Information Technology Reference
In-Depth Information
need to make a business case for them also, especially if they sense
potential risks in the system.
How much should one invest in security improvement and for what
returns? For some businesses it may be possible to recoup some of the
investment to get a marketing or competitive advantage by drawing
attention to its security investments. Designers must advise customers that
increased security, while essential, can affect some other business metric
such as performance or throughput, as can be seen in the case of increased
security for air travel. A healthy balance may emerge through trial and
error as customers appreciate the need for security and accept some
“inconvenience” while businesses start embedding security as part of their
normal deliverables and learn to absorb the associated costs.
Security Needs to Protect the Right Thing
While everyone agrees that it is imperative to protect things that are
important, sometimes organizations end up protecting the wrong thing.
There could be a number of reasons why such mistakes occur, the most
critical being a faulty prioritization process. It is good to have guidelines
that bring some objectivity into the prioritization process, because every
department considers its applications and data to be of critical importance
(Figure 16.6).
One should avoid getting caught in a circular argument about priori-
tization: “we give priority to things that are important, things with higher
priority are important.” Sometimes applications are classified based on
different needs that have little to do with security. An application might
be classified as a “Class A” or “Tier 1” application from a support or
downtime point of view. Such classifications may not be relevant from a
security point of view. Most applications classified as high or strategic are
likely the ones that the company would like to allocate security resources
Security needs to protect the right thing
Figure 16.6
Protect the important things first
.
