Centralized vs Decentralized Security

Not many, and I wouldn't.

An investment usually yeilds some sort of return. A true IT Security function would yeild nothing.

It would be more appropriate to think about security in the same manner that we think about risk and insurance. The security industry lacks the numbers for insurance companies to hop on board and provide useful IT insurance polices. Until more companies are willing to disclose the particulars of security related losses, that won't change.

Senior executives havethe most to lose, and typically have the least access, while the rank and file are indifferent and have the most access.

You could organize the rank and file to care about their companies' assets, but that would mean changing corporate cultures and the nature of ownership in large corporation.

Security is best sold when it is bundled with something. You buy the car with brakes, lights, air bags, etc. all to insure a safe ride, but you don't add these on after you buy the car.

Yes and no, if it's a small operation, then security is generally not a overpowering problem, and needs little attention, BUT when the operation is large, there needs to be automated security and logging methods implimented, the ones responcible forwriting the strings that actuate security protocols collectively (Anyone who asks the user in large operations to impliment the "Gut" security, asks for the collective mistakes , and forgetfulness that accompanies it) , I operate a single man operation, and get at least one attempt a week live, not counting the "lurkers" that are automated, and to add to the mess is the new "code red" mess, that has opened a "pandora's box" to would-be good hackers (I have found a fix for Windows if you want it, but it has limitations that curtail operations) , the Security manager who does not string most S-apps together to automate, is simply asking for it. Who cares if it takes 15 more seconds to access?

As a security administrator -I've found that managers often look at the costs and say it's not worth it. It usually takes something pretty awful to happen, and then they'll respond, sometimes that doesn't even help.

It's kinda like having the roof blown off of the data center during a violent storm still isn't enough to convince someone we need to be concerned about disaster recovery..

I wish I could be more positive.

We have a decentralized business model here.

This question was auto closed due to inactivity