Security: A Business Enabler, Not Disabler Baseline (07/07)No. 74, P. 41; McCormick, John
as it appeared in the August 1, 2007 edition of ACM TechNews.
Purdue University professor Eugene Spafford, recipient of the ACM's President's Award for his "extensive and continuing record of service to the computing community, including major companies and government agencies," says one of the biggest weaknesses in corporate computer centers are business processes, operating systems, and applications that are developed and implemented with convenience or cost, rather than security, in mind. He says it is "just plain wrong" to assume that patches and add-ons will ensure the security of such products, when in fact security must be designed into the products from the outset. Spafford explains that part of this effort involves "having informed, empowered individuals who have the appropriate training and background to be making decisions about what goes in, and that those decisions are based on an adequate understanding of risk." A lack of knowledge about specific risks and the value of components constitutes a major failing, and Spafford says CIOs must obtain a comprehensive perspective of resources in need of protection and their associated risks. Spafford recommends that managers ask questions concerning whether the proper applications/operations/business processes are running, who ultimately decides new acquisitions and the architecture as project momentum builds, and whether risk is properly integrated in those decisions. He also suggests that people should get in a mindset that views security as a enabler rather than a disabler. Spafford is also the chair of ACM's U.S. Public Policy Committee; http://www.acm.org/usacm
