Security is a Balancing Act

by Kent Strickland

If you are an ounce of prevention type, you tend to think more strategically.  When you see opportunities, you clear obstacles to ensure success and preserve critical resources.  As part of your routine planning involving information technology, you attempt to manage risk to acceptable levels by seeking current information on security vulnerabilities and threats.  You are also more likely to identify measures of success when setting goals, and to later evaluate how you did.  You must be able to determine when you reach a point of diminishing returns. 

Information Security provides awareness information, advice, and vulnerability and threat assessment services for decision support.

If you are an easy to see type, you might tend to think more tactically and react quicker.  Planning is difficult or appears wasteful and time consuming, and you quickly identify short-term solutions to problems and move on.  You know that not everything can be foreseen, that there is no point in planning for unlikely events, and have therefore learned to rely on your ability or your organization’s ability to recover from unplanned problems.  High productivity is important. 

Information Security provides incident response, investigations, alerts, forensic analysis and monitoring to help recover from the unforeseen.

What happens when the environment is highly dynamic, with overwhelming rapid change as with information technology?

The ounce of prevention types could slow things down or become bogged down in planning, even suffering from paralysis by analysis.  Common sense lags well behind rapid changes and the easy to see types might find themselves very busy but “rearranging deck chairs on the Titanic.”  Organizational stress is inevitable.  The security and privacy of information is at high risk on the one hand, competitive edge and service satisfaction on the other.

Read the news.  Significant competition and technology change.  Tight resources.  Information exposures.  Identify theft.  Regulations.  Lawsuits.  Criminal prosecutions.  Apprehension.  Anxiety using the Internet.

Considering the environment today, which of the two mindsets—or in what mix or configuration—will provide the best approach to protecting information and remaining competitive?  What about when the environment is more static?

A number of regulations now require the use of risk management practices for a reason.  Choose a process that is effective and efficient strategically and tactically.  Security is a balancing act and there is a time for everything.  Risk management practices should be your guide.  For more information, visit www.bgsu.edu/infosec.

-Kent Strickland

Information Security Officer, ITS