Aligning Information Security Imperatives with Business Needs

By Oscar Kolodzinski

Unprotected information and breachable computer networks can seriously compromise a business’s future, through the loss of classified or customer critical information, exposure of trade secrets, unacceptable business interruption, or lawsuits stemming from security breaches. Information and computer network security involves more than technology. Most companies spend more money and man-hours than necessary on cutting-edge technology. Inaccurate analysis of the company’s needs can result in greater risk of information loss and higher frequency of security breaches.

Companies must consider the following potential scenarios:

Any of these could result in one or more of the following:

The overarching goal is to develop a scalable corporate security structure that is responsive to short- and long-term needs as well as shifts in technology. A basic tenet of such business-

driven computer network security planning is that senior management and its risk management function lead the charge on linking business strategies to computer network security and identifying where information is at risk.

By knowing future needs, security planners can anticipate requirements for information protection with a view to making them able to expand or contract according to strategic actions that the company takes in pursuit of its targets and goals. Similarly, the planning process will be responsive to shifts in technology; needs will be known in advance and systems put in place that allow for technology upgrades or add-ons.