The Case for Information Security

by Kevin Beaver, CISSP

Malicious computer attacks and the loss of information assets are a growing threat.   All companies, whether they have an Internet presence or not, must consider the many issues involved in securing their information and managing risks.  According to the most recent Computer Security Institute and FBI computer crime statistics, 85% of companies surveyed detected computer security breaches within the last year, and 64% acknowledged financial losses due to those breaches.  Additionally, 91% detected employee abuse of Internet access privileges, and 94% detected computer viruses.  It only takes one brief attack by a hacker, disgruntled employee, or computer virus for a company to suffer negative economic impacts.  Whether it’s the loss of revenue or the loss of customer loyalty, companies simply cannot take risks with their information. 

A major roadblock to effective information security practices for many companies is the difficulty involved in determining actual security requirements.  Additionally, many companies are concerned about having to spend too much time and money on security initiatives.  Depending upon the size of the company and the level of security required, an information security program could be a monumental task.  However, most companies are not aware of the smaller steps that can be taken to ensure a high degree of security.  Contrary to conventional practice, firewalls, data encryption, anti-virus software and other technologies are simply not enough.  Companies must focus more on risk management and consistently administer periodic vulnerability assessments and audits, offer ongoing security awareness training for employees, and most importantly create and maintain sound security policies and procedures.  Whatever the case, the long term costs of securing information systems are much less than the costs of restoring customer confidence or being forced out of business altogether. 

If the proper systems and techniques are implemented and managed properly, information security can be a business enabler.  It can help companies add value to their products and services, reduce the costs of doing business, and even increase revenues by offering products and services that they couldn’t offer before.  For instance, with the proper information security systems in place, companies could take orders and accept credit cards online, allow customers to access and administer personal information, or even provide secure supply-chain management services, as is the case in online business-to-business marketplaces.

The issues involved with information security are complex, and expertise is hard to find.  Information security is a process and a philosophy.  It is more of a business issue than a technology issue, and it must be managed from the top down.  Company owners and executives must understand the business impact of information threats and the implications involved if systems are not secured.  In addition, to protect themselves legally, companies need to show proper due diligence in attempting to establish best practices for information security.  There must be efforts to not only prevent the bad guys from getting in, but also to keep information from leaking out.  It’s no longer a matter of if or when, but instead how many times a company will experience computer breaches.  Knowledge is power, and most companies cannot afford to lose their information-based knowledge, thus losing their competitive advantage. 

Kevin Beaver is the founder of Principle Logic.  He can be reached at kbeaver@principlelogic.com.