Focus On The Human Factor, Security Panel Says

Security experts say the human factor should be the focal point of security governance, not technology

By Kathleen Lau, ComputerWorld Canada

August 04, 2008 — CSO — During a recent panel discussion that drew about 80 information systems professionals, three attendees were found to have unsecured BlackBerries that could be touched via Bluetooth. "These are security experts, mind you," noted panel member Rolf von Roessing, a partner with professional services firm KPMG. His quick scan of BlackBerries in the room was meant to illustrate that the human factor should be the focal point of security governance, not technology. The fact that the majority of device owners -- except those like the three in attendance -- successfully secured their handheld devices shows that the trouble isn't with the technology itself, said von Roessing. "Everyone knows how to use a BlackBerry," he said, "but it's how they use them, how they behave and the little awareness of day-to-day security that is most worrying." IT managers are, he said, "actually frustrated, disappointed with their users." Von Roessing was championing a business model for information security governance, alongside Vernon Poole, head of business consultancy at Sapphire Technologies Inc., and Jo Stewart-Rattray, director of information security at Vectra Corp. The panel discussion was part of the annual ISACA (Information Systems Audit and Control Association) conference this week in Toronto. The model, created by the University of South California's Marshall School of Business, is intended as a tool to sell an information security strategy to the business. The model is composed of a matrix of four key components (organization, people, process, technology) linked by flexible dynamic interconnections (culture, architecture, emergence, enabling and support, governance, human factors). Those interconnections, the panel explained, can change depending on the organization and therefore result in a model of shifting shape. Lack of awareness about security, said von Roessing, "tells us that the people node... is our main focus nowadays." Therefore, information system professionals need to develop what Poole called an "intentional culture" or policies dictating technology use, for instance, that would help ensure a secure corporate environment. Relative to other components of the model, Poole said it takes the longest time to build that culture and eventually close the gap between technology and people, but "that work is absolutely vital." "The main aspect here in terms of human factors is that we're already seeing a lot of security lapses," said Poole. But among the feedback the panel received, some in the audience felt the model assumed an unrealistic top-down approach that attempted to push culture across today's

• Print

• MOBILE SECURITY QUICK TIPS
• How To Protect Your Mobile Data