What is dedication… how do you define it? How are you better for it?
To often people try to raise dedication to a level that seems impossible to achieve, but that is not necessary. Dedication to your passions, pursuits, and life are simple enough. Dedication should not have soft edges, but should happen at intervals.
I find that dedication to training for instance can be achieved when rest days, variety in events, and fun are brought into a sometimes realistically “boring” or mundane and repetitive set of activities. For instance when pursuing Ironman Events the training typically involves 6-8 months of training 16 hours of a week across each skill. Needless to say this can lead to a bit of mental fatigue, but adding short / fun swim, run, and rides can provide the sufficient gap necessary to allow for dedication to continue with stronger mental stamina to raise to the next level.
This concept of interval training is well tested in physical athletes, and I have sought to apply it in my life generally.
Consider how you would apply it in the following areas:
- Making moments in your life beautiful
- Living life (feeling like you are in a rut and there is nothing new/exciting?) > seek out new adventure! (I recently, thanks to the Olympics) have been re-introduced to my love for ice skating, and gymnastics thanks to my daughter)
- Work – variety is the spice of life, inject hands on hard core with cerebral program and management functions (don't lose touch of how the tire meets the road or you'll either lose the rhythm of the industry or have unrealistic expectations across your teams and business.. pretty simple)
How does this relate to business.. well the same as it does for our personal ventures, since the personal venture and dedication of our people is what makes up our business. Without these fundamental pieces there is no business that can succeed.
Information Security, like other fields, requires this type of dedication given the sheer complexity and dependency placed upon these efforts by the individuals behind them. I would challenge you to answer the above questions for yourself personally, and then consider how they apply to your sphere of influence. When you are satisfied, seek out your colleagues and team members .. are they, and if not how can you help them move forward?
Sometimes the most technical aspect of our field of business, technology, and information security is the people themselves.
Questions that must be managed by the COO and CIO of every business relates to dedicating finite resources across the company. The products and services sold the by the business are developed and delivered to market as rapidly as possible in a race to be competitive. In the startup realm the concept of building in security, compliance, and privacy elements is very low priority. In most cases startups (and skunkworks within larger enterprises) depend upon the security of the libraries (ruby on rails, java libraries, etc…) and product components (UL Certified) to deliver security. Unfortunately depending upon the security and safety of the individual pieces is insufficient and inadequate when the elements (from here forward meant to refer to technology code and physical product components) are brought together in a new and non-obvious way. The emergence of these new products and services introduces dependencies, communication channels, new operating environments, and custom elements that reduce or eliminate the security-compliance-privacy elements that existed individually.
Leadership must then prioritize as immediately possible to introduce security-compliance-privacy. Companies certainly benefit by building these natively within the products and services at the Design & Build stage, as it is cheaper to build once then to re-design / re-code to meet the market expectation of security-compliance-privacy. The case when the organization must review its existing portfolio and decide what should be done, is the focus of this article. An analysis is necessary to evaluate the landscape of necessary and appropriate security-compliance-privacy requirements, and which products or services should be updated.
Or stated another way …
Where on the game board do the services and products of our company get prioritized to receive compliance, security, and privacy ‘attention’?
Such an analysis should at least include:
- Listing of all required regulations and business best practices
- Listing of all legal and contractual obligations
- Discovery of similar product / services in the market and list any requirements outlined resulting from litigation and similar government agency enforcement actions
- Strategic roadmap review – identify any likely near term requirements
- Listing of all requirements the individual products & services will be subject to from the customer’s perspective
At this point a robust listing exists on what the products and services should support. A cross-map of these requirements should then be produced for optimized adoption and sustained operation. The cross map will also provide the design specifications that will contribute to the use cases and product development life cycle. An example of such is below:
The above then (in sequence 1 to 5) are placed on your product / services game board and prioritization and risk management are possible. This is a process I designed in 2008 and have enhanced based on experience and client feedback building global security and compliance programs. Your program may need to consider additional facts and realities. I would love to hear your thoughts to enhance and challenge this method.
Posted in Compliance, IT Controls, Security
Tagged best practices, cloud computing, Compliance, compliance program, cybersecurity, it compliance and controls, IT Controls, james deluccia, jdeluccia, regulation, Security, security program