Just IT skills?

A very good article (thank you) and hits the weak point in many corporations. Unfortunately (today?) many companies see the tactical security, i.e. fighting the fires, much more important than having a security and risk management strategy and planning. They just can't win and are lucky to survive. So, the question is more than just IT security skills.

I don't believe the basic skills shortage, security problems are ages old, nothing new except the implementations change day by day but the basic problems have always been and always will be there. Tools and toys can be learned easily but a strategy is something else! There is no shortage of education, sources (and even vendor training) for IT only security methods and usage, but..

Security management is like any other business function management, very seldom the same persons have time to do all the risk management, strategic and tactical planning, design, management, and execution even if they would have both the strategy and the tactical skills,. Why even try (except maybe in a very small environment?) How often do you see Mr. D. Trump, his architects or even the construction managers installing security locks to a new building themselves but maybe changing the lock combinations if they are going to live there? However, they may have an external security company to install the locks!

And because business security is much more than just an IT problem, the security management doesn't belong to IT but should be a top level function in any business. In fields where the security has been an important part of the business a long, long time, as oil, airline, insurance, utility/power, even many manufacturing, etc, you don't see it managed by IT but they have organized it throughout the whole company.

I have seen it done both ways, personally done the risk assessment , risk, cost and return estimates and followup's over years, and so on - and on long run, sooner or later, the tactical only (or where the security doesn't have the top corporate support) has failed, often very badly!

Click to read the article this is in response to.