CIO Insight have run a survey amongst CIO's about their attitudes to security. While I'm not sure how much should be put on these kinds of surveys there are a few interesting items:
Sixty-five percent of respondents said they'd met with senior executives during the past 12 months to discuss security. And 74 percent said their colleagues understood the concerns raised and seemed willing to make changes to business practices to make their companies more secure.
Still, a full 30 percent of CIOs said those same business executives forced their CIOs to cancel planned changes to business practices to ensure better security after receiving complaints from business units or end users. [CIO Insight] via [Security Focus]
So Senior Execs are not yet taking security very serious. Thats not really news, but it's interesting to see a study confirming it. To be fair though , it is very easy for us Security Professionals to blame the business side for not wanting to make changes, but it really is our responsibility to educate not only Senior Management, but also the users of our systems and networks about the importance of security.
Many traditional security measures do literally make the job of the business side harder. Access tools are extremely cumbersome and non userfriendly and while company firewalls do stop a lot of bad attacks, they can also create technical barrers for employees and business groups to interact in less formall ways with customers and business partners.
The solution as I see it is to make individual applications or application subsystems secure in their own right. An internal trading or back office system should be at least as secure to the internal network as a online personal banking system has to be on the public internet. By taking care when we develop and deploy these apps and working with our users on good day to day security procedures, the complaints from our users are likely to be reduced quite strongly while improving the overall security of the organisation.
6:33:14 PM  comment []
|
