Once upon a time when information security did not figure in
the priorities of the IT Head (the era before the CIO title came into vogue),
the company took upon itself to protect sensitive information that if leaked
would be detrimental to the image and reputation. The internet was beginning to
spread its wings reaching out to residential customers, the browser wars had
just begun, electronic commerce was yet to reach irrational valuations, and information
leakage or protection was not on the radar of many enterprises.
There were no USB connectors or drives, internet connections
were rationed and capacity low, email the primary mode of information
dissemination apart from paper. Separation of Information Security & Risk
into an independent entity was a big pioneering step forward. The new team
started with creation of dos and don’ts for users that culminated into a set of
policies. In a hierarchical world moving up the ladder, the stringent policies
became liberal as you look upwards for the convenience of senior executives.
Then came the noise and requests for exceptions citing
business need and impact with the newly imposed controls; function heads
authorized the leniency thereby rendering policies significantly compromised in
intent and execution. New threats that were perceived to be largely external
were intercepted and addressed, internal exceptions however stayed and
continued to grow. Companies worked on an acceptable risk internally and with
high levels of trust with senior executives to guard the family jewels.
Fast forward to the current world of heightened awareness
and impact from information leakage and cyber threats, is the scenario any
different ? Sampling across companies in a cross section of size, industries
and geographies indicate that the information security function now exists in a
majority of enterprises, reporting into the CIO who has also taken on the
mantle to protect the information assets. High maturity and regulated companies
have given security independent charge to the CISO accountable to the
CEO/Board.
Policies have become stringent, implementation rigor higher and
with the availability of a plethora of tools, the ability to monitor better. The
industry has continued to disrupt available solutions with newer, faster,
better, cheaper, painting a scarier picture forcing adoption driven by FUD. Social
engineering has evolved to new levels with multitude of avenues reaching out to
the gullible and the stupid who are willing to give away everything including
personal records that compromise corporate and individual assets.
Most policies are cookie cutter approaches with standard
templates from the consulting companies with some variance by industry; many of
them have statements that put at risk the enterprise and the policy itself. The
implementation too is outsourced to IT companies who provide out of the box
solutions at times with no alignment to industry specifics. Compliance
continues to drive policy creation and intent: to pass the statutory audit, to
ensure that customer audits do not show non-compliance, to help justify budgets
for information security.
Leaving aside an exceptional case of incompetency at the
senior management level within an enterprise, today the awareness and intent to
protect information assets of the company is genuine enough to put pressure on
IT and Information Security professionals. Auditors and regulators have also
gained adequate expertise to go beyond the superficial reports, dashboards or
compliance statements. They are better equipped and have raised the bar for
owners, entrepreneurs, management and the Board.
ISO and other standards based practices and certifications
are mainstream, the cost of information leaks can now be measured in fiscal
terms; wordsmithing to crisply document and disseminate the policies with no
room for ambiguity or misinterpretation has become the baseline expectation. No
exception is the new rule; need to deviate ? Change the policy instead, create
grades and boundaries for execution. It makes life so much easier rather than to
explain why an exception was granted and how was it managed.
Staying compliant is mandatory, protecting information is
necessary, educating stakeholders is a starting point; take steps before a
crisis emerges. Make sure policies are easily understood in intent and
execution; have employees sign off acceptable use policies that define the
boundaries; reinforce with frequent communication; assess, audit and publish
results irrespective of status, success or opportunities to improve; stay
connected to innovators and peers in the industry to benchmark your effort and
stay safe.
But whatever you do or don’t, please don’t create exceptions
to any policy !
No comments:
Post a Comment