Sing it shrdlu
Over at Layer8, shrdlu lays it out there and tells us what it takes to appear to be effective:
In all the initiatives I’ve rolled out in my (checkered) career, the ones that have gotten the most acclaim from my management have always been the ones that were most visible to the users. They turned out to be popular if they:
– were used directly by the users
– allowed the users to do something better, or faster, or better AND more securely
– helped reduce the risk of a legal problem
and
In the eyes of the business—the ultimate risk decision maker—the more it affects/helps the users, the bigger the win. So from a practical point of view, they’re using a very different set of risk factors than we are from behind our consoles and our dashboards.
These are both huge points, that highlight the difference between what we as practitioners often think is important and what the business thinks is important. The trick of course is balancing the two correctly. My recommendation is whenever possible leverage adding security by packaging it with a new offering that users want. For instance, at one employer, there was a big push from users to be allowed to move from dial-up to VPN over their home broad-band connections. We gave it to them, but took the opportunity to move from passwords for authentication to tokens. We got almost no complaints from users about it being harder or more complicated because it was bundled with something they really wanted. This had the added bonus, that down the road when we later required it for accessing certain critical systems, it was a well understood technology that people were used to using, so we got very little push-back and got compliments from our auditors for being so conscientious.
“…what it takes to APPEAR to be effective.”
Nicely put, arthur. Fake it ’til you make it, that’s what I always say. 😉
The secret to success, according to (IIRC) George Burns:
“Sincerity, kid. Once you fake that, you got it made.”