Aligning IT security with the business
Outside in or inside out, threats have to be protected against both in business and IT. Organisations today are looking to adopt more holistic approaches to balance IT security delivery against the risk management needs of the organisation, explains Jon Collins.
Where next for the security industry? The more cynical of pundits (and I include myself in this) have referred to it as an industry of fire extinguisher suppliers. No! Unfair! Or is it? While this glib titling may have an element of truth, we have to see this in the context of information technology at large, and most importantly, of how organisations procure their IT assets.
The fact of the matter (and this has been proven many times over in our industry research) is that organisations tend to buy technology in a number of quite defined ways. At one end of the scale we have major infrastructure investments, such as the construction of a new data centre, or the acquisition of an enterprise application like SAP. Such high-visibility procurements require the full support of the company board, and indeed, need to be run as change programmes in their own right as numerous users and data sources are migrated to the new platforms.
At the other end of the scale we have more tactical investments. While IT budgets may be created for the year, money will tend to be allocated on a quarterly basis. Like charities, there are plenty of worthy ways that the money could be spent, each of which will undoubtedly benefit the people at the receiving end – the business end-users of technology. But equally, there is only so much money to go around so some projects go unfunded, generally these tend to be the ones that are harder to justify. Quite frequently, it is in this tactical area that we find security purchasing: it is any wonder then, when we ask what organisations already have in place, we see the simpler stuff (antivirus protection, VPNs and the like) at the top of the list, and the more complex much lower down? Put bluntly, organisations treat security acquisitions like fighting fires, so should we be surprised that their actions are partially to blame for spawning an industry of fire extinguisher suppliers?
The good news is that there are signs this attitude and approach is changing. Many companies and public bodies are starting to see security within the broader context of risk, and this is having a positive impact on both attitudes to, and procurement of, security-related technologies. This sea change is for a variety of reasons: not least, the US-led compliance wave, which has grown into the broader “governance, risk and compliance” movement visible in all parts of the globe, particularly but not only in the Financial and Public sectors. As organisations become more savvy about business risk, they are recognising that IT is a two-pronged fork: not only can it be the cause of many risks that ultimately impact the business, but also, it is the source of a certain set of tools that can help organisations mitigate risks across the board.
The result, of course, is that IT security is being taken far more seriously by many companies. This does not mean that the wallet for security products has been prised firmly open, however. Traditionally, IT security has dwelt upon issues that make the best headlines: such incidents have generally come from the outside and more likely than not, IT security companies and their PR representatives have leapt on them as examples of exactly what their products can protect against. Meanwhile however, we have seen from our research that the potential for some kind of misdemeanour coming from an insider is just as great. We know (largely from anecdotal evidence and extrapolation) that companies are loathe to tell the world when they have suffered an internal security breach, which means that story- hungry journalists are not generally aware when such things happen (indeed, in certain US states, it is now illegal to keep mum – a fact that security companies have been quick to capitalise upon). While such incidents may not be discussed, this does not diminish their importance, however.
The insider threat does not have to be some kind of corrupt or malcontented employee determined to bring his organisation to its knees. While this can happen, far more likely is that something will go wrong due to an error of judgement, or a bunch of fresher staff members goading each other on, or an accidental eavesdropping that leads to a confidentiality breach. There are plenty of potential examples – but it is perhaps easiest to think back to one’s own experiences – of leaving a mobile phone on a park bench say, or accidentally deleting that important file. Such issues, writ large, demonstrate the real nature of the threat that the organisation’s own employees – that is, thee and me – pose to the business. Because it can boil down to mistakes that are made in the course of doing one’s normal work, clearly, it becomes difficult to defend against them. How can one easily guard against an employee deleting data, when said employee has every right and privilege to do so?
Equally clearly then, the expanded nature of risk to cover both illicit outsiders and unfortunate staffers means we can no longer think about solutions in technological terms alone. We are seeing success where organisations are taking the broader view, not only of the risks but also of the protections – setting workable policies for acceptable computer use, say, or ensuring that mobile workers are also given security awareness training when provided with corporate kit. Yes, absolutely, security technologies have a part to play, but only within this wider context, and not diminishing or replacing it. To many of us this means breaking the habits of a lifetime. We are all (particularly in IT) attracted by the latest gadget or software package, but we must resist the temptation to see such baubles as “the answer” in its entirety.
Even if we manage to adopt the broader view, we are not out of the woods. Security – or to use a better term, risk management – is not something that can be done only once and then left. This is for a number of reasons, not least that organisational behaviours are changing almost as fast as the technologies supporting them. Simple changes can completely blow a set of security policies out of the water. The lowly USB stick for example, is both a huge asset to individuals wanting to share files, but at the same time poses an equally large risk, having reached a size where they could hold a company’s entire customer database several times over. Or consider blogs, which are a thoroughly useful collaboration mechanism, but can equally provide a mechanism to thrust corporate secrets into the public domain. The same dichotomies can be found in the business at large, for example as organisations try to achieve the benefits of managing multiple outsourcing suppliers or allowing flexible home working. Such establishments may well be looking to open up their corporate boundaries, not lock them down – but all the while, they will need to manage the risks inherent in doing so.
So, what’s the answer? Ownership is key – and that stretches from the individual acknowledgement that people are both part of the problem and part of the solution, right up to ensuring there is somebody in an appropriately senior position to take responsibility for all risks, both business and IT. Some organisations are already achieving this, and many others are looking to see how they might develop such a role, with such an authority, in a way that works for their own businesses.
The bottom line then, is that we cannot rely on simple solutions, technological or otherwise – but then, this was never a simple problem. Many organisations still have a way to go, but a good first step is to recognise that it can only ever be part of the answer, and for the rest we will need to take a long hard look at ourselves, and at our organisations. The goal of aligning IT security with business risk management may not be easy to attain, but at least we shall be facing in the right direction.