Thursday, September 07, 2006

Mike Rothman Is Right

Mike Rothman is right:

I'm here at the Security Standard conference and I'm seeing the pendulum starting to swing back. What pendulum? The pendulum that swings like a metronome between security as a defense and security as an enabler...

I'll make it very very clear. Security is not a business enabler. It is a cost of doing business. You cannot do new things because of security. You do open up new revenue streams and add value to customers via new applications that reflect new (or updated) business processes. It may be ill advised to put these new business processes on the web without adequate security, but you CAN do it.


In extreme cases of incredible negligence or outright stupidity, a business may deploy an exceptionally insecure application or business process that must be shut down due to overwhelming fraud and theft. Barring those circumstances, however, I agree that businesses are willing to "put these new business processes on the web without adequate security" and suck up some level of "acceptable loss."

Richard Stiennon agrees:

My perspective is that treating IT security like a business process is like treating a tactical military strike force as a business. While maintaining the capability of military forces could be a process open for improvement by applying some business discipline, actually fighting battles and overcoming opposing forces does not have much of the "business process" about it. Security is much more akin to fighting a battle than it is to "aligning business objectives".

Hopefully someone at this conference will address security as a cost, like insurance or legal teams.

5 comments:

Kenneth F. Belva said...

Mr. Sam Dekay and I published a paper on security enablement in late August.

http://www.securityfocus.com/archive/1/444735/30/0/threaded

http://www.ftusecurity.com/pub/VT-belva-dekay-final.pdf

Sincerely,
Kenneth F. Belva, CISSP

LonerVamp said...

I also think security is not a business enabler. And it is that same reason why coding is not necessarily secure by default. Security is a cost (unless your industry is in providing security, I guess). Think of the security guard for the building. Does his presence generate any revenue? Not for your typical business.

It is a tough distinction to make. Security can (will) prevent loss of business, but it, in and of itself, does not raise revenues. Marketing will always say otherwise, that someone chose the company because they meet a security standard they require, but really, security just prevented their lack of choosing you (i.e. going elsewhere).

Back to my coding example, it costs money in time and energy to code security into most apps. When push comes to shove, every IT person grudgingly knows that functionality will beat out security. Lack of security at deadline time won't necessarily trump just getting the product out. Security is a cost there, too, not an enabler. Lack of it may reduce revenues, but having it won't increase revenues, by itself.

Brian said...

Where is that half full glass that I have around here? I wonder how much of this position is a reaction to the marketing machines gathered at these conferences and how much is "real"?

I'm on the fence. I think that many, many people still don't trust the Internet. They they don't do any form of electronic banking or commerce. They don't want their personal information on the network.

The problem with that is that we can help a lot of people using networks and the Internet. And many folks are missing out because we can't reach them. We can help them do much more than manage their finances through the wider disemination tools such as specialized portals and medical telematics.

Can we have security and functionality and stilll generate revenue? Sure. But it won't be easy.

Rob Lewis said...

Since surveys have shown a high incidence of people now reluctanct to use the internet for e-commerce and even e-banking now, could it not be said that proof of secure transactions and public confidence, could lead to increased e-commerce activity?

In this case, security would be a business enabler, and the lack of it currently, and the resulting lack of public confidence, is a barrier.

Richard Bejtlich said...

Hi Rob,

You are describing the Road House effect.