Since that tragic day on September 11, 2001, much has changed about the way we think about security. The most spectacular manifestation of this can be seen at the checkpoints of our airports. At all costs, we are being protected from even the most remote possibility of a hijacking through a variety of strategies that include arming pilots, putting more air marshals in the air, and even grounding planes with questionable passengers on the passenger list. Now, even the plans of grading passengers and their possible threat profile have returned as a likely future in air travel.

 

The procedures at the checkpoints have led to outrage. Frail and sometimes disabled seniors are sometimes frisked and suspiciously handled on their way through these checkpoints. Our common sense of decency, respect for our elders, and pragmatism about the profile of a would-be terrorist is insulted by witnessing this humiliating process of preparing our seniors for transport. Some would have us believe that for the sake of propriety, we should institutionalize the less attentiveness to seniors. Would this undermine or strengthen our air security?

 

In IT, we are experiencing confusion and paranoia similar to that of homeland security. The hacker, the denial of service attack, the virus, and even the industrial spy is lurking around every virtual corner anxious to pounce, damage our data, or gleen our confidential information. Thus, developing a security mindset and methodology that has stability and is not subject to regular disruptions of process has become increasingly more difficult to design and implement in the digital world.

 

Systematic vulnerabilities and boardroom paranoia have become the strange bedfellows demanding that IT invest untold dollars and resources responding to possible threats. Management sensitivity to increase return on investment (ROI) in every IT initiative goes out the window where data security is concerned. Our IT strategies now include strategies to immediately react to the latest identified threats. Exacerbating this challenge is that the list of vulnerabilities continues to grow. Just when an organization has insulated itself from one, another becomes prominent.

 

There is another and more reasoned way to approaching security, according to Peter Tippett Ph.D., founder and CTO of TruSecure (TruSecure.com). His approach is one of risk management, not dissimilar to the risk management that a company adopts for other organizational risks. Based on experience, empirical, and statistical evidence, Dr. Tippett suggests the following points in defining an IT risk strategy.

 

 

What is the goal? The goal is to minimize the frequency of patching to once per year, especially for organizations with many computers and devices. As part of continuing risk research, TruSecure has defined a model for calculating IT risk that applies to 98 percent of instances.

 

Jacinto Benavente's words have been updated by Dr. Tippett. "We wind up fixing things that we don't need to fix." Now we can be fast!

 

CHAIM YUDKOWSKY, CPA, CITP, is president of Byte of Success Inc., a technology consulting company specializing in helping small and mid-size business grow using technology. He is available for both consultation and speaking. He may be reached at cyudkowsky@byteofsuccess.com.