http://www.guidance-consulting.com/component/content/article/34-disaster-recovery/98-how-to-use-vulnerability-metrics-to-prevent-it-disasters.html

Thank you very much for your colaboration, and keep it coming!

Adriano

My Little Tricks:

1. I’ve found the most effective way is to “place” infosec function as the missing link between the IT and the business. You represent (mainly) interests of the business when dealing with IT and (occassionaly) interests of IT when dealing with the business.

2. If the core business of your organisation is not IT related, it is safe to assume business leaders pay very little interest to information security unless there is significant risk exposure to financial loss and/or legal consequences. MAKE SURE these two factors are part of your every business discussion or presentation.

3. Good lines to explain the importance of and sell information security to the business:
3.1 “Information Security is like an insurance – it seems insignificant and unneeded until there is an immediate risk of disaster (until it’s too late)”. Sometimes no attention is paid until the disaster hits, but quite often just the realisation of being at serious risk is enough to kickstart immediate remediation.
3.2 “Perfect is just too expensive – information security aims at good enough”. Well it’s actually down to the infosec experts to qualify what “good enough” may mean for the organisation.
3.3 “We don’t care about these computers, we care about your greatest asset – business information”. Computer hardware is cheap – therefore insignificant for the business leaders.
3.4 “How much is the 2GB USB stick? How much is the same stick worth with your powerpoint presentation about future business mergers/aquisitions plan?”
3.5 “How much do you think a printout with the sales report of our biggest competitor is worth? How about ours – left last week on the printer at the reception?”

4. When coming to business for a decision on securing funds, resources and time for an information security programme prepare 3 scenarios:
4.1 Minimal – very basic level of protection, leaving significant risk exposure, costing 50 kudos (or whatever amount or currency, but keep the rate vs cost of Rational the same) – DON’T MAKE IT CHEAP!
4.2 Rational – “good enough” level of protection, leaving reasonable manageble risk exposure, costing 70-80 kudos (this is what you aim for – preferred solution)
4.3 Perfect – excellent level of protection, cutting edge technology, leaving minimal risk exposure, costing 200 kudos or more.
I’ve met only very few cases where “minimal” solution was selected. 80% of time – rational solution is chosen. Occassionally the business leaders would pick “perfect” and well it’s playtime then!
The key point is to leave the final decision (and accountability) to the business leaders. Whatever the choice – make sure you document everything (your cases, your recommendation, the final choice and who made it). That’s just in case

5. Never ever state that “it is secure” whatever you refer to. Make sure to use phrases like “higher level of security”. Nothing ever is 100% secure. When challenged use the automotive example – driving an S-class Mercedes is much safer than riding a bike in case you have an accident, however it will still not guarantee you safety. A battle tank is safer although even that does not guarantee 100% safety.

Good article Adriano.