IT Security Management and Business Process Automation: Challenges, Approaches, and Rewards

Abstract

A favorite idiom among security experts is, “Security isn’t a product, it’s a process.” If security is a process, then why not automate it? Today’s workflow and business process management (BPM) technologies are mature enough to support the automation of essential tasks that underlie risk compliance and assessment, vulnerability testing and management, patching, incident management and response, and other information technology security processes. More important, an enterprise platform for IT security process automation enables cybersecurity specialists to centrally orchestrate the interactions of personnel, their work, and various point products for information security—cutting across departments and functional areas to ensure a resilient, flexible security posture. The results: faster deployment and stronger enforcement of security policies; the ability to achieve sustained compliance with industry and government mandates for information security; comprehensive, error-free documentation of security procedures and policies; and more cost-effective attainment of the enterprise’s security goals. This article will review some of the basic issues that relate to information security process automation, including turning security policies into security requirements; challenges in enforcing security requirements; what’s involved in automating information security and compliance processes; and how a security process automation platform supports that effort.