Focus on the human factor, security panel says

During a recent panel discussion that drew about 80 information systems professionals, three attendees were found to have unsecured BlackBerries that could be touched via Bluetooth.

“These are security experts, mind you,” noted panel member Rolf von Roessing, a partner with professional services firm KPMG. His quick scan of BlackBerries in the room was meant to illustrate that the human factor should be the focal point of security governance, not technology.

The fact that the majority of device owners – except those like the three in attendance – successfully secured their handheld devices shows that the trouble isn’t with the technology itself, said von Roessing. “Everyone knows how to use a BlackBerry,” he said, “but it’s how they use them, how they behave and the little awareness of day-to-day security that is most worrying.”

IT managers are, he said, “actually frustrated, disappointed with their users.”

Von Roessing was championing a business model for information security governance, alongside Vernon Poole, head of business consultancy at Sapphire Technologies Inc., and Jo Stewart-Rattray, director of information security at Vectra Corp.

The panel discussion was part of the annual ISACA (Information Systems Audit and Control Association) conference this week in Toronto.

The model, created by the University of South California’s Marshall School of Business, is intended as a tool to sell an information security strategy to the business.

View a PDF of the model here.

The model is composed of a matrix of four key components (organization, people, process, technology) linked by flexible dynamic interconnections (culture, architecture, emergence, enabling and support, governance, human factors). Those interconnections, the panel explained, can change depending on the organization and therefore result in a model of shifting shape.

Lack of awareness about security, said von Roessing, “tells us that the people node… is our main focus nowadays.”

Therefore, information system professionals need to develop what Poole called an “intentional culture” or policies dictating technology use, for instance, that would help ensure a secure corporate environment. Relative to other components of the model, Poole said it takes the longest time to build that culture and eventually close the gap between technology and people, but “that work is absolutely vital.”

“The main aspect here in terms of human factors is that we’re already seeing a lot of security lapses,” said Poole. But among the feedback the panel received, some in the audience felt the model assumed an unrealistic top-down approach that attempted to push culture across today’s decentralized organization.

Poole agreed that the model must be more ecosystem-centric to address the fact that many businesses are engaged in partnering and outsourcing relationships. He noted that the model is still in its infant stages and will be subject to a workgroup of information security professionals whereby it will be ameliorated as seen fit.

Von Roessing added that the model is supposed to be like COBIT (Control Objectives for Information and related Technology) in that it can be differently applied to different organizations and “it allows us to describe everything, but doesn’t regulate everything.”

In its final form, the model will be useful to help the business identify where the cause of publicized security breaches occurred amid the matrix of components and dynamic interconnections, said Stewart-Rattray.

But while the model can be used for reactive analysis, Stewart-Rattray doesn’t bar the possibility of selling it to the business as a predictive tool moving forward.

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Cybersecurity in 2024: Priorities and challenges for Canadian organizations 

By Derek Manky As predictions for 2024 point to the continued expansion...

Survey shows generative AI is a top priority for Canadian corporate leaders.

Leaders are devoting significant budget to generative AI for 2024 Canadian corporate...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now