Security for the Broken Business

What is the IT securitys responsibility when the business itself is intrinsically secure? The first step may be to point out the obvious.

IT security professionals have recently been talking about the importance of having a seat at the table, that is, a voice in the corporate decision-making process. Ive begun to doubt whether those professionals, or any other members of corporate management, fully appreciate what that seat could mean.
As a discipline, security is about protecting assets of every sort from dangers of every type. But what if... what if a portion of the organization -- or the organization itself, cannot be protected? What is securitys responsibility then?
I was thinking about this recently as I listened to men, even older than myself, talking about the memories of a war long ended. As they discussed battles and action I was reminded of what little military strategy Ive been taught. In strategy, positions and how to defend them are often discussed. In those discussions the hard truth is laid out: Some positions cant be defended.
Through geography or materiel, human resources or munitions, circumstances conspire to make certain positions so vulnerable to attack that there is no workable defense. And in those circumstances theres really only one option. Do not, under any circumstances, allow yourself to be caught in that position.
In business we like to believe that were smart enough and the tools we wield so powerful that any position -- and circumstance -- can be successfully defended. It can be defended if only we apply enough discipline, intelligence, knowledge and technology. But its possible that were wrong.
Lets take a famous example, that of Equifax. Tens of thousands of words have been written looking for
what went wrong
at Equifax. Certainly there were mistakes and errors of process, procedure and action, but its possible that that data would have been compromised at Equifax (or one of its competitors) even if those mistakes had not been made. Why? Because of the indefensible position.
The business in which Equifax finds itself requires vast stores of sensitive, personally identifiable information. Data comes into the system in huge streams and must be accessible, via applications and various products, to customers on a constant basis. It is possible that the business requirements (as the business currently exists) is impossible to truly secure. Todays question is whether there exists a CISO who could rise from their seat at the table and question the basic premise of the business.
I chose Equifax (and, by extension, the whole credit reporting industry) because its very visible and has become hugely important. Its not alone in having some basic qualities that may make it impossible to protect. There are other important industries that share many of the same qualities and its reasonable to ask whether those businesses are so important that any security breaches must be considered a reasonable cost of doing business.
If security is to take its place around the table in the executive suite then security leaders must be ready to talk about the most basic business issues. One of those issues has to be whether the organization has occupied an indefensible position -- and if it has, what to do about the horde rapidly advancing on all fronts.
Related posts:
Equifax Breach Points to Similar Security Concerns – Report
SONIC Quiet on Data Breach Details
Solving the Problems of an Equifax
— Curtis Franklin is the editor of
SecurityNow.com
. Follow him on Twitter
@kg4gwa
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Security for the Broken Business