Previously I'd said that a good, practical definition of information security is to prevent and detect unauthorized access. That definition is fine, but it doesn't address why a business would be interested in pursuing an information security program. In my view, there are two primary reasons: a good information security program can help control costs and add value.
Control costs
Unauthorized access leads to disruptions and disruptions cost money. The unauthorized access might directly disrupt business, worm and virus infections that crash workstations are good examples, or the results from the unauthorized access might be disruptive, such as when trade secrets or product development plans are stolen. As a result, the business wants information security to keep such disruptions to an appropriately low level.
Of course, the business would be perfectly happy if information security eradicated all unauthorized access. Unfortunately, not only is this an impossible task, the closer you get to such a goal, the more difficult it is to do business. Disruptions due to security processes can quickly become greater than the disruptions from the unauthorized access. So the business instead tasks information security with keeping disruptions at an acceptable level.
When operating to control costs, an information security team manages processes aimed at increasing the difficulty of gaining unauthorized access (prevention) and decreasing the damage potential of unauthorized access (detection). I feel that detection naturally includes response--if you detect something, you investigate and respond--but I've talked to others who feel that response should be an explicit part of the information security mandate. If your organization falls into that category, it's easy enough to alter the definition: prevent, detect, and respond to unauthorized access.
An effective information security program must be founded on frank discussions between the business and information security on the disruption unauthorized access would cause and the disruption security controls and processes would introduce. Those discussions should focus on identifying relevant disruptions and figuring out how they can be measured. Once you can measure disruption, you can work on defining acceptable levels of disruption. And from there you're well on your way to an information security program that the business backs because it produces a measurable control of costs.
A later post will explore how an information security program can add value.
Comments