How Does Information Security Contribute to Success?
Several issues come to the fore when considering how
INFOSEC contributes to an organization's success. In
a nutshell, a properly executed information security
program will increase the likelihood that the
organization will be able to achieve its objectives.
Consideration of Abraham Maslow's famous hierarchy of
needs could be helpful here. As you'll likely recall,
Maslow defined five levels of needs, physiological,
safety, love, esteem, and self-actualization. The
first of these needs, physiological, includes such
things as air, water, and food. These must be
satisfied to sustain life. Once these needs have been
met, the next level of needs arises, safety. When
addressing our need for safety, we establish a sense
of stability and consistency in the world around us,
and we have the ability to manage and to overcome
adversity. Maslow's higher-level needs then move on
to love and acceptance, a sense of belonging to
something larger than ourselves. The fourth level of
need is esteem, where we feel good about what we are
doing, and are recognized for our efforts. Finally,
the highest-level need is self-actualization, where we
realize our potential, and become all that we possibly
can be, the best that we have to offer.
While Maslow's hierarchy of needs was constructed to
explain how people progress toward unselfishness, the
hierarchy also makes sense when being applied to
organizations. First, organizations are simply made
up of groups of people, aligned toward a goal.
Second, organizations do function largely the same
way. Without the “physiological” needs--those
necessary to sustain “life”--being satisfied, the
organization cannot continue. Instead of food and
water, organizations need such things as capital and
people. Safety needs include the ability to establish
an operating environment that will allow the
organization to deal with adversity. INFOSEC fits
into this second level--achieving information security
will allow an organization to deal with the kinds of
dangers that could kill an organization whose basic
day-to-day work is the management of information.
Moving then into acceptance, organizations have made a
mark for themselves, where people understand what the
organization is, and how it fits in with the
landscape. Esteem of a company is really the esteem
that the employees. Things like recognition for good
work done fulfill this need. Finally, at the highest
level, the organization becomes all that it can be,
where its mission statement is achieved in some real
sense, where it is offering all that it possibly can
to the world around it.
To be able to achieve their missions--to reach
self-actualization--organizations must satisfy the
lower-level needs. Notice that issues such as safety
and security fall into the second of Maslow's five
levels. To an information-based organization, INFOSEC
must be satisfied not after it has become all that it
can be, not after it has been recognized for its work,
and not even after establishing itself as a player in
the marketplace. The need for information security
must be satisfied at the second level, immediately
after basic issues of survival.
INFOSEC thus provides the ability for the organization
to establish a sense of order in the world around it.
Only after this has been achieved will the
organization be able to navigate successfully through
the world toward some higher-level objective. This
is, incidentally, the same level as an organization's
physical security. You cannot stay in business if you
do not take precautions to prevent thieves from
breaking into your office and stealing your company's
equipment.
Once INFOSEC has been achieved, the organization will
be free to move on to establishing a place for itself
in the marketplace, to be recognized for its good
works, and to become all that it can.
When considered in this light, INFOSEC should seem
less esoteric. At the same time, the requirements of
an INFOSEC program in your organization should become
more clear. Understanding the role of INFOSEC in an
organization's quest to self-actualization and our
understanding of how technology and policy work
together to achieve information security, we can see
several requirements for any successful information
security program:
- It must be in harmony with the organization's
highest-level objectives;
- It must be given clear direction so that conflicts
that will arise (such as functionality vs. risk) can
be resolved properly;
- It must correctly identify the information that is
critical to the organization (what is it that we're
trying to protect?);
- It must understand the operating environment of
the organization, including not only objectives and
policies, but culture and technology;
- It must result in the kind of stability that
allows people in the organization to stop worrying
about the information itself, and to focus on
higher-order needs.
A good information security program should simply
allow the organization to manage the risks that it
will most likely face, thus providing the kind of
stability needed for it to go about the business of
achieving its ambitions. In this way, INFOSEC is just
as critical a piece of the overall formula for success
as a viable offering, a good marketing plan, and the
ability to accept customer payments.
[ Next: How Does INFOSEC
Relate to HIPAA? ]
