Security, managing

Management and Employee Cooperation. Before beginning to collect data, the cooperation of the managers involved, including the first line supervisor, and of the workers should be secured. Management needs to be informed so that they can be confident that surveillance activities will not upset production or lead to injuries. Workers need to know what the valuation means to them and how the results are to be reported. Everyone needs to know how the measurement is to be conducted so that the actual measurement causes as Htde dismption as possible. 

However, security management cannot be confined to prevention and protection alone. A preliminary analysis, with a view to determining the nature eind level of risk is a prime requirement. 

Process security and process safety have many parallels and use many common programs and systems for achieving their ends. Process security management requires a systems approach to develop a comprehensive security program, which shares many common elements with process safety management. 

Security Vulnerability Assessment A security vulnerability assessment is intended to identify security vulnerabilities from a wide range of threats ranging from vandalism to terrorism. With the recognition of threats, consequences, and vulnerabilities, the risk of security events can be evaluated, and a security management system can be organized that will effectively mitigate those risks. 

TABLE 23-33 American Chemistry Council s Responsible Care Security Code Process Security Management System ... 

Chemical plant security managers were very pessimistic about their ability to deter sabotage by employees, yet none of them had implemented simple background checks for key employees such as chemical process operators. 

In the discussion above, conditions described referred to perfect world conditions—that is, to those conditions that we would want (i.e., the security manager s proverbial wish list) to be incorporated into the design and installation of new chemical industry infrastructure. Post-9/11, in a not-so-perfect world, however, many of the peripheral (fence line) measures described above are more difficult to incorporate into chemical industry site infrastructure. This is not to say that industrial chemical facilities do not have fence lines or fences most of them do. These fences are designed to keep vandals, thieves, and trespassers out. The problem is that many of these facilities were constructed several years ago, before urban encroachment literally encircled the sites—allowing, at present, little room for security stand-backs or setbacks to be incorporated into plants or critical equipment locations. Based on personal observation, many of these fences face busy city streets or closely abut structures outside the fence line. The point is that when one sits down to plan a security upgrade, these factors must be taken into account. 

An active and effective security program should address protection of public health, public safety (including infrastructure), and public confidence. Chemical facilities should create an awareness of security and an understanding of the rationale for their overall security management approach in the communities they reside in and/or serve. 

Multi-Plant Safety and Security Management in the Chemical and Process Industries... 

Security management process (all listed implementation features must be present) Creating, administering, and overseeing procedures to ensure the prevention, detection, containment, and correction of security breaches. Risk analysis Risk management Sanction policy Security policy... 

Information Technology) security development and evaluation according to Common Criteria (ISO/IEC 15408) family of standards. The main goal of developing the tool is to make these activities easier. The tool is based on the enhanced concept of generics, advanced functionality, compliant to ISO/IEC DTR 15446 and the recent information security management standards, and on the risk analysis as well. 

The features improving compatibility with information security management standards were implied basing on experiences in software development compliant to BS-7799-2 standard (SecFrame [24]). 

OESM - deals with security management—all non-IT aspects,... 

Improved Compliance with Information Security Management Systems and Other Useful Features... 

The following tool features can be useful to deploy more easily the certified against CC security-related products, by the organization compliant to information security management standards, like ISO/IEC 17799, BS-7799-2, ISO/IEC 13335 ... 

Krueger B. Application of the Common Criteria to Information Security Management Systems—A study, 5th International CC Conference, Berlin, September 2004. 

ISO/IEC, International Standard ISO/IEC 17799 2000 Code of Practice for Information Security Management, 2000... 

Security Secure management of data, i.e., un-retrievably destroyed or secure archiving of preserved integrity, depending on application)... 

The security life cycle of safety-related systems has to take into account the complete IT-security management life cycle as addressed in ISO 17799 and many national IT Security Handbooks, equivalent to the safety life cycle of IEC 61508. IT-Security Management is a continuous process of... 

IT-Security includes the following processes, which are related to the corresponding phases of the IEC Life Cycle Model (in [nn], Figure 3). Following this concept, the complete security management life cycle can be considered and integrated in a holistic, unified model of parallel, equivalent activities ... 

It has been demonstrated, that mass deployment of networked, dependable embedded systems with critical control functions require a new, holistic system view on safety critical and security critical systems. Both communities have to interact, communicate and integrate at the end. A unified approach to address the safety AND security requirements of safety related systems is proposed, based on the functional safety standard IEC 61508 and IT-Security management standards, handbooks and guidelines. 

Europe issued its own directive on electronic signatures in 1999." Although originally developed for e-commerce, it is also applicable to GDP and GMP apphcations. The MCA is clarifying the scope of its use for GCP and GLP apphcations, and at least a minimum degree of applicability is certain. European regulatory authorities refer to ISO 17799 on information security management" and reference to advice on the admissibility of electronic records." ... 

Retry lock-out after three unsuccessful attempts user then has to formally apply to Security Manager for new password Retry lock-out after three unsuccessful attempts... 

SOP for periodic review by Security Manager and escalation to senior management as appropriate Recommend design altered to only allow one active terminal per user at a time... 

Closure of Incident Signature of Security Manager Date ... 

Information security management (including virus checking)... 

---