Untitled Document
In my earlier years an important influence in life would occasionally tell
me that I was doing things "bass ackwards" when I was trying to perform
some logical sequence of tasks out of order. Whether I was learning to drive
a stick shift (to this day the clutch still dumfounds me) or assemble something
by the instructions the phrase was, although a little off-color, completely
apropos.
As I work with customers across a wide spectrum of IT regulated industries
I continually ask myself are vendors doing a disservice to organizations
by telling them they can meet a regulation if they implement a specific network
or security technology or control? I often question the integrity of a vendor
when I read a promise of "compliance" with the implementation of this
product or that service. From years of supporting IT projects, it's just not
that easy, and applying a specific technology to deliver compliance is, in my
humble opinion, bass ackwards.
Over the years I've learned a more effective and logical approach to IT security
is to have a well thought out and obtainable security program that optimizes
the use of people, process and technology and that improves over time. From
what I've seen, this approach results in a more secure network and almost guarantees
regulatory compliance. Building IT security requires an integrated effort across
the entire organization and the ability to leverage multiple best-of-breed solutions.
A difficult challenge for many IT teams is that they suffer from varying degrees
of organizational segmentation where functional teams do not cooperate effectively.
I can't tell you how many times I've worked with companies where the security
group has said "we can't do that because the network group won't let us
do this." Or, the network group says "we can't do that because the
server group won't let us do that."
I understand the need to segment the organization along specific functional
lines; unfortunately, when developing an IT security management strategy it
is important for all teams to work closely together and to leverage each others
expertise as required by the defined security objectives. Over the past few
years there has been much debate around whether network and security operation
teams will converge. I don't think there's a right answer to the question; however,
the common thought amongst many analysts is that a successful IT security program
requires effective collaboration amongst all the groups that deliver any IT
based service.
1