Discussion on:

Protecting the blind side: Invest in security awareness to protect data

The left-tackle is the corporate body is dead on. I have seen signs of "We want you" Uncle Sam with the text reading "Who is responsible for security? YOU ARE!" I disagree on who the Quarterback is. I always tell my customers that IT Security is made up of a hybrid between an IT pro and a Security pro and must be worked as a matrix business model (which is ugly, I know). The IT Security should report to the security dept managment directly. Furthermore, they should have the authority to direct the IT Dept. on matters of Information Assurance and IT Security.

Excellent analogy Dominic -- any security system that relies on users to make good security decisions is bound to fail. My company, Symantec, works with our customers??? CISOs, internal IT staff and channel partners to help them do a better job communicating the need to embed security within everyone in the company. Too often, employees don???t hear from the CISO or the IT department until after the organization has been hit by an attack or suffered a breach.

I would add a head coach ??? the CEO, board of directors, etc. -- to this list of key personnel. It???s the responsibility of the QB (IT department) to demonstrate why technologies and regular employee education and training must be a priority. Protecting information and interactions protects the bottom line the company???s reputation.

Great!!! thanks for sharing this information to us!
sesli chat sesli sohbet