Print

Comment

Email

Digg

Del.icio.us

Reddit

Twitter

One of the alarming trends noticed in the past year was the way corporates were responding to the challenges of digital security. A bit of fear is essential to kick start any change and given a choice between an indifferent management and a concerned one. Most would prefer the latter. However, when the concerns of an ignorant management lead to paranoid actions, the results could be devastating. 

Advances in technologies and great products notwithstanding, let us not forget that the aim of security is to reduce risk to acceptable limits. It is not to try and eliminate risk at the cost of business. However, several experiences seem to indicate that many organizations have launched a digital security crusade that ignores this basic tenet of risk management.

The most apparent of this manifestation is the management's obsession with monitoring employees and laying down 'security' restrictions. Various companies ask their visitors to deposit their cell phones and USB drives at the security counter. This is done to avoid any security breaches.

Security or Embargo
Let's try and get real here. What is the aim of a corporate office? Among other things, an organization's headquarter is its interface with the external world. Sure there are certain areas which are sensitive and it is only fair to restrict entry to such parts of the premises but when one is asked to deposit all electronic items at the gate, it is reminiscent of a high security prison rather than a corporate office. But for the sake of argument let us take this a step further and examine whether such extreme measures actually improve security. Actually they don't.

Firstly, the security guards are pretty much relying on the declaration of the visitor about his personal belongings. If the organization gets about 400 visitors a day chances are that more than 99% of them are law abiding citizens with no ulterior motive. And the one odd hostile person will hardly 'declare' his intent at the gate. Thus a system that relies on the thief to declare his intent of theft is a pretty lame one. Besides, where does one stop? An iPod can double up as a USB drive. Incidentally, recent versions of the Swiss army knives have USB drives built in and frankly until networks within companies get upgraded to the levels of transporting megabytes of data in real-time, the USB drives do perform a very real function.

Tackling Web Threat
Certain corporates also seem to have fallen for the classic parody of using technology just because it is there. Web monitoring is one such example. There are a plethora of tools that allow the management to monitor the web activities of their employees. So in theory, one can observe just what each one is up to. But the question is-to what purpose? It is a given fact that on a typical day a certain percentage of time of the employees will be spent in browsing the net or perhaps checking private mails. So what? Couldn't the employee be making private calls or writing private letters? In an age where most employees spend upward of 12 hours in the job environment or commuting to it, isn't it fair to expect them to attend to some personal tasks during that time. Ok, so there is that one odd person who is spending most of the time on the net surfing, but since when did software becomes a substitute for managing results?

Besides, there is the point of privacy. In any socio-economic framework, every employee has the right to her privacy. While the management may have a technical right to monitor it's assets, one can doubt that it does much good for the morale of the employees to get the message that they are not trusted.

There can be some basic hygiene such as barring of porn or sites containing racial material but banning Web mail accounts etc is downright unwarranted. Not in this day and age where most employees are considered to be knowledge workers, even if they are engaged in non-IT work. This makes it absolutely essential for organizations to understand the implications of stringent procedures and polices on its most valuable asset, employees. Hence to achieve its desired goals, a corporate security policy should align itself to the HR policies of the organization.  

Best Practices in Place
Understand that the entire gamut of security management systems comprise primarily of three components-identity and access management, threat management, and security information management. All these help an organization achieve operational efficiencies and regulatory compliance, as well as contain costs, mitigate risk and ensure continuous business operations.

In order to achieve these corporate objectives, organizations need to have a robust system in place. The reason why most of the organizations act over-zealously in matters of security because they do not incorporate some of the best practices into their operations to improve information security.

So a concerned management must exercise jurisprudence while protecting their assets. With increased number of online users and the associated challenges, organizations must understand the need of security within the IT framework. Their criterion should be that whatever the IT deployment, it has to bring value to the company both in terms of data protection, increased business and enhanced employee morale. Finally, security system should serve its purpose rather than be deployed because others are doing it. In short there is no need to get paranoid about security else one could end up with a very secure but demoralized and inefficient organization.

Captain Raghu Raman, CEO, Mahindra Special Services Group
maildqindia@cybermedia.co.in

Page(s)   1