建立一個(gè)安全有效的風(fēng)險(xiǎn)模型進(jìn)行外包決策【外文翻譯】

1、本科畢業(yè)論文（設(shè)計(jì)）外文翻譯原文：原文：CreatinganeffectivesecurityriskmodelfoutsourcingdecisionsBThassubstantialexperienceofoutsourcingoffshingparticularlytoIndiancompaniessupplierengagementprocessesarewellestablished.BToutsourcesinfmation

2、communicationstechnologies(ICT)wktoacombinationofstrategictacticalsuppliers.Acommoncontractualframewkhasbeenimplementedfstrategicpartnerssince2003thisincludesacomprehensivesetofbaselinesecurityrequirementsthatcanbeenhanc

3、edtoappropriatelevelsdependingonthenatureoftheinfmationassetsconcerned.BThasredefinedoffsheoutsourcingfrombeingatacticalmeansofreducingoperationalcostsintoastrategictoolfbusinesstransfmation.Thishasresultedinasignificant

4、increaseintheoutsourcingoffshingofICTdevelopmentmaintenancesupptcontactcentreactivities.Atthesametimecustomersstakeholdersarebecomingawareoftheirincreasingrelianceonelectronicinfmationtherisksposedbynotjustmaliciousactsb

5、utalsoaccidentalexposure.Outsourcingoffshingpresentsamecomplexpicturefconductingsecurityriskassessmentstheoutcomesmayhaveamajimpactonoperationalbusinessdecisions.BThasthereferevieweditsapproachestosecurityriskmanagementt

6、oensurethatoutsourcingassessmentsarebuiltintothenewdynamicenvironmentinwhichICTprogrammesexist.Thispaperdetailstheevolutionofprocessestomeetthesenewneeds.Specificmodelstoolstechniqueshavebeendevelopedtoensurethateffectiv

7、etimelyengagementwithstakeholdersoccursthatrisksrequirementsareidentifiedcommunicatedthatriskmitigationmanagementstrategiesareimplementedwithinappropriatecompliancegovernanceframewks.TheapproachusedbyBTisbasedonHMG’sInfo

8、secStardNo1:ResidualRiskAssessmentMethod(IS1).operationalsupptitispossiblethatanumberofthirdpartieswillbeprovidingservicesfthesameICTproduct.Thenatureofthecontractwillusuallydeterminethetypeofaccessprofilesthatthirdparty

9、personnelwillhavetoBTcustomerinfmatione.g.powerful‘root’accessfsupptfunctionsversus‘stard’useraccessfhelpdeskactivity.Inallcasesitisrecommendedthatinfmationsecurityrequirementsaredecomposedintothespecificsubjectsof‘confi

10、dentiality’‘integrity’‘a(chǎn)vailability’toconsiderthesefromthesystemlifecyclestagescoveredbytheoutsourcecontract(e.g.‘requirementscapture’‘design’‘development’‘test’‘operate’‘shutdown’).Thiswillcreatethegranularityneededtoid

11、entifyspecificlevelsofsecurityfdifferentlifecyclestagescontractse.g.applicationdevelopmentusing‘dummy’datamayrequirelowerlevelsofsecuritythanoperationalstagesaccessing‘live’customerdata.Itisalsoimptanttoaddresssecurityth

12、roughoutthecontractlifecycleaswelli.e.throughtocontracttermination—theUKnationalinfrastructuresecuritycodinationcentre(NISCC)hasissuedguidelinestofacilitatethis.Oneoffsecurityassessmentsareinsufficientplannedlifecyclecon

13、tractchangesovertimeprovideaneffectivetriggerfriskmanagementreassessmentsi.e.ontopoftraditionaltriggersfrevisionsuchasmajcomponentchangesannualreview.Manyfactsmusttherefebeassessedtoidentifysecurityriskssubsequentsecurit

14、yrequirementsmitigationoptionsfexample:?internationalstardssuchasISOIEC27001BS7799Part2:2005BS7858?BT’scpatesecuritypolicyprivacymarkings?regulationlegalrequirementse.g.UKDataProtectionActUKTelecomsStrategicReviewThesarb