Overcomplicating Information Security and Risk Management

Overcomplicating Information Security and Risk Management
by Drazen Drazic

If I had to highlight a key problem area for organizations when it comes to how they approach Information Security and Risk Management overall, it would be the over-complication of their implementation(s), or lack thereof. (Sounds strange for the latter but it’s that “complication” that also results in the “lack thereof”).

Technology has done little to simplify Information Security for organizations when viewed away from a point solution perspective and judged from an overall enterprise perspective.

As new layers of technology are deployed to supposedly further enhance security, what we are seeing is not an increase in security but rather additional complexity and the whole security program becoming so complicated that few if any individuals have that holistic oversight about their organization’s actual security position. When you don’t have this definitive view, you have critical failure. This article; “The 7 Reasons Why Businesses are Insecure” looks deeper into how simple approaches, being neglected contribute to the overall failure of an Information Security program.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Free Guide: Web Application Security
How to Minimize Prevalent Risk of Attacks
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Risks, Impacts, etc etc…..what do they mean in the whole scheme of things when they are rarely assessed outside of a specific system or application as discussed here? You’ve only got a fraction of the relevant data upon which to base a decision and/or strategy upon. The foundation principles of Risk Management have been forgotten! Yet, every major organization has a Risk Management group! What are they then doing for Information Security Risk Management? Ask them. I can guarantee you that they’re more than likely just doing project risk analysis, (and any Project Manager worth his salt can generally do that). Why? Because it’s all too complicated for them.

The foundation principles of Information Security and Risk Management haven’t really changed in the last 20 or more years but we seem to move further and further away from the basics - trusting in each new generation of the next big security software, appliance etc to deliver us some simplicity. Or, are we just hoping that it’s taking away accountability and the burden of us having to think and plan better? I’d say it is.

Comments

Anon says:

September 22, 2009 at 2:11 PM

We have lost touch with reality and common sense. Well said. Now to send this and links through to my management who will discard them because the concepts are not complicated enough.
Like or Dislike: 3 0
Anon Girl says:

September 22, 2009 at 3:36 PM

My Philosophy

The economic reality is the more systems we use, the more complicated the procedures we follow, the more equipment we have and the more information that we handle, the bigger the risk and the more it costs to maintain and protect.

• If you don’t need to keep it – Don’t.
• If it can be done just as well simpler – Do it.
• If it has been replaced –Get rid of it.
• If you don’t need to use it – Move it.
Like or Dislike: 3 0
Kristen Pike says:

September 28, 2009 at 7:57 AM

It’s amazing how many risk management solutions are founded in the concept of simplicity. When you look at the heart of any risk management planning, it’s all about proactively managing and simplifying what you can to decrease your risk.
Like or Dislike: 2 0

Leave a Reply

You must be logged in to post a comment.

Related Tweets

Syndicated Content


	Making The Buy For Trust Seal For ease of access, we have added a 'Buy' button to the very top of the Trust Seal landing page. This helps to ensure that it is easily visible and accessible to users and that it doesn't get missed further... VeriSign At SES The VeriSign Authentication team was at SES last week talking up the VeriSign Trust Seal which was recently launched in February, and Seal-in-Search - a service where search engine users can see the VeriSign Trust Seal next to sites protected... VeriSign Now a Symantec Company We are very excited to be a Symantec company! If you haven't already heard, VeriSign has been acquired by Symantec. The deal was made official on August 9, 2010. We are very excited about new opportunities for increasing and offering...



	PayPal UK Launch Security Key - Guest Posting from PayPal I am happy to say they are using VeriSign Identity Protection to deliver this, which means that PayPal Customers will be able to use their token at other sites who join the VIP network. PayPal are the first UK members of the network, but there are around 30 other members in different countries around the world so you can expect to see more places where you can use your token in the UK appearing shortly. Facebook scam - Part 2 This just in from the BBC web site, Symantec have identified a virus that steals user names and passwords, nothing new there. But, if I understand this right, it is delivered through a Facebook invitation from someone you don't know and delivers malware which can then steal user names / passwords and also keylog credit card info. Survey finds passwords are not secure - well d'uh! I don't think the vendor community has been crying wolf about the problems that stronger authentication solves, more like highlighting that this problem is here and growing. Well the discussion I have had recently with many different organisations across many different industries are now resulting in more and more consumer projects in this area



	Cloud Identity, Trust and the Liability Elephant. I have been involved with a couple similar initiatives around certification for identity and thought it would be interesting to explain the logic behind these efforts. The first initiative is led by the Open Identity Exchange and is based on... Greek Heroes, Facebook and Trust When Achilles was a baby, the oracle predicted that he would die in battle from an arrow. Thetis, Achilles' mother who did not want her son to die decided to dip Achilles' body into the water of a river that... PCI for the Cloud For most enterprise and security vendors, the cloud is fascinating both as a technology and a business disruptor. In fact, SAAS CEOs such as Successfactor, SalesForce and NetSuite are hot shots in Silicon Valley these days. Yet, most of us...