Information Security,

Auditee : Hi There ! Welcome, What would you like to have? Tea or Coffee? Auditor: Asset Register ! A comprehensive Asset Register is something which is quintessential for any risk management program. Everything that has to do with risk, follows from here. Information Security Risks are no different that any other type of risks. Having a few people (rarely security pro) building asset register will probably mess up any risk management at the very first stage. It has been seen that people generally miss to address technologically advanced assets (The ones they did not understand a few years ago)  to register in their asset inventory. The most obvious are the virtual machines.  Every day ,Virtual Machines (VM) are being created on the fly as per business requirement, many of them persist for years and many not so much. There are many questions  like: if that particular VM is of some value? Do I need to consider it as valuable at this point of time, whe...

When the world is about to wake up on handling security consciously, The C-Suite is unable to digest the Return On Investment. Every minute of every hour, Organizations are loosing their precious security employees just because someone somewhere is incapable to use Simple Math to give some numbers to their Bosses. The management is failing to understand or at-least ignoring the fact that security is important to their businesses directly. Gone are those days when repercussions were felt later in time, In contemporary culture the impact are too high and sudden. By the time organizations wake up, They have already had a visible dent on their businesses and values.  In the last couple of years, when everyone was working to bring security solutions on the table , C-Suite people made the wrong turn and brought "compliance" ! From that day till the next major incident, we are not expecting any turn from the current pathway . No one is sharing their part of energy to push this ...

"It might sound like a hate speech but believe me Top Management doesn't care about security, disaster recovery, compliance, project management and a lots of other domains that you fantasize about. The Board only care about RISK ."    National Association of Corporate Directors was founded in 1977 with the goal to educate directors. What they are telling boards can be understood as what board really need you to put up in slides. Board want you to:- Talk about Enterprise-wide risk management issue rather than just IT issue. Talk about legal implication of cyber risk as they relate to their company's specific circumstances. Talk about risk avoidance, acceptance, and transfer. They basically have interest in knowing how much risk are we taking as compared to others and your confidence factor in your analysis. They want some metrics to make some references. Also, the Board want your security metrics to be thorough and should represent your entire landscape...

"Net Neutrality:  is the  principle  that  Internet service providers  and governments should treat all data on the  Internet  equally, not discriminating or charging deferentially by user, content, site, platform, application, type of attached equipment, or mode of communication. "                                                                                                     ~ source : Wikipedia One beautiful afternoon, Steve an employee of big MNC log on to his personal email account and see an offer through which he can tunnel his service data which cost more than normal data through a free service. To save a few bucks he could not resist but use that service (eg. vpn), but Steve...

"With great power comes great responsibility" were the words of Sten Lee, who has written these lines for the very famous movie called  Spiderman  . Leaders specially in Information Technology (IT) industry do agree with the fact  that IT has profoundly  improved them to govern and manage resources with tremendous power. While striving to achieve things in an easier way when an organization is equipped with the power of IT , some organization fail to understand the repercussions of not using the power diligently. People at different organizational level have information about their own limited functions and often does not know how the information system is affected by their roles . Information Security is one of those requirement of an organization that should be dealt with a holistic approach which require a full fledged  management system . This is because the idea is to secure information of the complete organization not just to secure  IT systems....

With the proliferation of automated hacking toolkits and amusement that news channels create when some popular website gets hacked or defaced, every IT guy have heard of "security" at least as many times as it is sufficient to  make it sound boring.  Many researches held at universities across the globe shows good correlation between poor employee engagement with poor interest in efficiently fulfilling their jobs. Similarly there are some researches that emphasize on the phenomenon that effective security depends on employee engagement rather than hard compliance. With all of this taken into consideration it is not that difficult to say that talking about security more than required number of times can make situation worse. The problem that organizations are facing today can become daunting with more and more noise about  security. It is high time for CXOs to maintain a balance and keep providing filtered information about security at right time and amount. No o...