An Information Security Place

I am currently reading Michael Santarcangelo’s book Into the Breach (sorry it is taking so long Michael, just busy – I have 2 others I am supposed to be reading and reviewing as well).  This is not a review of that book (that is coming later).  I want to make some comments on a particular point he made in chapter 5, entitled "The Strategy to Protect Information".

In that chapter, Michael talks about how many people are shocked to learn where information is stored in their organization when the information discovery process is undertaken.  He states that people are so used to just copying the information wherever they need to get their job done that they didn’t even know that the data was stored in a central location.  This is very true, but this is not the point that I want to discuss.  The point I want to discuss is observation.

Michael has made an observation here.  He has studied people’s reaction to this step, and he had put it down on paper.  It may seem like a little trivial piece of information that will make you laugh when you tell your buddies over a beer – "That guy in payroll was clueless!  He copied the executive payroll data into a spreadsheet about 3 years ago onto his laptop and was paying them from the data stored there!  He was doing a lot of that work from home!  He didn’t even know that the new payroll system had been put in place a year ago!"  But in reality, that observation has huge ramifications.  That person COULD have been doing their job much more efficiently and SAFELY for the last 3 years.  The risk of him putting executive payroll data in a spreadsheet on his laptop and taking it home was huge.  But for some reason, he did not know that the new payroll system had been implemented.

But again, the point of this post is not that the payroll data was at risk.  The point is that I have seen that same reaction time and time again over the last 14 years I have been IT.  There have been numerous times when I pointed out to a user that they were using data from the wrong source.  Maybe they had thrown together a quick Access database on their PC after they took a local community college course.  That has happened so many times.  But I typically just pointed them in the right direction (or was advised to let them keep doing what they were doing because they got their job done).  It took me so long to actually see the ramifications behind that issue happening again and again over the years.  If I would have just stopped and thought about things earlier in my career in IT, I would have been able to see the forest a lot more clearly.  I would have been able to better handle situations like that more efficiently and more wisely at a much earlier point in my 14 years (maybe I could have written a book about it 10 years ago ).

So my basic point is this.  Use your observation skills.  Stop and think.  Don’t get so caught up in your day-to-day job that you don’t stop to observe and discern.  It can seriously impact the way you do your job, and usually in positive ways.  If you don’t pause to make sense of what is going on around you, you get swept up in doing everything in a less efficient way.  If you can’t see the underlying cause of problems, then you keep treating the problem as individual little slices of time instead of a systemic problem that could be causing larger concerns in your organization and in your industry as a whole.

Vet