AKIBIA'S PRACTICAL GUIDE TO ENTERPRISE TECHNOLOGY
Monday, August 16, 2010
The Death of Information Security
It may be hard for you to imagine a day without an Information Security group, but the truth is that the role of the security team is changing rapidly as priorities shift and other functions become more security savvy. Certainly the responsibilities of the current security team won't ever disappear, but I see more and more organizations adopting a decentralized model of managing information security. We now have robust privacy and compliance functions within many organizations with responsibilities that greatly overlap with the traditional security team. The most significant trend that I see is the move towards a deeper focus on risk management principles. This shift away from more traditional approaches to finding a risk and crushing it into oblivion with security controls is drastically changing the role of the security team. Governance and oversight activities are becoming the main focus for many of the more mature security programs, and less time is being spent on operational tasks. Rather these daily responsibilities are being dispersed amongst the existing operational teams as part of their functional work. No longer does the security team need to own every security related control or project in the organization. It is even becoming less common for the security team to have a staff of operational/technical engineers managing and monitoring security devices. The role of a security manager is also evolving more into an oversight focus. Provide guidance and tools for the existing operational teams to perform their daily function, and regularly assess their effectiveness.
Interestingly, as our industry pushes to get a seat at the executive business table, it forces us to also become more integrated into the business and adopt a risk-based model that the organization can use outside the security group. This raises doubts about the future of information security as a function and distinct team within the business. Will the Chief Information Security Office (CISO) exist as a position in 10 years? What about the privacy or compliance officer? No one can say for sure, but it seems likely that these functions and the oversight being performed by the information security team today will be absorbed into existing functions within the organization. Most security awareness programs try to emphasize that protecting the organization’s interests is not just the responsibility of the security team, but that every employee is responsible for security. Be careful what you wish for. The realization of this dream may land you out of a job. Ultimately wherever the functions and activities of information security end up in the organization, each business will need someone with vision, leadership, and subject matter expertise to provide oversight and ensure that there is a cohesive approach to protecting the business’ interests.
I think that security teams should really approach an Information Security program as if they are consultants hired to help guide the business. The majority of your time should be spent interpreting security policies and standards, and helping the organization to understand how and when to apply them. If you think about the major components of your security program, likely you spend a lot of time managing out-of-compliance issues, working with auditors, assessing discovered vulnerabilities and emerging threats, and responding to incidents. All of these activities really need to be grounded in a robust risk management framework if you have any hope of being successful. Using the risk-based approach will help to prioritize where you should spend your energies and determine which risks are acceptable for the organization. We need to move away from a culture of expecting 100% compliance and zero risk. That just isn't a reasonable goal. Which ever risk model you choose, be sure that it provides a flexible yet consistent methodology for assessing and analyzing risks as they pertain to your organization in particular. No more of this reliance on everything being a blanket 'best practice' to justify security initiatives. In the past we have fostered a culture of saying 'No' which put us at odds with the business growing and evolving. It's the difference between security and the business standing on opposite sides of the mountain trying to figure out how to get over the top, as opposed to us standing on the same side trying to find the best solution together. Once you start to really analyze and understand the risks to the organization, you will be much better equipped to advise the executives how to best minimize exposures without compromising the organization's objectives.
Risk management is still new to many security professionals in the field. If you are interested in learning the fundamentals of risk management and how to use this foundation to build a mature security program, I recommend a new course being offered by SANS, MGT442 Information Security Risk Management. The debut of this course is being hosted in Hopkinton, MA on September 28th & 29th. More information is available here.
