Issue link: https://www.e-digitaleditions.com/i/1472963
34 I ICT TODAY However, most enterprises do not communicate their cybersecurity risk guidance or risk responses in consis- tent, repeatable ways. Methods, such as quantifying cybersecurity risk in dollars and aggregating cybersecu- rity risks, are largely ad hoc and are sometimes not per- formed with the same rigor as methods for quantifying other types of risk within the enterprise. In addition to widely using cybersecurity risk registers, improving the risk measurement and analysis methods used in CSRM would boost the quality of the risk information provided to the ERM program. In turn, this practice would promote better management of cybersecurity at the enterprise level and support the enterprise's objectives. PHYSICAL SECURIT Y While it is important to protect data, it is equally important to protect the access to a building and who is allowed to physically access information. Following are some of the standards to reference for physical security for the smart/intelligent building: ANSI/TIA-5017, Telecommunications Physical Network Security Standard This standard addresses the physical security for telecom- munications infrastructure, including cabling for smart buildings which is specified in TIA TR-42.1. While the 'A' revision has been approved, the committee has not started work on it. The corresponding ISO/IEC stan- dard is ISO/IEC 24373, which is still in development. ISO/IEC 27039:2015, Information technology — Security techniques — Selection, deployment and operations of intrusion detection and prevention systems (IDPS) ISO/IEC 27039:2015 provides guidelines to assist organizations in preparing to deploy intrusion detec- tion and prevention systems. It addresses the selection, deployment, and operations of IDPS. It also provides background information from which these guidelines are derived. One of the most beneficial resources available for physical security of buildings was developed after the bombing of the Alfred P. Murrah Federal Building in Oklahoma City, Oklahoma. The Interagency Security Committee created and published the document, While it is important to protect data, it is equally important to protect the access to a building and who is allowed to physically access information. There are proven methods available for performing CSRM and integrating the results. Improving the mea- surement and communications methods used in CSRM, such as through the use of cybersecurity risk registers, can improve the quality of the risk information pro- vided to ERM. This result promotes enterprise-wide CSRM and supports enterprise-level decision making. Improved communications will also help executives and corporate officers understand the challenges that cybersecurity professionals face when providing those professionals with the information they are accus- tomed to receiving for other types of risk. A PDF from NIST about integrating cybersecurity with ERM is available for free. 4