If you are in information security, are you already known as “Dr. No?”
If you’re not, is this what the head of information security is called in your organization?
Something happened over the course of the past thirty years that turned much of the information security profession into the “Dr. No’s” of the corporate world.
Reminds me of the song “Hit the road Jack” by Ray Charles that went something like “Hit the road Jack, and don’t you come back no more, no more, no more, no more….” A nice version of the song can be found on Youtube at www.youtube.com/watch?v=Q8Tiz6INF7I. This is the reaction many information security professionals run into after another “Dr. No” explanation with the boss.
In fact, the primary words heard from the lips of many security professionals is “You can’t do this”, “You can’t do that”, and other explanations involving the word “No.”
A business unit manager at a large conglomerate once told me, “We just avoid them (the security group in IT) and do what we want.” A CIO and a consumer products company once said, “We have these folks on staff, and I’m scared of them, so we try to minimize their impact on operations.”
We’ve done it to ourselves
A CISO at a large company recently told me and others I was with that when it comes to “Dr. No”, “We’ve done it to ourselves.” His argument is, “we’ve focused only on telling people what they can’t do” and a culture of “what can go wrong, will go wrong”, or the equivalent of Murphy’s laws for the security profession. While it’s okay to be prepared for the possible worst downside risks (that’s after all part of the job, isn’t it?), using this approach for all public communications to the rest of the organization is simply just a three letter acronym: FUD.
And, he’s right. One of the reasons why fear, uncertainty and doubt (FUD) works is that no one wants to be associated with it, but the problem with FUD is that when it’s the only thing people hear, people turn off or ignore the message. And, if it’s the only message that continues to be heard, people turn off and ignore the messenger, which often results in lower budgets and a marginalization of contributions from the security group that could otherwise help organizations improve results and avoid real business risks.
What can you do?
So, what can you do avoid being tagged as a “Dr. No” or dig-out from being seen as “Dr. No?”
Do what this CISO did: tell everyone that worked for him that the word “No” was no longer to be used. Alternatives to using “no” that were acceptable included such phrases as “You can’t do it exactly that way, but you could do it this way”, or “Not exactly but this would be more effective.” The change in language by his staff went a long way to reinforcing a change in approach that signaled a willingness to find acceptable alternatives with those darn users, business owners and stakeholders.
In addition, one of the most critical changes you should consider introducing is to re-frame all conversation about security from “no” and “yes” or “black and white”, to a new conversation involving “trade-offs”, one that put the onus for the business risk decisions back in the hands of the business owners. As in, “You can do this if you like, but here are the consequences of the business decisions. Here are some alternatives, and here are the trade-offs you’ll be making.”
Consequences of changing the culture
We’ve learned from research conducted with thousands of organizations that this risk-benefit trade-off approach is a winning formula being implemented by the organizations with the least unplanned business downtime from IT hiccups; the lowest rates of loss or theft of sensitive information and data; far fewer vulnerabilities in IT networks, systems and applications; and the fewest problems with audit in IT.
It turns out that these same organizations spend more money on information security, in every industry and by organizations of all sizes. In fact, the amount spent on IT by these firms is 3 times higher than all others, and the amount spent on information security is 1.7 times more. And, the reason for higher spending among these organizations is that IT and information security are business-relevant with choices expressed in terms of trade-offs for business owners.
The research also shows that in addition to the small things like the changes in language and approach, changing from Dr. No to a business risk-benefit trade-off culture in IT requires an ability to consistently gather information from people and IT systems, and turn this into relevant insights covering business impact status, trends and forecasts.
Instead of the annual budget challenge of digging-up some information, the frequencies range from daily and weekly, to monthly and quarterly, depending on the type of information being sought. The much more frequent rate of collection is achieved by higher levels of automation to collect, store, analyze, report and communicate the business impacts of using IT.
What’s it going to cost you?
Almost all of the IT and internal auditors I’ve ever talked with will tell you that assessing and dispassionately explaining the status, trends and forecasts of the benefits and risks is an approach that has worked for them. Now maybe it’s time for IT and information security professional to implement the same successful risk-benefit trade-off discussion and culture with business leaders.
The only downside risk or additional cost you’re going to experience is no more “Dr. No” - no more, no more, no more, no more!
See the latest research, “Data Driven Reporting and Communications about IT: Better Results, Less Risk, to learn more at IT Policy Compliance Group.
