Security vs. Productivity
Yesterday I took some time to attend the Transend Security and Privacy Symposium 2005. Transend is using this symposium as an opportunity to present itself to the local (Westcoast) IT community. I’m not sure if they felt the event was a success - the number of empty seats seemed very high to me.
Anyway, the symposium had some interesting speakers. Bob Hansmann of Trend Micro told us how it now takes less than 4 days from a patch is released until a new virus attacking the specific security issue can be found. That is less time than it takes most companies to install a new patch. He also mentioned that the challenge is one of security vs. productivity. Speaking to secuirt practitioners he said: “Your job is not to keep a virus from spreading, but to keep productivity up”.
Dick Hardt of Vancouver based Sxip Identity Corporation presented his Identity 2.0 presentation. Well worth a look if you have not seen it already. If you are a blogger, check out their Sxore product.
Dina Palozzi of Bank Of Montreal discussed the importance of the KISS principle when it comes to collecting data. She suggested that understanding the information is critical from a privacy and security perspective. She felt we needed to look at:
- What is collected?
- How is it used?
- Who is responsible
- Where is the information stored
She also said that information must be managed according to business objectives, customer expectations and legal requirements. She furthermore pointed out that accountability for protecting information cannot be outsourced.
Micael Milligan of Kasten Chase brought us from the information itself to the business consequences of poor information management. He suggested 20% of customers has terminated relations with a company with security breaches.
Representatives from the BC and Alberta Privacy Commissioners/Offices mentioned that 95% of all security breaches are due to human breaches. The Albertans also name names when it comes to judgements and orders from the commissioner.
There was other interesting presenters as well. For me, with a background in financial services marketing, it was interesting to note the Risk definition from Paul Wing of Great-West Life: “Risk is … not consistently meeting business objectives and there being an adverse impact“. Thus risk is more than IT/S risk - we also need to take into account all processes that are impacting how we perform compared to our business objectives.
roar at roarweb dot com
Note: This pos moved from Blogger December 6, 2005