Protecting business from the inside out

While data protection provides the challenge, and compliance will consume a majority of the time, the most relevant trend for 2008 is information security's emergence as a strategic business-level issue that plays an increasing role in achieving business objectives. For years, the term IT security has been very appropriate, since activities were focused around antivirus, firewall rules, intrusion detection and the like, with the need for specialized skills to implement and manage specific security technologies. These technologies will continue to flourish and improve, but the mysticism associated with managing them has all but gone away. The operational roles to support these tools are being integrated into the organization's infrastructure team, which is where the roles belong. Antivirus software should be a standard part of a desktop operating system build and supported by the desktop management team; firewall management should be included as part of the network management team, etc.

The role of information security in 2008 and beyond is to help a company understand the risks to, and effect on, business operations stemming from the current environment. That means incorporating risks associated with data, privacy, business resiliency and continuity, technology, third parties and, with the help of corporate counsel, even potential legal risks to enable executives to make better business decisions. Moving forward, information security concerns will begin to be integrated at a fundamental level with business initiatives as they are being developed and will become a relevant component of a company's enterprise risk picture.

The information security journey through 2008

The role of information security in 2008 will be more of a journey than a destination. The ever-changing landscape of risks, regulations and threats will provide multiple diversions and distractions from the security program. However, focusing on data protection and governance, achieving compliance goals and integrating information security into the key business initiatives will lead to a more successful program for 2008 and in the journey beyond.

Kevin Richards, CISSP, is a member of the Risk Advisory Services practice of Ernst & Young LLP. He also is the International Vice President of the ISSA (Information Systems Security Association) International Board.

The views expressed herein are those of the author and do not necessarily reflect the views of Ernst & Young LLP.