Humans in Information Security

People have a lot of prejudices when trying to identify the different roles in Information Security for the different position scales in the companies, it is easy to oversimplify the responsibility levels as it is human behavior.

Everybody knows the different issues of IS in any company, actually companies and media has even blown them out of proportion sometimes, it has to do with a combination of creativity and common sense where everything begins:

A typical modern company has the following macro divisions on their workforce:

·         End Users

·         Information Security Officers

·         Top Executives

End users

End users take the brunt of the decisions of both ISO’s and TE’s and are mostly dubbed as the “enemies” of the ISO’s… there is nothing farther from the truth as the people who knows most about the micro management of the company is the End Users!!

They are the people who faces day by day the challenges and attempts of hundreds of wannabe small time criminals who want to obtain information or any kind of advantage from our company.

End Users are our first and best line of defense against information criminals and they deserve the support and training from the Information Officers and Top Executives.

ISO’s have to explain carefully the role of the EU’s in the security strategy, in this task it is imperative to keep the explanation in a mildly-technical manner, and this speech has to be simple, to the point and focused in their role, humans tend to lose focus in topics which are perceived as outside their area of expertise.

EU’s have to understand their responsibility on the business process and the potential impact of their actions in their job and the organizations to realize their full potential as partners in the security of the organization.

Information Security Officers

Information Security Officers are called “Good Guys” in the company because they are the rule makers and protectors of the realm, but it can easily become the contrary.

Information Security inside of an organization is a delicate matter as it needs to create a synergy between the business needs, the business process and, well, security.

ISO’s tend to become entrenched in the last factor only, they tend to become a “NO” man, which doesn’t go too far from becoming an obstacle for the company.

The primary task of an ISO is to listen to the needs of the business with the Top Executives, then listen to the way it is currently executed by the End Users and basically create a Security Strategy using a combination of both point of views.

The second task of the ISO is assuring this strategy will not hinder EU’s while covering TE’s objectives, this part can be done by designing and/or implementing tools and procedures with the EU’s.

The responsibility of the ISO is to protect the business, not only the information but the business too and this means protecting the way it is done too.

Top Executives

Top Executives are very important for the company as they define the macro operations of the organization, they help to design the security strategy and must help to enforce it by using their skills to create a culture out of this strategy.

TE’s tend to forget this second part and stay in a passive role, thinking that after issuing the order the responsibility is exclusive to the ISO, but the company’s security is not as simple.

ISO’s by definition cannot change business procedures as required by the strategy as this is a TE function, so the TE’s have to be involved on every adjustment to the business processes.

ISO’s have to explain their role and the implications of it to the TE’s so it is imperative for it to be described in a business language and be very careful with the technical language involved, as previously stated it is common in human beings to ignore ideas unclear or not perceived as part of their expertise.

Conclusion

In the matter of security an organization cannot leave its responsibility and execution in hands of one individual, it is a work for all echelons in the business to develop a security culture which will protect its employees and their jobs.

Security is not a new field but it is one of the less developed and new threats on new business fields are forcing a due sophistication on its method which calls for all disciplines to embrace new ways to get the job done without giving away our hard work to petty criminals