Wig, weave or hat? The balding man's perspective on information security

摘要

In most cases it would be true to say that you could add a little bit of information security to your business and it would increase the safety of data without causing massive changes to operation. However the extent to which this is possible is limited. It is like die man who starts losing his hair and decides that the crew cut option is not for him. He can get a hairpiece or wig but the larger the wig is, the greater the risk that it looks false or even fails and blows away when the weadier turns windy. Another solution for hair loss is the hair weave or transplant, where the 'new' hair is incorporated into the existing to make the match as invisible as possible. Good, effective information security in business needs to be woven into the way that business works, into the culture if you like. This can take longer, as suitable approaches to risky operations are found, but if they are efficiendy carried out they are much longer lasting. Of course you could go for the 'Trilby' approach and just hide the problem under a hat in the hope it is not uncovered. Good luck with that! Why then, are businesses so resistant to incorporating information security into their culture? I think a big part of the answer is perception. To start with, diis includes the perception of information security itself, but also its effects on nontechnical staff.