Ideally, all personnel in an organization should readily understand the threat to a company’s health if risk is not managed. Unfortunately, risks and risk management are often perceived quite differently. Personnel often tend to be the weakest link when it comes to security threats to an organization.

One of the challenges with effective risk management of IT resources is achieving a proper balance between security and usability. FIGURE 1-2 shows a diagram. In the diagram, on the left, the computers are completely locked down with such a high level of security that the controls may prevent users from adequately performing their jobs. On the right, the computers are easy to use, but security is being neglected. In the middle, a balance between the two has been achieved.

Balanced security rarely satisfies everyone. Security personnel want to lock systems down tight, whereas end users find those security controls inconvenient and want more usability.

It is common for individuals in the following roles to have different perceptions of risk:

• Leaders and managers—Leaders and managers are concerned mostly with profitability and survivability. Because attacks can result in loss of C-I-A, leaders are willing to spend money to mitigate risks. However, their view of risk is typically based on costs associated with the risk and the controls. Managers need accurate facts to make decisions regarding which controls to implement to protect company assets.
• System administrators—System administrators are responsible for protecting IT systems. When they understand the risks, they often want to lock systems down as tight as possible. Administrators are often highly technical individuals. Sometimes, they lose sight of the need to balance security costs with profitability. Some organizations have administrators, often Tier 1, who serve as the first line of defense for IT support. These administrators are given limited administrative permissions. They often view the security controls as hindrances to performing their job and don’t always recognize the importance of the controls. For example, the need to use a change management process isn’t always understood. A well-meaning technician may bypass a change management process to solve one problem but unintentionally create another problem. These unapproved changes can result in business losses.
• Developer—Some companies have in-house application developers. They write applications that can be used in-house or sold as part of the company’s product offerings. Many developers have adopted a secure computing mindset. They realize that security needs to be included beginning at the design stage and going all the way through to the release stage. When developers haven’t adopted a security mindset, they often try to patch security holes at the end of the development cycle. This patching mindset rarely addresses all problems and results in the release of vulnerable software. Ideally, security needs to be an integral step in the life cycle of software or application development.
• End user—End users simply want the computer to work for them. They are most concerned with usability and often don’t understand the reason for the security controls and restrictions. Instead, security is viewed as an inconvenience. Well-meaning users often try to circumvent controls so they can accomplish their job. For example, because USB thumb drives often transport viruses without the user’s knowledge, companies frequently implement policies restricting the use of thumb drives. However, a user who needs to transfer a file from one computer to another to complete a project deadline may view a USB thumb drive as a necessary solution.

The perceptions of these different role holders can be addressed through targeted training. Some training can include all employees. Other training should be targeted to specific roles. Targeted training helps role holders better understand the big picture. It can also help them understand the importance of security and its value to the success of the company. People responsible for managing risks must take all perceptions into account. This is especially true if any of the controls can be bypassed. For example, theft of laptops is a common problem for some companies. An employee can leave a laptop to take a break at a conference only to come back and find the laptop gone. This risk can almost be eliminated if the company purchases hardware locks, which can secure the laptop to a desk or other furniture. However, if users don’t perceive the risk as valid, they may simply not use the lock; therefore, they must be trained to understand the controls and the consequences (to the company and themselves) for not complying with the controls.

Process represents the actions taken to reach a desired outcome. A lack of formal process is a contributor to risk in any organization. Without a process for creating recipes and training cooks, a bakery, for example, could not produce consistently delicious cupcakes, and risks income loss. Without a process for inventory control, a sales company may risk loss of customers from lack of supply. For many organizations, these processes take the form of policies, standards, and guidelines. The following list describes some of the processes associated with IT resources:

• Policies—Policies are formal statements that are issued directly by an organization’s leaders, such as an acceptable use policy, which describes both acceptable and unacceptable behavior when using company-owned computers and network resources.
• Standards—Standards are mandatory rules written to support or at least provide some direction to policies. For example, a password standard could follow an acceptable use policy.
• Guidelines—Guidelines are not mandatory but provide guidance on specific behavior. For example, guidelines are written on how to create a strong password.

Ideally all organizations should have a general information security policy and may have specific policies in place to define how the business will handle access control, remote access, email usage, incident response, disaster recovery, business continuity, and other risk situations.

Whether in a small business, large government body, or publicly traded corporation, most IT infrastructures consist of the seven domains shown in FIGURE 1-3: User, Workstation, LAN, LAN-to-WAN, WAN, Remote Access, and System/Application. Each domain poses its own set of risks. One method for identifying the risks posed by technology is to review each domain, concentrating on the threats, vulnerabilities, and impact of a loss.

The following examples describe some of the risks for each domain; more risks exist than are described for each domain. Businesses must provide protection in each of the domains. A weakness in any one of the domains can be exploited by an attacker even if the other six domains have no vulnerabilities.