How to fashion a 'security first' enterprise
- 19 March, 2008 10:29
These forward-thinking IT managers are working at dismantling the stereotype of the risk-averse security professional-cum-business foe. How? By showing business colleagues they understand company operations and appreciate corporate goals.
"If security professionals' sole objective was to eliminate risk entirely, no one would have a BlackBerry, no one would have a laptop, and we'd all shred everything the second we read it," says Chad Mead, head of infrastructure security for Global Technology Infrastructure at JPMorgan Chase, headquartered in the US. "But today's business has changed and become much more mobile, so security has to become more of a partner with business."
The need for security pros to tune in to business is not unlike the situation IT experienced about a decade ago, when organizations started thinking about technology as a strategic asset. Then, IT directors learned that presenting technology plans to the board or operational units without emphasizing business benefits was an exercise in futility.
"Businesses have to understand and be willing to listen to security people, but it's up to security managers to coax the business folks along," Mead says. "It's up to security professionals to change perception of security as impediment, and help business managers think of incorporating security upfront."
Security professionals who have operations backgrounds might find changing their mind-sets and becoming a partner to business easier than most. But an operations background is not essential. More important is that security managers get out of their offices and ask questions.
Prime objective
Understanding the business "should be the key objective for any risk manager," says Andre Gold, head of security and risk management for ING Financial Services, and former CISO at Continental Airlines. At ING, as at Continental, Gold says he spent time learning how business operations such as call, distribution and maintenance centers work and measure success. "Once you understand the business, it gives you credibility. You can have conversations about security as a business enabler, not an inhibitor," he says.
Page Break
Big results can come from small changes. At Akamai Technologies, Andy Ellis, senior director of information security, looks for opportunities to help business workers take small steps toward security.
"I call them 'margin decisions,' where people are on the margin between doing the right thing and not, and I try to help them do the right thing," Ellis says. "You share your vision for where they could be in three, five or 10 years, but give them something real and achievable now."
This approach helps him project the image of adviser, not auditor, Ellis says. Instead of issuing business-unit heads a mandate about where security should be, he works with them on problem resolution. Business leaders like this approach, and keep coming back to him for early involvement in business projects, he says.
Business rethink
As security professionals change their mind-sets, business-unit managers are slowly rethinking security as well, says John Pescatore, a vice president with Gartner. They are beginning to understand that if an application they're modeling is going to touch financial data, it's going to require strong authentication, and that if they're building a customer application, auditing needs to be included. "If those [security elements] are baked in at the beginning, that's a big leap forward," he says.
Still, the more often security professionals can adopt a business stance, the more successful a risk-management program will be. This soul-searching isn't an end in itself; if security professionals speak in the language of business, they will find they get a seat at the table when new projects are beginning. And with the opportunity to talk security from the start comes more effective risk management.
Some security pros even find that when they can educate business units in the strategic importance of security, their job is often accomplished for them. As Gold says, "It's great to have a seat at the table, but it's even better when you don't have to be at the table" because business managers discuss security unprompted.