In my earlier years an important influence in life would occasionally tell me that I was doing things "bass ackwards" when I was trying to perform some logical sequence of tasks out of order. Whether I was learning to drive a stick shift (to this day the clutch still dumfounds me) or assemble something by the instructions – the phrase was, although a little off-color, completely apropos.

As I work with customers across a wide spectrum of IT regulated industries I continually ask myself – are vendors doing a disservice to organizations by telling them they can meet a regulation if they implement a specific network or security technology or control? I often question the integrity of a vendor when I read a promise of "compliance" with the implementation of this product or that service. From years of supporting IT projects, it's just not that easy, and applying a specific technology to deliver compliance is, in my humble opinion, “bass ackwards.”

Over the years I've learned a more effective and logical approach to IT security is to have a well thought out and obtainable security program that optimizes the use of people, process and technology and that improves over time. From what I've seen, this approach results in a more secure network and almost guarantees regulatory compliance. Building IT security requires an integrated effort across the entire organization and the ability to leverage multiple best-of-breed solutions.

A difficult challenge for many IT teams is that they suffer from varying degrees of organizational segmentation where functional teams do not cooperate effectively. I can't tell you how many times I've worked with companies where the security group has said "we can't do that because the network group won't let us do this." Or, the network group says "we can't do that because the server group won't let us do that."

I understand the need to segment the organization along specific functional lines; unfortunately, when developing an IT security management strategy it is important for all teams to work closely together and to leverage each others expertise as required by the defined security objectives. Over the past few years there has been much debate around whether network and security operation teams will converge. I don't think there's a right answer to the question; however, the common thought amongst many analysts is that a successful IT security program requires effective collaboration amongst all the groups that deliver any IT based service.