We have always talked about the need for a proactive approach to security and its effectiveness and benefits in managing risks. E.g. it’s always more effective and economical to build secure software rather than testing and fixing it after development or in production. In fact we even learned in school with lessons which said “Prevention is better than cure”.

In risk management we come across controls which are:

Preventive: Controls which ensure than exposure don’t or can’t occur

Detective: Controls which help us capture exposures if they happen or are happening

Corrective: Controls which enable us to correct exposures

Nowadays there is lot of focus on Detective controls which includes deployment of technology solutions which detect and capture unwanted network activity, access attempts, patterns etc. Needless to say these investments and focus is fine, but we need to move our risk management posture more towards the preventive side. Which is we must do more to ensure we don’t have weak areas which can be exploited.

I recently read the book “Superfreakonomics” by Steven Levitt and Stephen Dubner. I am usually apprehensive of sequels as they never match up to the original, but gladly this book was a good read. I came across two examples in the book which illustrate the point about preventive controls.

After the 7/7 terrorist attacks in London there was a team formed to use statistical information to identify terrorists. Data points used to identify suspects were banking usage patterns such as:

-          They make large deposits in cash and withdraw small amounts

-          PO boxes are used as addresses and they often change

-          There are regular wire transfers to other countries but always below the threshold for Bank   triggering requirements

-          They never use savings accounts or fixed deposits even though the account had idle money

-          Transactions don’t show normal living expenses and regular out flows such as insurance payments etc.

As one can imagine it would be difficult to come up with a algorithm to make the system accurate. Let’s say a system is developed with 99% accuracy and that there are 500 terrorists in the UK, 495 of them would be identified which would be great. The problem is that with 50 million adults living in the UK the system would also wrongly identify 1% of them which is 500,000 people. This would be huge problem to manage, which is similar to the “False positive” issue in the information risk management world. Hence the best detective control system or technology would always have a false positive issue which would significantly reduce the benefits from the system.

Another example is the detective control deployed at airports which require us to remove our shoes at the security check / scan. This started after one Richard Reid tried to ignite a shoe bomb; fortunately he failed but statistically succeeds in killing equivalent of 14 lives a year in the US!

Let’s say it takes on an average one minute to remove the replace the shoes in the airport security line. In the US this happens for about 560 million times a year, which is equal to 1,065 years. Average US live expectancy is 77.8 years, which yields a total of 14 person-lives a year.

The above examples may sound dramatic (statistics and economics can be used to communicate any message depending on which side you are!). However the underlying theme makes sense, we have to focus on proactive approach to security to be more effective and economical in comparison to other approaches.

I had the opportunity to watch “3 Idiots” which in my view is one the best Hindi movies of all times. Several things in the movie stood out, the basic theme from Chetan Bhagat’s book, the amazing adaption and modifications by Raju Hirani, the concept of “be the best in what you do and success will follow”, the astonishing transformation of Aamir Khan to a 22 year old student etc.

One interesting element of the movie is the use of “All is well” and the story behind it. Rancho (Aamir Khan) uses the words “All is well” whenever he is in trouble (including the highly melodramatic child birth!)  and explains the logic behind it. When he was small they used to have an old watchman who used to roam around the streets shouting “All is well” and every one used to sleep peacefully. Only later did they realize that the watchman was actually night blind! The “All is well” shouts used to give great level of comfort to all and as he says it’s required to fool the heart once in a while.

In lot of ways we risk managers are like the watchman. Our job is to provide assurance to our organizations that “All is well”. This “All is well” feeling is seen by the general users and employees of the organization by the “visible” controls and their implementation. We often come across controls which are not “real” but more “visible”, maybe more deterrents than controls. E.g. the checking of underbellies of cars by guards at shopping malls or hotels. These guys seldom have any clue on what they are looking for; they are doing it just because someone has instructed them to do so. Worst of course is when we are asked to open the boot, they shove a metal detector inside and wait till it makes some noise and then let you pass!

In an ideal situation we should have controls which are specific, manage the risks effectively, are visible, are easy to manage, are not too expensive and don’t cause too much inconvenience. Since most of us don’t operate in the ideal world, it’s important to balance the real and visible controls. It is important to visibly inform the users that security is taken seriously and any deviation would be captured. It’s not about getting it 100% right; it’s about having something in place instead of nothing. As they say “it’s better to be approximately correct, that completely wrong”. Needless to say only having “visible” controls would be disastrous, it’s about having the right balance.

It’s our responsibility to provide assurance and the “All is well” feeling to our organization and users. Hopefully we would be doing it consciously and not as the night blind watchman of 3 Idiots.

For those of us working in the information risk management space, times are challenging. For the last 12 to 14 months, the focus was on how we can get more out of our information assets while controlling the risk management costs. Now that the economy is showing signs of revival, we might get challenged with new forms of risk as organizations become aggressive and would try to regain lost ground and market share.

One key element which we need to manage always are our relationships, many times we hear ourselves say “My management doesn’t understand the value of risk management and security” or “My users just look at convenience and any controls we define are met with resistance” etc. Hence relationship management is important for us to be successful in our function (like most others I guess).

At a high level following are our interfaces or “Configuration items (CI)” (a term borrowed from ITIL!).

§  Management: They look at the strategic view­ – e.g. how do I grow market share?

§  Business Operations: They look at the tactical view – e.g. how do I ensure this customer 
                             is happy?

§  Employees: They look at the convenience view – e.g. I need access to this resource 
               and now.

§  Security: They look at the control view – e.g. Do exactly as I say!

Each of the above CI’s would need to align for an organization to runs its business and manage risk effectively. As Risk managers and CSO’s how do we ensure this happens and everyone contributes?

Srimad Bhagavatam speaks about Catustayam—the four diplomatic principles:

§  Saama: The process of pacifying

§  Daama: The process of giving money (rewards)

§  Danda: The principle of punishment

§  Bheda: The principle of dividing

We need to effectively apply the right principle to the right CI at the right time for the right situation to get the desired result. Hence a matrix needs to be built mapping the four CI’s and the four principles, examples of which I have attempted to explain in a presentation.

The presentation is available online at:

http://www.aujas.com/presentations.html