected." - IATF 3.1

Next

Subhashini Acharya,
Bachelor of Engineering in Computer Science from Utkal University,
Post Graduate Diploma in Management from XIM, Bhubaneswar (Batch 2006-08),
Currently, employed with TATA Corporate HR as a part of their HRDP Program.