I wrote about information security as cost control mechanism in an earlier post. This post looks at using information security as a way to add value to the business.
Your customers and business partners want assurance that you are keeping the information and services that they've entrusted into your care safe from unauthorized access. In an environment of identity theft and stolen data, this assurance is valuable. All other things being equal, the business providing the better assurance is more likely to get the customer.
To capture this value, the information security team is going to have to go after polish. The base activities will likely be the same--the team is still out to prevent and detect unauthorized access--but now those activities will have to be refined and honed to a point where they are presentable.
The type of polish depends on the business. For some, white papers describing security features and vetting procedures will be appropriate. For others, tours of security operation centers and meetings that include information security folks will work better. An especially effective approach is to demonstrate thought leadership in security relevant to your business. Microsoft is doing an excellent job in this area. The goal is to polish your security processes until they shine, and then present them to your customers so that they can admire that shine.
Of course, you should not make promises you can not keep or claim security processes that you don't actually follow. The FTC is watching for these sorts of misleading statements and has successfully pursued legal action in several cases.
The decision to pursue a value-add approach needs to be carefully considered. Every dollar you spend on polishing your security beyond the point where it is acceptably functional is a dollar that could've been spent on something else. Will a dollar's worth of polish capture an additional dollar in sales or prevent a dollar from going to a competitor?
Each business will need to determine how sensitive their customers and partners are to security gradations. My suspicion is that initially a little goes a long way, but you soon reach a point where additional effort at security polish does not lead to appreciable increases in feelings of assurance.
Extracting value from an information security program is still fairly new and unproven, but more and more customers and partners are looking for assurance. I've seen plenty of contracts where security requirements have been explicitly baked into the agreement. Many regulations require that organizations ensure that their vendors provide appropriate security. The writing seems to be on the wall--we'll see if it fades or becomes bolder.