Table Of ContentAchieving and
Sustaining Secured
Business Operations
An Executive’s Guide to Planning and
Management
—
Neelesh Ajmani
Dinesh Kumar
Achieving and
Sustaining Secured
Business Operations
An Executive’s Guide to
Planning and Management
Neelesh Ajmani
Dinesh Kumar
Achieving and Sustaining Secured Business Operations: An Executive’s
Guide to Planning and Management
Neelesh Ajmani Dinesh Kumar
Hopkinton, Massachusetts, USA Chadds Ford, Pennsylvania, USA
ISBN-13 (pbk): 978-1-4842-3098-5 ISBN-13 (electronic): 978-1-4842-3099-2
https://doi.org/10.1007/978-1-4842-3099-2
Library of Congress Control Number: 2017961550
Copyright © 2017 by Neelesh Ajmani and Dinesh Kumar
This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or
part of the material is concerned, specifically the rights of translation, reprinting, reuse of
illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way,
and transmission or information storage and retrieval, electronic adaptation, computer software,
or by similar or dissimilar methodology now known or hereafter developed.
Trademarked names, logos, and images may appear in this book. Rather than use a trademark
symbol with every occurrence of a trademarked name, logo, or image we use the names, logos,
and images only in an editorial fashion and to the benefit of the trademark owner, with no
intention of infringement of the trademark.
The use in this publication of trade names, trademarks, service marks, and similar terms, even if
they are not identified as such, is not to be taken as an expression of opinion as to whether or not
they are subject to proprietary rights.
While the advice and information in this book are believed to be true and accurate at the date of
publication, neither the authors nor the editors nor the publisher can accept any legal
responsibility for any errors or omissions that may be made. The publisher makes no warranty,
express or implied, with respect to the material contained herein.
Cover image designed by Freepik
Managing Director: Welmoed Spahr
Editorial Director: Todd Green
Acquisitions Editor: Susan McDermott
Development Editor: Laura Berendson
Technical Reviewer: Rajesh Sukumaran
Coordinating Editor: Rita Fernando
Copy Editor: Karen Jameson
Distributed to the book trade worldwide by Springer Science+Business Media New York,
233 Spring Street, 6th Floor, New York, NY 10013. Phone 1-800-SPRINGER, fax (201) 348-4505,
e-mail [email protected], or visit www.springeronline.com. Apress Media, LLC is a
California LLC and the sole member (owner) is Springer Science + Business Media Finance Inc
(SSBM Finance Inc). SSBM Finance Inc is a Delaware corporation.
For information on translations, please e-mail [email protected], or visit http://www.apress.
com/rights-permissions.
Apress titles may be purchased in bulk for academic, corporate, or promotional use. eBook
versions and licenses are also available for most titles. For more information, reference our Print
and eBook Bulk Sales web page at http://www.apress.com/bulk-sales.
Any source code or other supplementary material referenced by the author in this book is
available to readers on GitHub via the book’s product page, located at www.apress.
com/9781484230985. For more detailed information, please visit http://www.apress.com/
source-code.
Printed on acid-free paper
Table of Contents
About the Authors �������������������������������������������������������������������������������vii
About the Technical Reviewer �������������������������������������������������������������ix
Acknowledgments �������������������������������������������������������������������������������xi
Introduction ���������������������������������������������������������������������������������������xiii
Chapter 1: Current Practices ����������������������������������������������������������������1
Information Security, a Growth Industry?1
State of the Business 2
State of the Security Practices3
Anything Wrong with the Current State? 5
Transforming Fear Into Confidence and Advantage 7
Chapter 2: Next Practices: Business-Centric Security and Risk
Management �����������������������������������������������������������������������������������������9
Business State 9
Security as a Competitive Differentiation 11
Secured Business Operations, an Organizational Capability 13
Achieving and Sustaining Secured Business Operations 18
Manufacturing Organization (B2B Engagement Model) 27
Health Care Organization (Digital Business) 30
Achieving and Sustaining Secured Business Operations in Your Organization 32
iii
TTaabbllee ooff CCoonnTTeennTTss
Chapter 3: Secured Business Model ���������������������������������������������������35
Achieving and Sustaining Secured Business Operations Starts with Business 35
Secured Business Model and Five Ps 36
Secured Business Model Capability Maturity Levels as a Value Road Map 45
Secured Business Model Is a Bridge Between Business Engagement
and Operating Model 47
Chapter 4: Secured Operating Model ��������������������������������������������������49
Realizing Secured Business Operations49
Components of Secured Operating Model 51
Business Management54
Operations Management 56
Risk Management 58
Compliance Controls 60
Master Data Management61
Data Definition 62
Data Integrity 63
Data Security 63
Data Services 64
Data Architecture 64
Infrastructure Management 66
Practices for Secured Operating Model 68
Business Management: Change Management 69
Business Management: Governance 70
Business Management: KPI Measurements 72
Operations Management: Process Management 74
Operations Management: Access Control Management 75
Operations Management: Audit and Monitoring 77
Risk Management: Threat Management 78
iv
TTaabbllee ooff CCoonnTTeennTTss
Risk Management: Vulnerability Management 79
Risk Management: Exception Management 79
Compliance Controls: Data Security 80
Compliance Controls: Segregation of Duties 80
Master Data Management: Identity Management 81
Master Data Management: Asset Management 82
Master Data Management: Role Management 82
Master Data Management: Policy Management 83
Master Data Management: Dependency Management84
Master Data Management: Glossary Management 86
Master Data Management: Life-Cycle Management 87
Infrastructure Management: Network Management 88
Infrastructure Management: Data Center Management 89
Infrastructure Management: Application Management 90
Using Secured Operating Model 91
Chapter 5: Secured Management Model���������������������������������������������93
Sustaining Secured Business Operations 93
Components of Secured Management Model 95
ASSESS 96
PLAN 96
IMPROVE 96
MANAGE 97
Key Management Practices 100
Assess Process Domain Practices 100
Plan Process Domain Practices 104
Improve Process Domain Practices 113
Manage Process Domain Practices 116
Conclusion 121
v
TTaabbllee ooff CCoonnTTeennTTss
Chapter 6: Security Effectiveness �����������������������������������������������������123
Current State of Measures 123
Effectiveness Defined 125
What Is An Organization Trying to Achieve? 126
What Is An Acceptable Cost for the Organization? 127
What Is Effective? 128
Why Are Security Efforts Perceived as Not Effective or Too Expensive? 129
Principles of Security Effectiveness 131
Becoming Effective with Value Flow Map 134
Doing Right with Business Mindset 137
Measuring Change and Outcomes 139
Key Measures for Security Effectiveness 139
Measure to Manage 141
Chapter 7: Making It Real �����������������������������������������������������������������143
What Have We Learned? 143
What Has Been Done?150
Technology Manufacturing Company Open for Business 152
Leading Health-Care Provider Expanding Globally 153
A Service Provider Merging with Another Service Provider 154
A Hospital Network Optimizing Cost and Maximizing Care 155
What Can You Do? 156
Approach for Adopting and Operationalizing the Framework 157
Index �������������������������������������������������������������������������������������������������159
vi
About the Authors
Neelesh Ajmani has over 28 years of
experience in solving critical business issues
in public and private sectors with expertise
in digital transformation, risk management,
secured business operations, strategic
planning, organizational design, agile program
management, enterprise architecture and
information management. Neelesh is a
Program Management Specialist Advisor in
the Health Care and Life Sciences Industry
practice of NTT Data Services. In affiliation
with Mitovia, Inc., as Chief Services Officer, he is advising and developing
the body of knowledge and services offerings for achieving and sustaining
secured business operations. In the past, Neelesh worked at Cisco for 15
years in advisory, delivery, and leadership roles, specializing in Internet
Commerce, Identity and Access Management, and Manufacturing
solutions. Neelesh has delivered business solutions with the state-of-
the art technology solutions for many Fortune 500 organizations in
Manufacturing, Banking industries, Supreme Court of India, and federal
government of India. He has an MBA from San Jose State University, and
an MS in Computer Applications from Jawaharlal Nehru University, India.
Neelesh is certified in Advanced Program Management from Stanford
University, PMP, TOGAF Enterprise Architecture, and is an ITIL V3 Expert.
Connect with Neelesh at linkedin.com/in/neeleshajmani or at
[email protected]
vii
aabboouuTT TThhee aauuTThhoorrss
Dinesh Kumar is Cofounder and CTO at
Mitovia, has over 30 years of experience
in technology business management,
strategic planning, value measurement and
communication, capability assessment and
planning, and governance. At Mitovia he
is driving business-minded, knowledge-
driven practices and solutions for planning
and managing organizational capabilities,
including digital, security, competency, and
shared services management. Dinesh has filed a patent on capability-
driven, service- oriented planning. He is also an adjunct professor
at Stevens Institute of Technology, teaching technology business
management and process innovation courses to MBA and MSIS students.
Dinesh is a board member and principal at the Innovation Value Institute,
where he is developing and driving capability models and practices for
managing IT for business value. He is a founding member and major
contributor at The Value Council, a nonprofit organization focused on
improving value management practices. Previously Dinesh has held a
broad variety of sales, consulting, and management roles at Microsoft,
Informix, and Unisys. He has an MBA degree from Penn State University
and an MS in Computer Science from Rutgers University.
Connect with Dinesh at linkedin.com/in/dineshku or
[email protected]
viii
About the Technical Reviewer
Rajesh Sukumaran has over 19 years of
experience in various technology domains
with proven technical leadership and
management skills. Rajesh has been working
as a security professional for over a decade in
designing, architecting, and deploying Identity
and Access Management solutions, Security
Risk analysis, Compliance and Auditing
technologies, Single Sign on, Federated Identity, Enterprise System
Architecture, Authentication and Authorization technologies, Strategy and
Governance, and custom-built security frameworks. Rajesh is a Certified
Information Systems Security Professional (CISSP) and he is currently
working as a Security Systems Specialist Advisor at NTT Data Services. He
leads the Security Services division focusing on IAM architecture, leading
enterprise security and drive profitable growth and innovative thinking.
In the past, he has played many roles as security architect, technical
manager, database administrator, and data warehouse specialist. Rajesh
has a Masters in computer applications from University of Kerala, India.
He is currently focused on Risk-based Identity Intelligence, IoT (Internet of
Things) security and cloud security solutions.
Connect with Rajesh at https://www.linkedin.com/in/rajesh-
sukumaran-cissp-43a6236/ or [email protected]
ix
