Wed, January 02, 2008 — CIO — Looking into 2008, the information security agenda for executives continues to evolve. Long gone are the days where a firewall and an intrusion detection system can constitute the arsenal of information security defense. The complexities of what to protect and when, overlaid with requirements of regulation and compliance, create the need for a new type of information security executive—one with business savvy, sound risk fundamentals and holistic technical understanding. These skills, coupled with a strong strategy, will be necessary for organizations to achieve their 2008 information security goals.

In looking to build that type of strategy and structure, the items most likely to top the list are data protection and governance, compliance and the effective integration of information security practices into key business and risk management efforts. Executives must choose carefully; how the 2008 strategy addresses these three critical items may determine the program's ultimate success in protecting the business.

Where did the data go?

Data has gone rogue, and it didn't make any headlines in the process. Perhaps it should have. An event this important warrants some attention, but because it didn't happen with a big bang, no one seemed to notice. Inanimate as it is, data is causing problems because it's growing at an uncontrollable rate and it's hiding seemingly everywhere—both in the trusted confines of the data center and on the move through laptops, PDAs and e-mail. It's being disclosed (both on purpose and inadvertently) at an alarming rate and it's all but openly defying the letter of our corporate policies and standards.

The number one item on the 2008 information security agenda is data protection. The practice of protecting the confidentiality, integrity and availability of data is not new—passwords, encryption and data classification structures have been around for years. What has changed is the type of data that's now considered valuable. From the external attacker perspective, intellectual property and insider information were once the most sought-after data asset. Now, the data currency of choice is identity—e-mail addresses, social security numbers and credit card information. Corporate espionage is still a significant threat, but the new underground deals in volume, where success is being measured in thousands and millions of identities.

Internally, data protection is equally challenging. Executives demand that data be available to aid in decision support, albeit limited to only those team members with a "need to know." Whether through e-mail, jump drives or mobile devices, sensitive information seems to be leaving companies in droves. Add in the complexities of outsourcing and offshoring, and the data protection strategy needs to stretch beyond once-trusted walls and around the world.