During a recent panel discussion that drew about 80 information systems professionals, three attendees were found to have unsecured BlackBerries that could be touched via Bluetooth.
“These are security experts, mind you,” noted panel member Rolf von Roessing, a partner with professional services firm KPMG. His quick scan of BlackBerries in the room was meant to illustrate that the human factor should be the focal point of security governance, not technology.
The fact that the majority of device owners – except those like the three in attendance – successfully secured their handheld devices shows that the trouble isn’t with the technology itself, said von Roessing. “Everyone knows how to use a BlackBerry,” he said, “but it’s how they use them, how they behave and the little awareness of day-to-day security that is most worrying.”
IT managers are, he said, “actually frustrated, disappointed with their users.”
Von Roessing was championing a business model for information security governance, alongside Vernon Poole, head of business consultancy at Sapphire Technologies Inc., and Jo Stewart-Rattray, director of information security at Vectra Corp.
The panel discussion was part of the annual ISACA (Information Systems Audit and Control Association) conference this week in Toronto.
The model, created by the University of South California‘s Marshall School of Business, is is intended as a tool to sell an information security strategy to the business.
The model is composed of a matrix of four key components (organization, people, process, technology) linked by flexible dynamic interconnections (culture, architecture, emergence, enabling and support, governance, human factors). Those interconnections, the panel explained, can change depending on the organization and therefore result in a model of shifting shape.
Lack of awareness about security, said von Roessing, “tells us that the people node… is our main focus nowadays.”
Therefore, information system professionals need to develop what Poole called an “intentional culture” or policies dictating technology use, for instance, that would help ensure a secure corporate environment. Relative to other components of the model, Poole said it takes the longest time to build that culture and eventually close the gap between technology and people, but “that work is absolutely vital.”
“The main aspect here in terms of human factors is that we’re already seeing a lot of security lapses,” said Poole. But among the feedback the panel received, some in the audience felt the model assumed an unrealistic top-down approach that attempted to push culture across today’s decentralized organization.
Poole agreed that the model must be more ecosystem-centric to address the fact that many businesses are engaged in partnering and outsourcing relationships. He noted that the model is still in its infant stages and will be subject to a workgroup of information security professionals whereby it will be ameliorated as seen fit.
Von Roessing added that the model is supposed to be like COBIT (Control Objectives for Information and related Technology) in that it can be differently applied to different organizations and “it allows us to describe everything, but doesn’t regulate everything.”
In its final form, the model will be useful to help the business identify where the cause of publicized security breaches occurred amid the matrix of components and dynamic interconnections, said Stewart-Rattray.
But while the model can be used for reactive analysis, Stewart-Rattray doesn’t bar the possibility of selling it to the business as a predictive tool moving forward.