Project Management and Information Security Approaching Security as a project

Project Management Information security is a process, not a project However, each element of a security program can be managed as a project (managed processes)

Project Management The application of knowledge, skills, tools, and techniques to project activities to meet project requirements Application to Security Use of PMBoK The Project Management Institute (PMI) Cert. The Project Management Professional (PMP) Certified Associate in Project Management (CAPM)

Example of a Project Management Team and Security Members of the development team Champion Team leader Security policy developers Risk assessment specialists Security professionals Systems administrators End users Management of Information Security, 3rd Edition

Project Management Book of Knowledge (PMBoK) Source: Course Technology/Cengage Learning

PMBoK KA – Project Integration Project integration management Includes the processes required to coordinate occurs between components of a project Elements requiring integration: Project Plan Development Progress Monitoring Revision Control Resource Allocation Control

PMBoK KA – Project Integration Project plan development The process of integrating all of the project elements into a cohesive plan Core components: Work time Resources Deliverables

PMBoK KA – Scope Management Ensures that project plan includes only those activities necessary to complete it. Major processes: Initiation Scope Planning Definition Verification Change Control

PMBoK KA – Time Management Ensures that project is finished by identified completion date while meeting objectives Includes: Activity definition Activity sequencing Activity duration estimating Schedule development Schedule control

PMBoK KA – Cost Management Ensures that a project is completed within the resource constraints Includes: Resource planning Cost estimating Cost budgeting Cost control

PMBoK KA – Quality Management Ensures project meets project specifications Includes: Quality planning Quality assurance Quality control Software bugs account for about 40% computer systems failure

Management of Information Security, 3rd Edition PMBoK KA – HR Management Ensures personnel assigned to project are effectively employed Includes: Organizational planning Staff acquisition Team development Management of Information Security, 3rd Edition

PMBoK KA – Communications Management Conveys details of project activities to all involved Includes: Communications planning Information distribution Performance reporting Administrative closure

Stakeholder Analysis for Project Communications

PMBoK KA – Risk Management Assesses, mitigates, manages, and reduces the impact of adverse occurrences on the project Includes: Risk identification Risk quantification Risk response development Risk response control

PMBoK – Project Procurment Acquiring needed project resources Includes procurement planning, solicitation planning, solicitation, source selection, contract administration and contract closeout

Projectitis Occurs when the project manager spends more time documenting project tasks, collecting performance measurements, recording project task information, and updating project completion forecasts than accomplishing meaningful project work

Project Mgmt Tools: Work Breakdown Structure Work breakdown structure (WBS) Simple planning tool for creating a project plan Determine minimum attributes for each task As the project plan develops, additional attributes can be added Work phase after WBS is completed

Work Breakdown Structure: Determine minimum attributes for each task Table 1-2 Early draft work breakdown structure Source: Course Technology/Cengage Learning

WBS: Include additional attributes Source: Course Technology/Cengage Learning

Task Sequencing Approaches: PERT Source: Course Technology/Cengage Learning

Task Sequencing Approaches: PERT Three key questions: How long will this activity take? What activity occurs immediately before this activity can take place? What activity occurs immediately after this activity? Determine the critical path Slack time

Task Sequencing Approaches: PERT Advantages Disadvantages

Task Sequencing Approaches: PERT

Task Sequencing Approaches: Gantt Gantt chart Easy to read and understand; easy to present to management Easier to design and implement than the PERT diagrams, yielding much of the same information Lists activities on the vertical axis of a bar chart, and provides a simple time line on the horizontal axis

Task Sequencing Approaches: Gantt Figure 1-11 Project Gantt chart Source: Course Technology/Cengage Learning

Automated Project Tools Microsoft Project A widely used project management tool Keep in mind: A software program is no substitute for a skilled and experienced project manager A software tool can get in the way of the work Choose a tool that you can use effectively