When you are building an Information Security practice you need a solid governance structure in place. For those of you who might not be familiar we can look at it a more accessible way. If you are building a house you need a solid foundation otherwise the thing will collapse.
Much in the same vein, if you do not have a solid set of policies, you are destined to fail.
All is not lost as there are all sorts of resources that are available to help you online. The key point to remember is that with anything you find should never be used verbatim. If you cut and paste a policy you find online and swap the letterhead you should just hang up your tin star now. Do not pass go. Do not collect $200.
Why? Well, let’s cut to the chase. No company is the same as the next. You would be doing yourself and your organization a disservice if you are to maintain this perspective. OK, so if you are maintaining the idea that because you work at Bank A and Bob has a job in governance at Bank B that you will not be able to take their policy and simply use it at your own. Realistically you will need to tailor any policy to your own environment.
If you don’t have a proper governance structure in place it can cause you some angst. As an example, how can you remove an employee who is surfing porn on the Internet if you have no framework in place to deal with such an action? That is the simplest example that comes to mind.
To spin it differently, there was a shop that I worked for at which I was told that I could not use a certain piece of software. It was a fairly benign software application so, I couldn’t help but to ask why. Now, bearing in mind I had no argument with being told no. I was just interested in knowing what the rationale was for that decision. The answer I received was, “because $group said no.”
What?
I asked the unforgivable question. I said, “OK, can I see the documentation regarding that decision? I just want to better understand why.” I was greeted with a Jedi hand wave. This isn’t OK. If you don’t have things documented then they do not exist. Pure and simple.
So, when you are tackling the policies for your organization be sure to go beyond the flaming sword of justice approach to governance. It is simply a dead method for dealing with the foundation for your security program. You want to facilitate the business in a safe and secure way to ensure that security is not the “road block” of old while saving the organization from itself.
When you create your policy documents make sure that they receive reviews from senior leadership, legal and human resources departments. Failing to do so will limit the veracity and adoption of a policy.
If you do not communicate your policies within your organization, how can you expect people to abide by them? Communication is a mainstay of any governance program. Go forth and bring the positive word of security to the masses.
If an information security policy falls in the corporate forest…does anyone read it?
Originally posted on CSO Online by me.
