Security Mistakes: Technology or Behavior?Security Mistakes: Technology or Behavior?

Enterprises have many considerations to make when evaluating their security standings – technical, organizational, and behavioral.

Security is an ongoing battle for every organization. Whatever you do to secure your infrastructure and data, there will always be someone depending on organizational behavior to have some security weak points and using new tools to attack.

Attitudes about security can be enabling or retarding security development and implementation. Security is more than the technology applied to ensure things are secure. Security is also how the organization envisions security and its place in the business processes.

Love That New Technology
Looking for the best product or service is looking at a transitioning solution -- whatever is best now may not be best next week. Technical solutions are not the only solutions. Those marketing their products and services will dwell on the latest security issues and how their technology solutions mitigate the problems. But focusing on new technology can lead an organization to bypass, ignore, or miss other pertinent security issues. The latest technology cannot correct the behavior and improve the policies that may be the root cause of the security problems.

A few questions to consider are:

Distrust That New Technology
The opposite behavioral problem can occur when IT implements a new technology that interferes with smooth business processes. This can become common when the new technologies impose restrictions or extra effort on the users and the organization's customers. Is the security staff inclined to say no to anything new that would require new security solutions? This behavior can actually backfire since users may develop work-arounds that satisfy their requirements but do not adhere to the organization's security requirements.

Points to consider include:

A good approach is to avoid forcing updates with little regard for the user's productivity.

Focus on the User and Business, Not Technology
Security is there to protect the organization, its staff, and customers. It can be easy for those in charge of security to place their requirements before those of the organization. This attitude can foster the creation of goals that do not improve the operation of the organization. The security goals may actually weaken security, cause CAPEX and OPEX expenditures that are not beneficial, and alienate the users. It can be quite easy for the business and security requirements and implementation to become misaligned.

Actions worth considering are:

Beware the Checklist
Many vendors prepare checklists that the organization can use to evaluate itself. The checklist can be valuable but should not be considered the final answer. Anyone who prepares the checklist will focus on what they know and can miss important considerations. Once the checklist is published, there will continue to be additions that are warranted but the checklist may not be properly updated. The danger in this is that an organization can perhaps mistakenly believe they have done a good job implementing security because they have satisfied all the checklist items.

Consider:

Organizing Security Management
There will be someone in the organization who looks at security as a risk management situation. IT will most likely not report up through the risk management executive. Therefore, risk management and IT staffs can often have an uncooperative relationship, and may not collaborate effectively.

As viewed by IT, risk management is a business issue, not a technical issue. The end result can be either an over-engineered implementation with an associated high cost or an under-engineered implementation that leaves the organization vulnerable.

Further, there can be internal problems within IT that complicate security management. One example would be a lack of collaboration that leads the network staff to implement solutions that are redundant with those implemented by the security staff.

Because of the disconnect between IT and risk management goals, as well as the potential for inconsistencies between network and endpoint security, one idea to consider is whether the chief information security officer (CISO) should be under the CIO.

Policy Management Unfocused
There will always be changes in IT systems, networks, applications, and data. How an organization deals with the changes and continues to implement security measures is just as important as the initial implementation of the security solutions.

When working to optimize your organization's security approach, consider:

There is a weakness in this blog: This post is itself a form of checklist, which I cautioned you to beware of earlier. But these considerations are presented as such to expose some of the issues involved with security. If you like checklists as a tool, then my advice would be to look for as many checklists as possible and combine them together. But don't consider your work done – because even then, the resulting checklist can have gaps.

Gary Audin will be speaking at the Enterprise Connect Orlando 2015 conference, taking place March 16 to 19 in Orlando, in the session, "Right-Sizing Your SIP Trunking Procurement," on Wednesday, March 18, at 3:45 p.m. If you haven't yet registered, do so now using the code NJSPEAKER and receive $300 off an event pass.