(Did you miss Part 1, 2, 3, 4 , 5 or 6? Click here for part 1; here for part 2; here for part 3; here for part 4; here for part 5; and here for part 6 to catch up!)
Often missing from the professionalization of Information Security debate is that of business intersection. The best-trained and certified professional will be of little use if injected into a working environment that is unconscious to need or risk. Where would the medical profession be today if it had not professionalized? What about the airline industry?
Providing businesses with trained professionals (not only in the technical aspects but also in the business aspects), combined with certification on a national or global level delivers to the business some basic assurance. A professional organizing body creating paths for the field and bringing together the brightest to help forge general directions and coverage across business verticals becomes a natural process benefiting practitioner and business alike.
However, the largest benefit comes from elevating the field into the business arena, where businesses are aware of, better understand the role of, and are able to fit Information Security into the proper level of business process. No longer would Information Security be just an IT problem, but what it actually is: a business problem. When businesses undertake Information Security like any other business risk, businesses enhance their level of security; this enhancement flows down to the products and services they deliver. When the current ad-hoc approach is exchanged with a holistic approach, it benefits the business, the industry, the consumer and the nation.
The rapid growth of technology since the birth of computers has revolutionized the world and the way both individuals and corporations leverage the Internet and computing devices. However, the rate of change has created new paradigms in business models at the same time complexity and risk acceptance has increased homogeneously.
Reliance on this multifarious cyber universe has likewise intensified and is projected to be increasingly ubiquitous as the “Internet of Things” looms on the near horizon. Yet the foundations baked into the very fabric of this creation were never designed to be secure. A central basic maxim of Information Security is that security after the fact is more costly, less effective and has a longer time to value. The current state of Information Security has borne out this truth in its very own industry.
Information Security is playing catch up at the same time it is trying to define a core in a multitude of security frameworks. As a relatively new industry, Information Security is facing challenges not unlike other new industries but it is not self-realizing its own deficiencies. Like the entry-level Information Security professional, that dives too deep into extraneous threat vectors but is unable to connect real business risk to the business, so goes the Information Security profession as a whole.
The Information Security profession must connect real business risk with the business in such a way that places the business in a position to lead Information Security. Professionalizing this industry may just be the only hope of making that switch and thus solidifying a permanent positive impact