IT security in a changing world
IT security in a changing world
Predicting the future is always a challenge, particularly when it comes to IT. The history of computing is littered with attempts to define how things might look: the only characteristic they share is an innate level of inaccuracy. If we want to define IT strategy however, we must take a stab at what we think will happen. There are some, more obvious trends that can help us here – use of mobile technologies, say, or use of virtualisation. The harder ones to judge are more dynamic areas such as social networking and Web 2.0, or trendier, issues-based areas such as going green. Trying to decide whether such things are just a flash in the pan is perplexing, to say the least.
For security professionals, every big, new thing brings with it a raft of big, new risks. Gone forever are the days when security was discussed in terms of air-gaps and offline storage: the brave new IT environments of today are always-on, and always connected. The result is a conundrum: oftentimes, organisations choose to risk the potential dangers rather than battening down the hatches and constrain business. A simple example is the USB-attached storage device (a.k.a. the flash drive or iPod), which these days has the capacity to haul off a significant amount of corporate data, if not all of it. One CIO told us when his department conducted a USB port scan, they found over 600 different types of USB storage device attached to corporate desktops. Blocking access to these, however, would restrict how people share information, as well as being an administrative nightmare to manage.
While organisations may be choosing to accept the inherent risks of many technologies, this doesn’t mean they are blasé. In many case, companies are finding themselves restricted by a lack of security. Indeed, according to a recent Freeform Dynamics research study, they are limiting the adoption of such business-beneficial approaches as teleworking and workforce mobility, because they are concerned about the risks. So, the absence of a warm feeling about how risks are being countered, is actually holding organisations back. Not just this, but more and more these days security breaches are being treated as a failure of business governance, not just of IT.
What to do? If a lack of understanding is at the root of the problem, the solution is perhaps to mitigate this, rather than having sleepless nights about what might be. There are several things an organisation can do, none of which are specifically to do with technology: these include defining ownership of the problem, delivering workable policies that can change with time, and separating concerns between those that do and those that monitor. Most importantly, IT security needs to be treated seriously at board level, not for its own sake but because the lack of security is an inhibitor to business growth. A business-led, co-ordinated approach to IT security need not be difficult to implement, if it is pitched at the right level, and for the right reasons.