I have tried to break down the problem areas into multiple areas with some comments.
Mindset: Information Security in IT / Business is always seen as a trouble maker or that causes hindrance. This is to do with the mindset. This needs to be broken into with the notion that it is not an independent function, but more of a need and one that works in a cohesive manner.
Education: Teach / educate people about the business consequences of having a security as one of the core requirements. If it is for a C Level, they should perceive the issues and should be educated to relate to IP, Adherence, Compliance and the all the consequences associated with it. It has to be carry out without losing momentum and purpose to all the lower levels being it operations, development, support and all other supporting functions. Typically the education could be iterated to any common architectural implementation and give lots of examples for what needs to be protected and how it can be broken into. I do not want to quote examples, but it could be anything such as even building a house and protecting the valuables inside it. Be it human, money, things, vehicles etc., and explain about the iterative process right from designing the house, adding perimeter security, monitoring, installing access controls, adding safes, segregation and storing of valuables, using 3rd party services such as banks, insurance providers, personnel, vehicle and infrastructure safety measures, safeguarding information related to all access and authorization measures such as keys, passwords, vault codes, inside attacks, social engineering and anything that is there in this world. The same could be mapped to the threat modeling approach and related to what needs to be done for the business at every level. The systems that needs to be implemented to protect and safeguard the valuable information / data and the responsibilities of everyone who are involved in the process. Education goes a long way right from what as an individual - a single person could contribute and develop the personal security habits to what he does as part of his job will add to the culture of having the right security mindset and all the mentioned issues will slowly be addressed over a period of time. Enforcing without proper articulation will lead to people circumventing / not adhering to the processes.
People: Being from a programming background and subsequently progressed to an architect and higher into management, the planning was missing even in me. I used to think of ways to get away from Information Security practices / processes because it adds lot of delay and associated changes, but realized it is required for the success of everything that is related to business. As they say, human is the weakest link in a security chain, try and automate as much as possible with proper audit trails of all the activities and responsibility management. Based on the business requirements and needs, categories / segregation needs to be made with respect to the privileges and rights one shall possess to carry out their duties and it needs to be enforced to function. Bypassing / workaround on security will lead to and widespread and slow adoption resulting in with lot of troubles at a later stage.
All the information security problems can be avoided with little monitoring and a lot of educaton and cultivating the mindset. It involves all the people who could help build a secure environment, platform, business and making it more resilient to attacks.
To summarize, it is the people's mindset cultivation, education and the culture that could help to go a long way! Just my thoughts.
I wanted to write more, but the I believe the above covers the basic idea of it. It's not something new and which are not there, but, it's what came to my mind when I read the query. It is also something which I practice on a day-to-day basis and do as much mentoring to cultivate it among my peers.
Thanks and comments welcome. Have a fantastic day!
