Synopsis

The article looks at options for reducing the costs of implementing security standards and the factors which affect corporate decisions to invest in security.  It suggests that a structured, incremental application of security against an objective, rather than subjective, standard would offer greater incentive and value for money.

How can effective security be delivered when constrained by budget or management reluctance to invest?

Whenever information security is mentioned within most organisations there is a collective groan; the board don’t want to engage, staff don’t want to be encumbered and the IT department sometimes lack the guidance to implement anything effective.  From a security professional’s perspective the most disappointing factor is the board’s unwillingness to participate in this vital part of their business.  Information security is often perceived as a disabler or an unnecessary expense which in turn dissuades business leaders from proper and necessary involvement.  Neither perception is correct; security is not a product it’s a process and can be tailored to meet budget and business need - providing its implementation is proportionate, structured and fully supported by senior management.  Often, the assumption is that protection is only delivered by wholesale security throughout all aspects of the business, so organisations take a chance on never being attacked, preferring no security to the effort required to deliver what they understand as security.

Information is one of an organisation’s biggest assets, comprising the entire business output or the majority of its support.  Without information most businesses are paralysed, resulting in immediate or gradual decline and eventual closure.  It is therefore imperative that all businesses regardless of their size or their specific output implement information security measures commensurate with the impact of data loss on their ability to continue trading.  Security must be proportional since imbedding effective security practices within a business requires effort to implement and maintain, and this effort needs support from the very top of the organisation.  Effectiveness of security needs to be judged and agreed as meeting a standard if the measures are to have any meaning outside the organisation.  Traditionally, this has not been cheap, especially since information security entrusts the majority of the protection effort in technology, and the most frequently adopted standards are expensive to implement and subjective in their validation.  Subjectivity introduces an element of chance that investment will not result in certification, which fosters a culture of over-engineered implementation and added expense.

Synopsis

Debates the difference between errors and mistakes and offers directed security education as a solution, albeit one that is a panacea.  It offers the pragmatic view that humans make errors and we simply have to deal with the consequences and limit their effects since we cannot prevent their occurrence.

Oscar Wilde took the view, “Experience is simply the name we give our mistakes.”  Although Wilde lived in a time when mistakes had consequences that were rarely as far-reaching as they are in the modern globalised world it is perhaps heartening to know that since humans clearly make mistakes we should therefore be growing in experience.  In one perspective of the world, humans have been making errors almost since the time of their creation.  But there is a difference between a mistake and an error; one which even teachers are often prompted to question if my research is anything to go by.  However, I am drawn to this particular explanation:  “A mistake is a wrong response that, if thought about, you would realize is wrong. An error is a wrong response because you have no knowledge about what the correct response is.

In a nutshell, you make errors because you don't know any better, and mistakes you make despite the fact that you know better.  Pilots in the RAF use the term “switchpigs” to explain situations where the wrong button is pressed or an incorrect switch selection is made despite the operator being perfectly aware of what the correct action should have been.  Officially, the RAF uses a term we all probably understand; “Cognitive Failure.”  This cognitive failure is what allows the brain to guide our hand to select ‘send’ on our e-mail client when we knew that what we should have done is click ‘save’ whilst we deliberated on the wisdom of sending an e-mail criticising our boss.  So if we are to stand by the previous explanation of what constitutes an error, rather than a mistake, we must take it that human error in IT security terms is the result of a lack of knowledge.  But a lack of knowledge about what?  Not the operation of the IT or how the equipment works surely.  I suspect, and many will doubtless agree, the true foundation of human error is the lack of understanding, or knowledge if you prefer, of the implications of their actions.