Security management Toolkit
Story: Security is more than just an overhead
Information Security is an investment in the company's future
John’s article is absolutely correct and is thought provoking. It’s very difficult to be positive about Information Security, especially when it’s viewed as a technical issue rather than one that the business should embrace. Reporting the information security status to senior management tends to be negative. Information Security professionals report bad news. It can’t be helped. If security is running smoothly then there is nothing to report, otherwise Information Security has a tendency to be reported in quantitative terms, such as the number of security incidents. We need to find another way.
One important factor to consider within a company is the positioning of the senior Information Security professional. If they are within the IT department, then it will be viewed by everyone as a technical issue. Sure, most of the security controls are within IT because that’s where most of the information is held, but the drivers are with the business. If the security of information is a business responsibility, and it can be traced back to business requirements, then funding becomes easier. When Information Security is within the IT department there is a tendency to take a technical approach. After all, IT people love technology; they will buy the most technologically advanced and shiniest piece of equipment to mitigate security vulnerabilities and treats. If one considers that IT doesn’t own business information, then IT can’t be responsible for its protection. If the business doesn’t get this and other roles and responsibilities correct before any outsourcing takes place, then it can be very difficult to manage the outsource contract.
Full Talkback thread
