Government Technology

If you had a badly managed security risk in your IT organisation, why wouldn’t you do something about it? Most people would act if they really knew about a risk and understood that it was important.
    
Almost ten years ago, two Stanford University academics, Jeffrey Pfeffer and Robert Sutton, wrote a popular book titled ‘The knowing-doing gap’1 in which they explored how good companies turn their internal knowledge into effective action. Pfeffer and Sutton also outlined what happened to cause organisations to fail to act on key information they already had within their midst. Much of the problem was due to the information being locked up within organisational ‘silos’ of experts and specialists.

Communication gap
Risk management and security specialist functions often suffer from this communications gap. These are knowledgeable professionals who know about risks and the practical steps that can be taken to manage them, but without the organisational backing and funding provided by their senior management they can do little. A recent (post credit-crunch) survey by recruitment consultants Whitehead Mann found that nearly one in eight risk managers were not influential in their own organisations.
    
This confirms a theme that has run through private sector information security surveys for a number of years. Despite some improvement, a notable percentage of those surveyed still claim that their management does not understand the issues well and fails to give them necessary support. This does not sound like a good return on investment for security team costs.
    
As the responsibility for communicating lies with the communicator, just what is happening within security teams so that the message does not get across? Common failings seem to include:

• Not framing the security risk in credible business terms
• Not showing an understanding of broader context, including relative priorities of other risks
• Dealing with point issues and solutions rather then a more strategic vision
• Not understanding change implications and how to be a change agent
• General lack of influence skills.  
  

• Robust governance and risk management processes – so that investment in protection can be focused on where there is greatest business value, and assets valued and classified accordingly.
• Clear articulation of policy – defining where there need to be mandatory standards and processes and where localised decision-making is appropriate.
• A strategy and architecture that addresses risk management and security solutions in a holistic way, rather than just point solutions.
• Management of 3rd parties – and their security responsibilities and access.
• Trained staff, aware of their role in good security and able to perform the security task required of them.
• Incident management processes – so that the inevitable security events can be identified early, controlled and any impacts mitigated.
• Good linkage to physical security – so that the systems themselves can be protected from damage, theft or interference and media properly handled.
• Good operations processes – for operations of applications, systems and networks so that backdoors are not left open or software weaknesses not patched.
• Good access management – so that user IDs are created, maintained and demised in a timely manner and access is granted in accordance with policy.
• Adequate technical controls – including detection and protection against malicious code and systems/network intrusion; encryption and digital signing used appropriately.
• Robust system development – with a repeatable, managed development lifecycle run by developers trained in secure architecture and secure coding.
• Planned business continuity – assured by resilient systems design, robust backups and tested continuity plans