OPERATIONAL SECURITY OF UBIQUITOUS INFORMATION - Cyberwar-Netwar: Security in the Information Age - page 97

here is learning. The enterprise in the end has to learn what is risk and what is value.
The problem is to do it in real-time, so the faster it goes the better it can be managed. It
is, in fact, as important for other subjects such as strategy and operations as it is for
security. In the end you have to adopt a competitive intelligence approach that allows
you to learn. Risk is involved but the risk that you take regarding an enterprise that does
not use any framework or a less than perfect framework is much lower so you can
manage it better. The risk of exposure is lower, you become more efficient and in the
end you gain. The idea of competitive intelligence is to use intelligence. Normally we
think of intelligence as espionage, but intelligence is ethical; it can and should be used.
We say it is competitive because intelligence in enterprise might be thought of as
espionage. My belief is that these techniques should be used to evolve knowledge. You
may have to start from scratch but after a year or two you will learn what is happening in
the world around you and you can keep your blind spots on the low side. There is a topic
by an Israeli, Ben Gilad called “Tackling blind spots”, where he states that if you do not
have intelligence to see ahead, you have a big blind spot beside you and you can have a
competitor entering. For strategy this is important and I would argue that for security it
is also important. If you can keep your blind spots to the minimum, you could hopefully
prevent an incident such as the collapse of the Twin Towers in New York. That was a
big blind spot.
Handy : I have to complement this. One of the things we discovered goes as far back
as 1993. In the US, as we were downsizing our military, a lot of our intelligence analysts
found that they were very marketable on Wall Street because they used the same analyses
and assessment tools to figure out how the markets were going to go up or down, and
more importantly where the lucrative economic areas were. So it is not necessarily
covertly gathering information from competitors, as much as it is looking at the cultural
trends and different regions of the country or of the world and taking that information
and figuring out how best to market our products, where to market them and where to
invest. So I think you are on target.
Amaral : Because you are already linking security with financial systems, I believe
you should use the same models because we need value to make decisions.
Erez : A workshop can be one form of education. In Israel we have a lot of
workshops, connecting people from various organisations, in order to try to educate
them. One of our advantages is that many people who are heads of various organisations
come from a military-related background. Everyone has some sense of security, but for
me, in the end it comes down to human beings. You can have all the technical measures,
but if you do not understand the signals, or you misinterpret them, nothing will happen at
the end of the road. One very famous advertisement that I am always reminded of when I
speak on this subject is from a company producing steel doors for homes to prevent
thieves from entering and their slogan was always “Buy me before!” It had been found
that almost everyone only bought these doors after a break-in.
Amaral : I do not believe that you can manage this at a national level. I do not think,
at least in Portugal, that we will be able to do this, but we are not talking about
knowledge, we are talking about learning and learning management. Knowledge
management is starting, but learning management does not yet exist, but it will. There is