Emphasising security's strategic value in business

October 2002 News

Security is not a separate entity. Rather, in order for any security programme to succeed, it should form part of a company's holistic business plan. For the most part, this can only be achieved if those charged with the task of implementing security policies have the support of their colleagues in other areas of business such as the finance manager or the IT consultant.

However, often a security manager may go about the wrong way in trying to get his peers or employers to understand security policies. As author and security consultant Carl Roper points out: "The problem is that as security professionals, we have failed in many instances to properly educate senior management about the fundamentals of security. We tell them about the threats, what must be done to counter them, and how much it will cost. We do not sell them on the broader benefits of security nor explain to them how security can help the bottom line."

According to Roper in order to get security's message across, security managers need to address three points: knowledge base, including technical terms; management style; and inattention. Below is a synopsis of the key factors that he believes are essential for the security manager to get the support he needs from senior management:

Understanding: Security managers often mistakenly assume that executives are already well versed in the fundamentals of security. That false premise can create communication problems. Since a project's approval may hinge on the decision makers' understanding of a principle such as risk management, managers should not presume prior knowledge of the concept. For example, risk management may have one meaning from an IT perspective, another from an accounting perspective, and yet another from a security perspective.

The security manager should, therefore, offer brief incisive overviews of the principles on which a project is based. These can be introduced with phrases such as "As many of you may already know..." to avoid the impression that the security manager is talking down to the executives. The overview ensures that everyone will have at least a basic level of knowledge on which to base the funding decision.

Senior managers may also be unfamiliar with technical terms. Undefined terminology is an obvious impediment to communication. Some managers may think that making a presentation that is technical will cause decision makers to simply approve the project. That outcome is unlikely, however. A presentation laden with indecipherable terms is more likely to cause annoyance and frustration as executives are forced to ask repeatedly for explanations. And in some cases, decision makers will just 'fill in the blanks,' guessing at the meaning without asking, which is bound to result in misinterpretations. And when these misinterpretations lead to failures later, it is not the executive who will take the blame.

Operational approach: Every manager has his or her own style. The security manager who fails to craft a presentation to fit the decision maker's operational approach can doom a project proposal. The security manager must also recognise the concerns of other departmental managers - the focus on getting the job done. If the perception is that security is becoming a roadblock to the business objectives, it must be overcome. The security manager can do so by stressing how an effective security program supports the business goals. In addition, when making a specific project proposal, the security manager should relate it to specific corporate objectives that are viewed as vitally important, emphasising how the one benefits the other using as many specifics as possible.

Listening: Keeping executives' attention focused on security also entails listening. Only by listening to and understanding management's broader concerns can the security manager make sure that the security program fully addresses these concerns. In so doing, the security manager brings senior management to security's side and helps these executives to understand the entire process and their role in it.

Only by educating top management about security's role can the security manager obtain full support for the security program. And that objective can be achieved only when the security professional has learned to communicate effectively with senior management.

Till next month

Gerard Peter - Editor

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

iPulse to distribute Hitachi’s VeinID products
Issue 4 2021, iPulse Systems , News, Access Control & Identity Management
Hitachi Europe, a pioneer of finger vein biometric technology and iPulse Systems have announced a partnership to allow iPulse to distribute Hitachi’s VeinID products and solutions in Africa.

Cloud Security 2021: Latest trends and insights
Issue 4 2021 , News
With cloud security continuing to be a hot topic in 2021, Fortinet and Cybersecurity Insiders decided to ask cybersecurity professionals around the world and across all industries for their latest insights.

Panomera S-Series recognised with iF Design Award 2021
Issue 3 2021, Dallmeier Electronic Southern Africa , News
All Panomera models are equipped with the uniform Quick-Lock system, which makes them compatible with all mounting options – for wall, ceiling, mast and edge storage.

AVeS launches cybersecurity awareness campaign
Issue 3 2021, AVeS Cyber Security , News
Amidst rising cybercrime, ongoing lockdowns and the Protection of Personal Information Act (PoPIA) deadline in South Africa, organisations and their employees are facing a staggering increase in cyber risks.

PoPIA: De-identifying, matching and filing
Issue 3 2021 , Editor's Choice, News, Security Services & Risk Management
Three of the crucial areas in organisational PoPIA compliance that must be discussed include de-identifying, information matching programmes and filing systems.

ONVIF releases Profile M
Issue 3 2021 , News, CCTV, Surveillance & Remote Monitoring
ONVIF has released Profile M to address the dynamic video analytics market as well as expanding the pathways for the use of metadata and event handling into other systems, such as access control, cloud services and IoT platforms.

Top cybersecurity considerations for SMEs in 2021
Issue 3 2021 , Cyber Security, News
Cisco has published its 2021 SMB Security Outcomes Study, highlighting what SMB leaders are doing to thrive in today's ever-evolving threat landscape, as well as offering actionable insights on where they should focus.

Never allow someone onto your property without asking questions first
Issue 3 2021, Fidelity Services Group , News, Security Services & Risk Management
Opportunistic criminals are always looking for easy targets. Being aware of basic personal safety measures can go a long way towards protecting you from impersonators and imposters.

From the editor's desk: A storm in the cloud
Issue 4 2021, Technews Publishing , News
The latest ransomware attack, named Kaseya after a company that provides a number of tools to customers all over the world, has hit a number of companies ‘downstream. In other words, some of the companies ...

Winners of the inaugural South Africa OSPAs
Issue 4 2021, Technews Publishing, Secutel Technologies, Cathexis Technologies , Editor's Choice, News, Integrated Solutions, Security Services & Risk Management
The presentation of the first-ever South Africa Outstanding Security Performance Awards (OSPAs) took place virtually on Thursday 3rd June 2021 as part of an internationally attended online thought leadership webinar.