When I was in university, one of my Information Security professors taught us a very important lesson: "Your plan can never be perfect because nothing is perfect. You can only think so far ahead and do something rather than doing nothing". This is exactly the case for Booz Allen Hamilton, a military contractor specializing in management and technology consulting services.

In 2011, a network of hacktivists (hacker activists) called Anonymous reportedly hacked into the servers of Booz Allen Hamilton. Anonymous claimed to have accessed and deleted four GB of source code and released 90,000 military email addresses and passwords. As a result, the information security staff at the firm, headed by Michael Waters, increased almost 6-fold from initially having only 12. Other changes took place over the years to ensure a significant improvement in the company’s operations. Nevertheless, the firm experienced another attack from a company insider, Edward Snowden. In the article Navigating the muddy waters of enterprise infosec, written by Stacy Collett of CSO from IDG, ways are listed on how enterprises can have fully implemented information security program.

Emphasize Awareness

Be transparent with your customers. Inform them on your company’s security certifications and audits. Train employees on information security and most especially social engineering.

Create a Communication Channel

Align business goals and Information Security goals. Help employees and staff understand the language, importance of security and how it is a risk management construct. This will raise awareness of risks, know who and what resources are available to solve the problem. Lastly this brings a culture that will promote information security.

Spend Wisely

Rather than spending what is required and preparing for the worst to come, companies choose to be extremely frugal and become reactive to a scenario. While on the other hand companies choose to throw money at the problem. The best way to determine what your company needs is by asking these questions:

Are you prioritizing the needs that could actually hurt your business the most?
And are you remediating the areas where your business is most vulnerable?

Make it Real

In conclusion everyone (employee, staff and many more) need to understand what is at stake. Through taking into account the type of industry, "the nuances to the types of systems they use, their interconnectedness to third parties, the types of data they have, how they’re using it and what that might be.” If you are just starting to plan your Info Sec or already have one in place the most important question to ask yourself is, as Micheal Eisenberg says, When you can articulate a risk that the business and board of directors agree with, then you can come up with a plan to mitigate and manage that risk.

Navigating Enterprise InfoSec: Lessons Learned

Services

Solutions

Pricing

Resources

Events

About Us

Get Started