Security

Ask something
Discussion Locked

Is your IT security department proactive or reactive?

0 helpful
4 replies

by fregeus 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I am in a company right now that is in the process of creating an IT security department from scratch. They are under the impression that this department should be what i would classify as reactive, meaning that they will approve or refuse proposal for installations as they are presented (as being secure or not). They do not intend to participate in the analysis of any of those project, just react to them. It does not seem like they intend on delivering standards to follow aswell.

I find this to be a bad and costly view of security. I stronly believe that this will end up costing them more than they intended and will probably not yield the desired results.

Unfortunately, this is not the first company I come across that thinks this way. I was wondering if I hit two similar exceptions or is this the trend out there on the field.

My idea of a proactive department would be one that establishes standards for the other departments to follow, make sure that those standards are followed and participate in project to make sure they follow the spirit of what a secure environment should be.

Your thoughts are appreciated.

PS. How would you go about chainging their minds, if you agree with my point of view.

Thanks

TCB

4 replies

by jaqui

where the department issues guidelines and policies for security issues is the ideal.

unfortunately, it's not the "norm". Reactive is the normal way that they are set up and operate.

The biggest drawback is that by being reactive rather than proactive, security risks are in place and exploits can happen before they have the opporunity to address them.

Since your workplace is just putting their security department together, it is a perfect time to point out to the PTB that the reactive model leaves them open for security breaches that could, potentially, bankrupt the company.

by forum surfer

But people often times nitpick our policies, or push for apps that we deem "security threats" under our policies. In these cases, they point out where points out that is a great productivity tool and does not fall under . In these instances, we are forced to be reactive in our proativeness. Wait...I just confused myself! Proactive is the way to go IMO, but sooner or later you will be reactive. Only difference is it will be easier to back up your reactive response. :/

by gadgetgirl

the security department is always going to be seen as being a) obstructive and b) not meeting its objectives, if it is only reactive.

Not only do they need to set guidelines, but they also DO need (badly, IMO) to be involved in the projects. They can't just say NO without knowing why the project has to go ahead, and what it has to deliver and the business reason why.

By taking an active part in the project, the security side of things can give both advice and guidance, and also suggest more secure alternatives for what the project needs to accomplish.

Sadly, again agreeing with Jaq, the reactive security is usually the norm. It's not all their fault though: they need to be involved at the outset [b] not [/b] when the software/kit has already [i] been purchased[/i]..... (yup..... every bleepin' time )

You need to point out that this can only work if both sides sit down and talk. That way, the project gets the best of both worlds and also leaves everything secure. As I already stated, give them the obstruction point, and see if you can get them on board that way.

Wish I could say more, but it's one of those ever decreasing circle things.... it's happened to me ever since I got into security (10+ years) and I really don't expect it to change!

Good luck, TCB - you're gonna need it... :p

GG

Edit: first day back at work, and I've forgooootten how to spelll altoooogetherrr!

This discussion is closed to new replies.