Mike Rothman Is Right
Mike Rothman is right:
I'm here at the Security Standard conference and I'm seeing the pendulum starting to swing back. What pendulum? The pendulum that swings like a metronome between security as a defense and security as an enabler...
I'll make it very very clear. Security is not a business enabler. It is a cost of doing business. You cannot do new things because of security. You do open up new revenue streams and add value to customers via new applications that reflect new (or updated) business processes. It may be ill advised to put these new business processes on the web without adequate security, but you CAN do it.
In extreme cases of incredible negligence or outright stupidity, a business may deploy an exceptionally insecure application or business process that must be shut down due to overwhelming fraud and theft. Barring those circumstances, however, I agree that businesses are willing to "put these new business processes on the web without adequate security" and suck up some level of "acceptable loss."
Richard Stiennon agrees:
My perspective is that treating IT security like a business process is like treating a tactical military strike force as a business. While maintaining the capability of military forces could be a process open for improvement by applying some business discipline, actually fighting battles and overcoming opposing forces does not have much of the "business process" about it. Security is much more akin to fighting a battle than it is to "aligning business objectives".
Hopefully someone at this conference will address security as a cost, like insurance or legal teams.
I'm here at the Security Standard conference and I'm seeing the pendulum starting to swing back. What pendulum? The pendulum that swings like a metronome between security as a defense and security as an enabler...
I'll make it very very clear. Security is not a business enabler. It is a cost of doing business. You cannot do new things because of security. You do open up new revenue streams and add value to customers via new applications that reflect new (or updated) business processes. It may be ill advised to put these new business processes on the web without adequate security, but you CAN do it.
In extreme cases of incredible negligence or outright stupidity, a business may deploy an exceptionally insecure application or business process that must be shut down due to overwhelming fraud and theft. Barring those circumstances, however, I agree that businesses are willing to "put these new business processes on the web without adequate security" and suck up some level of "acceptable loss."
Richard Stiennon agrees:
My perspective is that treating IT security like a business process is like treating a tactical military strike force as a business. While maintaining the capability of military forces could be a process open for improvement by applying some business discipline, actually fighting battles and overcoming opposing forces does not have much of the "business process" about it. Security is much more akin to fighting a battle than it is to "aligning business objectives".
Hopefully someone at this conference will address security as a cost, like insurance or legal teams.
Comments
http://www.securityfocus.com/archive/1/444735/30/0/threaded
http://www.ftusecurity.com/pub/VT-belva-dekay-final.pdf
Sincerely,
Kenneth F. Belva, CISSP
It is a tough distinction to make. Security can (will) prevent loss of business, but it, in and of itself, does not raise revenues. Marketing will always say otherwise, that someone chose the company because they meet a security standard they require, but really, security just prevented their lack of choosing you (i.e. going elsewhere).
Back to my coding example, it costs money in time and energy to code security into most apps. When push comes to shove, every IT person grudgingly knows that functionality will beat out security. Lack of security at deadline time won't necessarily trump just getting the product out. Security is a cost there, too, not an enabler. Lack of it may reduce revenues, but having it won't increase revenues, by itself.
I'm on the fence. I think that many, many people still don't trust the Internet. They they don't do any form of electronic banking or commerce. They don't want their personal information on the network.
The problem with that is that we can help a lot of people using networks and the Internet. And many folks are missing out because we can't reach them. We can help them do much more than manage their finances through the wider disemination tools such as specialized portals and medical telematics.
Can we have security and functionality and stilll generate revenue? Sure. But it won't be easy.
In this case, security would be a business enabler, and the lack of it currently, and the resulting lack of public confidence, is a barrier.
You are describing the Road House effect.