Theory: Security Management vs. Security Engineering
Knowing the CIA Triad tells you what to protect. Security management is about deciding how much to protect, with what resources, under whose responsibility, and how the organization will respond when protection fails. This course takes the managerial view: it develops judgment in governance, risk and policy rather than hands-on technical implementation.
What Is Security Management?
Security management is the set of policies, processes, and organizational practices used to protect an organization’s information assets, with people, technology and data working together.
The definition deliberately puts policies and processes first. Tools matter, but they only work inside a managed system of rules, responsibilities and decisions.
Why It Matters
- Technology alone cannot stop every attack. Attackers target people and processes when the technology is strong.
- Organizations must decide what to protect, and how much to spend doing it. Budgets are finite; not every asset can get maximum protection.
- People and processes are often the weakest link. A trained, accountable workforce and clear procedures close gaps that tools cannot.
- Regulations and stakeholders demand accountability. Laws such as Thailand’s PDPA, auditors, customers and boards expect someone to be answerable for security.
The Security Manager’s Role
| Responsibility | What it means in practice |
|---|
| Sets security policy and standards | Writes the rules (e.g., “patient records must be encrypted”) |
| Assesses and prioritizes risk | Decides which threats matter most and which get fixed first |
| Coordinates people, process & technology | Makes sure staff, procedures and tools work together |
| Ensures legal & regulatory compliance | Maps obligations (PDPA, sector rules) to controls |
| Plans for incidents and recovery | Prepares response, continuity and disaster-recovery plans before something goes wrong |
Who Is Responsible for Security?
Security is everyone’s responsibility, but at different levels:
- Executives / board: own the risk, set direction and budget, are accountable to regulators and stakeholders.
- Security manager / CISO: designs the program, policies and risk process.
- IT and engineering staff: implement and operate technical controls.
- Data owners and department heads: decide who may access their information.
- Every employee and contractor: follows policy, handles data carefully, reports incidents.
Common mistake: answering “Who is responsible for security?” with “the IT department.” IT implements controls, but accountability sits with management, and every user’s behavior affects security.
Two Lenses on the Same Problem: Management vs. Engineering
| Security Management (this course) | Security Engineering (e.g., CSC351) |
|---|
| Focus | Policy & governance | Secure coding & configuration |
| Activities | Risk assessment & decisions | Building defenses & controls |
| Concerns | Legal, ethical, compliance issues | Exploits, tools, implementation |
| Guiding question | “What should we protect, and why?” | “How do we build it securely?” |
Both are needed and they feed each other. Management decides that patient records need strong confidentiality and sets a policy; engineering chooses and configures the encryption and access controls that satisfy it; management then checks (audits) that the control works.
Mini-example
“All laptops holding customer data must use full-disk encryption” is a management decision (a policy). Choosing the encryption tool, deploying it to 500 laptops and verifying the configuration is engineering work.
Week 1 Summary
- Security is not only about hackers; technology alone is insufficient.
- Security management combines people, process, policy and technology to support the business.
- The CIA Triad is the foundation for evaluating any security decision.
- Strengthening the triad involves trade-offs; the manager’s job is to balance them for the organization’s needs.
Review Questions from the Lecture
- What are the assets in the organization? Information/data, technology/systems, physical facilities and equipment, people, and intangibles like reputation (expanded in 2.2).
- What does security cover? People, process and technology.
- Who is responsible for security? Everyone: management is accountable, security and IT staff implement, every user follows policy.
- What are the three foundations of information security? Confidentiality, Integrity, Availability.
Exam questions that ask “what should management do” want a decision, policy or process (classify data, require approval, train staff, plan for incidents), not a product name. Phrase answers as organizational actions.
Worked Examples
Exercise 1
Classify each activity as primarily security management or security engineering:
(a) Writing a policy that requires all remote access to use multi-factor authentication.
(b) Configuring the VPN server to enforce multi-factor authentication.
(c) Deciding whether to spend this year’s budget on backups or on staff training.
(d) Fixing a SQL injection flaw in the patient portal’s source code.
(e) Checking whether the hospital’s data handling complies with the PDPA.
Show solution ↓Hide solution ↑
Solution
Ask: is this deciding what/why (management) or building how (engineering)?
- (a) Setting a rule → management (policy).
- (b) Implementing the rule technically → engineering.
- (c) Prioritizing resources by risk → management.
- (d) Secure coding → engineering.
- (e) Legal/regulatory compliance → management.
Management: (a), (c), (e). Engineering: (b), (d).
Exercise 2
A small company has excellent firewalls but no written security policy, no incident plan and no staff training. An employee falls for a phishing email and the attacker logs in with her credentials. Explain, from a security management perspective, what was missing.
Show solution ↓Hide solution ↑
Solution
- The technical control (firewall) worked as designed; the attacker did not break through it. They walked through the front door with valid credentials.
- What failed was the people and process side:
- No training: the employee could not recognize phishing (people are often the weakest link).
- No policy: there was no rule requiring, for example, multi-factor authentication for logins, which would have made the stolen password insufficient.
- No incident plan: once the attacker was in, there was no defined way to detect, contain and recover.
- These are all decisions management should have made about what to protect and how.
Missing were the management elements (policy, awareness training and incident planning), showing that technology alone cannot stop every attack.
Exercise 3
List the five responsibilities of a security manager given in the lecture, and give a one-line MediCare Plus Hospital example for each.
Show solution ↓Hide solution ↑
Solution
- Sets security policy and standards: writes a rule that only treating staff may view a patient’s EHR record.
- Assesses and prioritizes risk: decides that the unreviewed networked infusion pumps must be reviewed before the guest Wi-Fi.
- Coordinates people, process & technology: ensures nurses are trained, access-review procedures exist and the EHR’s access controls are configured to match.
- Ensures legal & regulatory compliance: prepares the hospital for its PDPA compliance review.
- Plans for incidents and recovery: maintains a plan for operating if the EHR goes down (paper fallback, backup restoration).
Policy, risk, coordination, compliance and incident/recovery planning, each tied to a concrete hospital decision.
Exercise 4
A hospital’s CEO says, “Security is the IT department’s job, not mine.” Give two reasons why this view is wrong.
Show solution ↓Hide solution ↑
Solution
- Accountability and budget belong to management. Deciding what to protect and how much to spend is a business decision; IT cannot fund or prioritize security on its own, and regulators hold the organization’s leadership accountable.
- Security failures are business failures. A breach causes operational disruption, financial loss, legal issues and reputation damage, all of which the CEO is responsible for.
(A third valid reason: people and processes across all departments, not just IT, are often the weakest link.)
Security is a management responsibility because leadership owns the risk, the budget and the business consequences.