Nearly every other business process in an organization has to demonstrably contribute to the top or bottom lines.
- What return did our advertising campaign bring in the form of new sales?
- How much profit did our new product generate?
- How much have we saved by moving our environment “to the cloud”?
Information security is getting a lot of mind share lately among executives and boards for good and obvious reasons. However, how are those boards and executives determining if they have the “right” programs in place?
This reminds me of the TSA paradox… Have freedom gropes, nudie scanners and keeping our liquids in a clear ziplock bag actually kept planes from falling out of the sky? Or is this just random luck that no determined person or organization has really tried in recent years?
If our organization is breached, or has a less significant security “incident”, it’s clear that there is some room for improvement. But, do no breaches mean that the organization has the right level of investment, right technologies properly deployed, right amount of staff with appropriate skills and proper processes in place? Or is it just dumb luck?
Information security is in an even tougher spot than our friends the TSA here. A plane being hijacked or not is quite deterministic: if it happened, we know about it, or very soon will. That’s not necessarily the case with information security. If a board asks “are we secure?”, I might be able to answer “We are managing our risks well, we have our controls aligned with an industry standard, and the blinky boxes are blinking good blinks.” However, I am blind to the unknown unknowns. I don’t know that my network has 13 different hacking teams actively siphoning data out of it, some for years.
Back to my question: how do we demonstrate that we are properly managing information security? This is a question that has weighed on me for some time now. I expect that this question will grow in importance as IT continues to commoditize and security threats continue to evolve and laws, regulations and fines increase, even if public outrage subsides. Organizations only have so much money to invest in protection, and those that are able to allocate resources most effectively should be able to minimize costs of both security operations and of business impacts due to breaches.
I recently finished reading “Measuring and Managing Information Risk: A FAIR Approach”, and am currently reading “IT Security Metrics”. Both are very useful books, and I highly recommend anyone in IT security management read them. These are generally “frameworks” that help define how, and how not to, assess risk, compare risks and so on. In the context of a medium or large organization, using these tools to answer the question “are we doing the right things?” seems intuitive, however at the same time, so mind bogglingly complex as to be out of reach. I can use these to objectively determine if I am better off investing in more security awareness training or a two factor authentication system, however it won’t inform me that I should have actually spent that extra investment on better network segmentation, since that risk wasn’t on the radar until the lack of it contributed to a significant breach.
Also, there really is no “perfect” security, so we are always living with some amount of risk associated with the investment we make. Since our organization is only willing or able to invest so much, it explicitly or implicitly accepts some risk. That risk being realized in the form of a breach does not necessarily mean that our management of information security was improper given the organizational constraints, just as not having a breach doesn’t mean that we ARE properly managing information security.
Without objective metrics that count the number of times we weren’t breached, how does the board know that I am wisely investing money to protect the organization’s data?
Is this a common question? Are good leaders effectively (and responsibly) able to answer the question now? If so, how?