Future of IA and IA - Information Assurance Architecture - page 374

14.3.2.4 Pendulum

Business cycles are repetitive on varying timescales, trends are movements more or
less in a distinct direction, and pendulums swing from one predictable end to the
other. One business pendulum swing is whether to build in-house or buy externally.
A more recent pendulum involves managed security service providers (MSSPs) ver-
sus performing security in-house. The current complexity of security is causing
focus on MSSP solutions. With complexity reduction through COTS and other
in-house configurable solutions, the pendulum is likely to swing back to in-house
for mid-range companies (less expensive in-house solutions); larger, distributed
organizations are likely to stay with outsourcers to take advantage of their cost
effectiveness due to economies of scale.
Many MSSPs use off-shoring to reduce labor costs for MSS operations. Off-
shoring uses foreign workers; foreign is a relative term applicable to any country.
Consider the risk and cost benefits of trusting the security of your organization to
foreign nationals whose best interests may not include your organization's success
or the success of your country. The prediction is that growing awareness of this,
heightened by security incidents that negatively affect business performance and
national interests, will push the security field to the top percentiles of the domestic
service industry.

14.3.2.5 Patterns

Going the way of industrial technology, the telephone, and fax machine, comput-
ing technology is no longer new and novel, but a business tool to provide support
for business operations. IA superimposes operational restrictions on technology to
provide secure business operations. There will be an increasing need to formally
align technology and security with business operations for many reasons, including
compliance management (i.e., align operations with legislative requirements), and
to justify technical and security infrastructure as part of ROI justification as both
an initial investment and ongoing operations.

14.3.2.6 Connections

Event relationships provide insight into event occurrence, with one event caus-
ing or predicting another. If we assume event A has some relation to event B,
the following provide some insights regarding the potential relationship between
them:

n Causal—The relation between cause and effect; a predictable result or flow

from one action or event (A) to the next (B); an occurrence of event A causes
the occurrence of event B.