Comments on: Some Insight (Incite?) on the WSJ IT Security Controls Article http://www.bloginfosec.com/2007/08/06/some-insight-incite-on-the-wsj-it-security-controls-article/ An Information Security Magazine in a Blog Format Mon, 30 Jan 2012 11:01:25 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: Alex http://www.bloginfosec.com/2007/08/06/some-insight-incite-on-the-wsj-it-security-controls-article/comment-page-1/#comment-107 Alex Mon, 06 Aug 2007 11:34:47 +0000 http://www.bloginfosec.com/2007/08/06/some-insight-incite-on-the-wsj-it-security-controls-article/#comment-107 "the article pitch was not the same as the final result." I'm not surprised that this would be the case. I think it's interesting that you had so many folks who saw the article as a "good" thing. I can see their point, as it may be useful in a more mature IRM department that has political viability. The folks that I spoke to briefly about this were one 50,000 seat organization with about 250 in IRM, and a 2,000 seat organization with 2 in IRM. The larger one wasn't happy, because neither the reach of their awareness program nor their political influence were large enough to successfully combat such an article. The smaller one had a much better reach with their awareness program, but, outside of "compliance", their ability to really influence management culture was limited. Their response was something along the lines of "All Sr. Mgmt is given a WSJ subscription, and I'm sure at least two of them will try some of these." The policy breaking isn't what angered them, it was the fact that if it did lead to an incident, they had no doubt that they, not the senior managers, would be the ones looking for a job. “the article pitch was not the same as the final result.”

I’m not surprised that this would be the case.

I think it’s interesting that you had so many folks who saw the article as a “good” thing. I can see their point, as it may be useful in a more mature IRM department that has political viability.

The folks that I spoke to briefly about this were one 50,000 seat organization with about 250 in IRM, and a 2,000 seat organization with 2 in IRM. The larger one wasn’t happy, because neither the reach of their awareness program nor their political influence were large enough to successfully combat such an article. The smaller one had a much better reach with their awareness program, but, outside of “compliance”, their ability to really influence management culture was limited. Their response was something along the lines of “All Sr. Mgmt is given a WSJ subscription, and I’m sure at least two of them will try some of these.” The policy breaking isn’t what angered them, it was the fact that if it did lead to an incident, they had no doubt that they, not the senior managers, would be the ones looking for a job.

]]>