|
Escalating security threats over the past two decades have spawned a whole new technology industry and a rapidly expanding knowledge domain. While new information, skills and technques are required to meet these threats do we really need to invent new technology and management control approaches? Or are we just reinventing the wheel...again.
Petty infighting among interest groups and blatant opportunism have created an entire sector of the technology industry that promotes costly security technology services and solutions through fear and disinformation. Executives and professionals have to see through that smoke screen and use common sense to guide them to the right decisions concerning just how much their business depends on bullet-proof security, just how much to invest in commercial security solutions--and most importantly, just how much these solutions differ from the solutions and processes they already have in place.
Each new threat potentially requires new solutions, but those instances are rare. As sage security luminary Bruce Schneier puts it, "there is nothing new under the sun." Most threats, when investigated and classified, fall into known security categories that can be addressed using existing controls frameworks. In other words, in 9 our to 10 cases we already know what to do and have in place the infrastructure to do it.
We already know what to do because security is not a new problem area. Security has been a concern in the information industry since the first computer was built to house proprietary information. Security is nothing more than a common quality attribute of technology systems and a business risk. We already have in place mechanisms to deal with quality assurance and risk management--and these can be leveraged to help address the security problem.
Security can be dealt with effectively on technology projects, using your quality assurance and risk management infrastructures. You simply prioritize security higher on projects, during the procurement process, and on implementations. The problem is that this assumes the organization already places high value on quality assurance and risk management. Our tendency to address security as a separate enterprise problem is chiefly because most companies have prioritized quality and risk analysis low on technology projects.
Companies have a choice: either fund costly security solution, or else prioritize security higher on technology projects and in making technology decisions. The latter approach leverages investments already made in your quality assurance and risk management programs and avoids unnecessary security investment costs.
(c) 2005 Bar Biszick-Lockwood/QualityIT
Home |
Sections 
