Taking the Security Message to the Suits

[InfoSec News <isn () c4i org>]

http://www.eweek.com/article2/0,4149,1356353,00.asp

By Dennis Fisher 
October 15, 2003   

CHICAGO - Where does the security buck stop? All of the certifications
and training in the world won't make any difference to the security of
corporate networks if senior managers and top executives don't
understand the problems and requirements faced by security
professionals, a consultant and former CIO said in a Wednesday keynote
speech here at the Security Decisions 2003 conference.

"We don't have to make the CISSPs [certified information systems
security professionals] smarter, we need to make the suits less dumb,"  
said Thornton May, a member of the executive education faculty at the
University of California at Los Angeles and a futurist who spends much
of his time speaking with CIOs at large corporations. "Right now, they
just don't understand what the problems are. They're coming out of
business school not knowing that information security is important. We
have to change that."

In order to do that, May said colleges and universities need to do a
better job of instilling in students the importance of security. He
suggested that business school students be required to pass an exam of
their knowledge of safe computing practices.

"We can't continue to barf out uneducated graduates into the world,"  
May said. "We need to make grads pass a safe computing test.  
Otherwise, we're in trouble."

But May didn't let the assembled security professionals in the
audience off the hook, either. May said they need to include
management and executives in discussions about why certain security
technologies are necessary and what benefits they will provide to the
organization. Simply creating a wish list of products and handing it
over to the decision-makers is counterproductive, May argued.

"Nobody likes an expert. You have to give [executives] something to
do," he said.

Michael Rasmussen, an analyst with Forrester Research who spoke after
May, agreed that security professionals need to make it easier for
executives to understand the complexity and challenges of their jobs.

"If you go in there talking about polymorphic buffer overflows and IDS
evasion, you're going to lose them," said Rasmussen, director of
research for information security at Forrester.
 


-
ISN is currently hosted by Attrition.org

To unsubscribe email majordomo () attrition org with 'unsubscribe isn'
in the BODY of the mail.