Despite the endless portrayals of embittered foes in politics and business, we are not divided. Despite our healthy disagreements on details, we are in agreement about the goals of computer security.
Despite the recent political results, we are not a divided nation. This is not a political commentary, but one of common interest to all of us in this country, not to mention the rest of the world. We certainly have more in common than we have differences.
In all of my years in information warfare, hanging out with feds, the military and all sorts of people in between, we have hardly ever discussed politics. It didn’t matter; we had a job to do. I still do not know the political leanings of my professional friends and colleagues – and I prefer to keep that sort of non-productive divisiveness out of my security mindset. Because, ultimately, we are united, not divided.
We need each other to survive. We need to think and act like partners and competitors at the same time by achieving a healthy symbiotic balance between the two roles. Impossible you say? Au contraire, mon ami!
The most striking example of competitive partnerships might be seen in the nation’s Information Sharing and Analysis Centers (ISAC), created by former President Clinton’s Presidential Decision Directive 63. As successfully demonstrated in the financial services ISAC, competing banks and insurance companies realize that cooperation in the areas of security and infrastructure protection is necessary for the common good. No one person, company or country lives in electronic isolation. A major security event at one bank is a sure prelude to other banks experiencing similar pain.
Changes in security are occurring inside many top corporations. Traditional stovepiping of security functions is only a hindrance. Cybersecurity requires physical security, both of which require trusted personnel to make it all work. Security departments must integrate their operations more than they ever have. The business-continuity folks need the cybergeeks and the man who fills the back-up generators with oil. The last holdout here, though, is human resources, which prefers absolute hegemony over cooperation. The only way this will change is for senior management to tell HR that they have to play nice with others – even if that means being occasionally politically incorrect in the pursuit of greater corporate security and integrity.
So despite the endless portrayals of embittered foes in politics and business, we are not divided. Despite our healthy disagreements on details, we are in agreement about the goals of computer security.
We agree that protecting the critical infrastructures is in the best interest of the U.S. and the stability of the world because we are all so interconnected. We all need to be reasonably healthy for any one company or country to succeed. We agree that personal privacy is more important than our government treats it and would like to strengthen it when and where we can. We agree that the bad guys are really, really bad and they operate asymmetrically, with little regard for consequence.
These thoughts form a platform that suggests methods for expanding and exploiting the opportunities competitive partnerships offer:
• Create tax incentives for organizations that can demonstrate a strong investment in security tools and personnel.
• Make security issues an educational component from the earliest school years. We tend to teach our children how to use computers, but not why or why not to do certain things.
• Educate America and the world. There is plenty of precedence for this. Think “Unsafe at Any Speed.” “Only You Can Prevent Forest Fires.” “Just Say No.” “Smoking Kills.” All successful public education programs. Protecting our nation’s economic and technological well-being doesn’t even have an advertising tag line. Shame on us.
So let us in the security community remain undivided and focus on the benefits we share and our common (and competitive) interests. In the grand scheme, political infighting is an aside, better left to the politicians. Computer security and protecting critical infrastructures are better left to us.
