Professional journey
Securing organizational assets is not a simple operational task, nor is it as well-planned as implementing a new project. While building adequate defenses against the known threats, the bigger challenge for the information security professionals is to tackle the unknown threats. Along with that the security professionals also carry the responsibility of promoting safe practices across the organization and educating the peers. While other teams are focusing on delivering solutions and value to end customers, there has to be a team who ensures the security of the organizational assets by implementing and monitoring controls to safeguard organization’s interest. These factors indeed influenced the decision to assume a role focused on information security.
Challenges CISOs facing today
With advances in technologies and its rapid adoption by organizations often before a technology has fully matured, it is absolutely necessary for the organizations to assess the risks associated with it from the information security perspective. Security continues to be an add-on to a product or technology rather than by design. Increasing consumerization of IT requires additional layers of protection and complexities which while providing choice of end-point to users, often add to administrative challenges and affect the end-user experience. The challenges of maintaining the right balance between controls and convenience, how much is enough, protecting the information assets from the unknown threats, data leakage prevention and justifying the ROI for security investments remain the continuing challenges for the CISOs.
Information Security outsourcing
The domain of information security is vast and the ever changing threat landscape is best handled if managed by SMEs. The Information security operations can be outsourced but the governance needs to remain in-house. Also, the effectiveness and performance of the outsourced operations must be monitored and reviewed diligently.
Difference between Data Privacy and Data Security
Data privacy essentially relates to protection of SPI and PII. It deals with how personal information e.g. customer or employee information is collected, stored, processed, shared and destroyed. The data security extends beyond the privacy of data related to individuals, to the organisational data protection encompassing confidentiality, integrity and availability.
Suggestions to Information Security vendors
Choosing the right information security solution is critical to the security of the business information and operations. It is equally critical that the chosen solution is deployed in a timely and most effective manner. There have been instances when even the best of the breed products fail to deliver the expected results when deployed. Clearly understanding the customer’s requirements before proposing a solution and ensuring the requirements are met after deploying the solution, will go a long way in building a mutually beneficial relationship between the vendor and the customer. Even though most vendors depend largely on partners for implementation of their products, they should retain the ownership of the deployment with themselves.