What Your Director of Information Security Wishes S/He Could Tell You (Part I)
A long title deserves a long post: Information System Security Directors (and Managers) must be adept at balancing corporate policies and business objectives with the ideals of security, and the idealistic security engineers who drive them. The most obvious example is when the Director must discern whether or not to recommend a particular system. Justification should be based on the return on security investment (ROSI) but follow-on discussions will be either to management in terms of costs, or to the technical team for the “cavernous holes it leaves in the infrastructure” as one security engineer put it. If one picks a middle road, one only serves to piss off both camps. When dollars are measured against subjective risks, it is understandable how different experts will come up with different recommendations, ROSI formulae not withstanding. The adroit Director of Security will be prepared to defend his specific position in the face of any management or technical opposition, an...