Calculating e-risk

First Union Corp., whose core business is trust, can't wait for outside interests to determine risk metrics. So last year, the Charlotte, N.C.-based bank implemented Phase 1 of a risk-compliance program by standardizing policy and tracking compliance.

"We wanted to make it measurable whether files, systems and risk parameters are appropriate," says Pat Hymes, manager of distributed computing at First Union's information security division.

Hymes' team started by assessing whether its published operating system security policy was being followed using commercial and home-written software agents that report the state of the operating systems.

The agents reported back that "the general state of our operating system-level security wasn't very good," Hymes says. "A lot of the system administrators didn't even know security was part of their jobs. So we put together a training class."

This compliance data is now used to chart measurements, which are routed to department heads and IT leaders with bullet points that say, "Here are the common risk areas and here are our concerns," he adds.

Hymes' next step: Develop similar measurements for compliance in networks and applications and among employees.