Why information security is NOT just an IT issue

Time and again, when I talk to business owners and managers about information security, I get the line “that’s an IT issue” or “our IT guys look after that”.

Whilst I’m well aware that IT and IT security plays a significant role in information security, it is not the Holy Grail many people seem to think it is.

IT is not some kind of magic wand, to wave over your information assets to suddenly make them secure. The careful and appropriate use of IT solutions is an enabler of information security. It is a method of securing your information and data whilst being used or accessed electronically.

Information is available throughout your organisation in a whole host of formats. Hardcopy printouts, hand-written documents and notes, and doubtless shelves of folders and binders, all make up a substantial element of your business information.

This information needs to be kept secure also.

But, by making information security and IT issue, many senior managers feel they have done their duty, and allocated it some someone who can deal with it. The problem here is that without senior management buy-in, and a top-down culture of security and security awareness among non-IT staff, the ‘IT Crowd’ can only achieve so much.

Often, IT security controls and processes, implemented without the understanding and buy-in of non-IT staff, will be circumvented. If staff feel that IT is getting in their way, they will do everything they can to work around it or subvert the controls. This is how we end up with users sharing logins or passwords, or documents being emailed to large groups of people because “Joe can’t access them”.

To successfully implement an information security programme, managers and business owners need to take ownership themselves. They need to be involved in writing the policies and procedures. They need to educate their staff and system users as to WHY they need to adhere to the policies, HOW to do it and WHAT the consequences will be if they are not followed. They can then use the available IT solutions to assist with the businesses information security policies, approach and objectives.

Information security is NOT an IT issue, but done properly IT can help you achieve your information security aims. You just need to make sure you’ve defined your business objectives beforehand, and educated your staff along the way.