A Good Offense

摘要

There are lots of news stories, much wringing of hands, and considerable confusion about system and information security. However, very little real, thoughtful discussion is going on-and more importantly, no real action, either. Several years ago, I was on assignment at a Japanese automotive firm and had several conversations with the information technology (IT) security personnel. They were completely baffled about what to do about company security. They understood that threats were real but kept talking about the budget and lack of senior management support. We discussed how this organization had two immediate areas of concern. The first was the finance division and its databases full of consumer information. Everyone was worried about liability issues if there was a breach. The second issue was the company's engineering system. There was a huge collection of data that any competitor would find extremely valuable. More importantly, in the same engineering systems were new designs of hybrid, electric, and diesel cars-the organization's very future. And yet, the company was hesitant to launch a security-improvement campaign.