Securing Senior Level Buy-in
We know that technology is critical to securing an enterprise's data and documents but we also know that information security is essentially a people problem as well as a management problem.
It has been my experience in the FBI and now with Xerox, that many corporations simply do not do a good job in identifying and protecting their critical information assets and trade secrets; the ones that mean the most to survivability and shareholder confidence. Why is this? Why do we get the idea security doesn’t fire on all cylinders despite the growing awareness of risk to confidential and privacy-protected information? The answer circles back to the ‘management’ side of the problem. With the many complex issues and challenges facing enterprises today, one question posed from the audience at all seven of the Security Summits we did last year was, “What can security professionals do to get senior executive buy-in for security? I think this is a very good question that drills down beneath the surface. It recognizes the difference between a top-down model versus a bottom-up or grassroots model. The top-down model has a champion that bridges the communities of interest across the enterprise and fosters a cohesive ‘process’ approach to best understand and mitigate risk. The grassroots approach lacks organizational support and just doesn’t operate on all cylinders.
But how you get upper management buy-in can be a daunting task. There is no pat answer. Some executives think, ‘it won’t happen to me’, and don’t easily scare – even in the face of horrific headlines describing security breaches. Others may consider their investment toward becoming regulatory compliant sufficient enough. Whatever the reason for a lack of senior executive buy-in, the implications are relevant to the need to better identify and protect critical information assets. Security professionals must have their act together to gain this level of buy-in and to have credibility. They must know their company – inside out – and all its assets. They must fully comprehend the ever-changing world of risk and develop specific metrics or measures of performance to track progress and the effectiveness of controls to mitigate risk. And perhaps most importantly, communicate the results to the senior team on a regular basis. Security professionals and risk managers have a unique perspective on business risk and impact that must serve as a counterbalance to the business objective of increasing shareholder confidence and value.
Making a compelling link to the company’s core values may be sufficient enough for some senior executives to raise the security banner, and fear of accountability and even jail time may be sufficient for others, but a razor-sharp security and risk management focus combined with measurable performance metrics can make a compelling case for the right champion to raise the banner and keep it there.
David Drab
Principal, Information Content Security Services
Xerox Global Services