Doing The “Right” Thing

By Joe Knape

The focus of The Security Catalyst is “Changing the way people protect information.”

Despite the deep respect I have for Michael, I’m skeptical that can be done. Before we can change the way people are protecting information we have to get them to protect it in the first place.

My experience of the last 15 years or so has caused me to come to the conclusion that people don’t want to protect the information they are responsible for. Sure, one hears a lot of talk about frameworks and strategies and processes and I see and have helped to implement some clever, and some not so clever, technologies and point solutions, but it is rare indeed that I have seen individual information security professionals, much less entire groups or organizations, proceed like they actually want to protect the information.

 We all know what we should be doing to protect the “important” information. We don’t do it because it might be hard or it might take a lot of time or money or resources (debatable but I’m thinking like an accountant) or it might upset someone else in the company. What I’m saying is, the “right thing” may not be easy, but it is always the right thing. You want to protect your information? You want to protect my information, or my mom’s, or my brother’s or whoever else’s? Because, honestly, the information you’re responsible for isn’t really yours, it is your customers’ and your customers’ are your friends, your neighbors, maybe even your family. Maybe by putting a face on the information you will be motivated to do the “right thing” no matter how hard you think it is or how much pressure you might get from the powers that be. 

So what is this right thing? Simple:

1. Identify what is considered “important” information to your company. Is it customer data, sales leads, intellectual property, etc.?,
2. Find ALL of your “important” information. Search every laptop, desktop, server, and database,
3. If the data doesn’t absolutely need to be where you found it, scrub it; if it does need to be there figure out a way to keep it safe and do it; encrypt it, anonymize it, put it in one or two central locations to be accessed “online” only, I don’t care.

Again, none of the above is “rocket science” and some of it may be extremely difficult, but it is RIGHT. So I ask you, for my sake, and the sake of my mom and dad, my brothers, and my friends, stop doing the easy thing and start doing “the right thing”.

 

Note from Michael Santarcangelo: for a complete answer to this challenge and more insights on how to successfully address this change, please read Into the Breach.