Who's in charge?

Establishing a structure is all well and good, but even when information is recognized as a high-value asset, many organizations still stuff the responsibility for its definition and protection down into low-level records and IT roles. This simply doesn't work, because those roles often don't have the authority to properly implement or manage the controls, and the new responsibilities take second place to existing job tasks.

For example, information classification (download PDF) is required in order to qualitatively categorize and determine what controls are appropriate to protect information, but does an IT director have the authority to mandate a classification scheme for an organization? Such attempts are often dismissed as data classification, when in fact the effort ought to apply across business units, HR, legal, records management, and other parts of the organization.

Likewise, would it be appropriate for IT to change the business rules for access to information because of a technical limitation or new feature? It's unfortunately common for organizations to become enamored with new connectivity features in a data repository or interface, and use that to open up remote access or data interchange for remote partners -- but just because you can doesn't mean you should. Access changes should be driven forward by business need, and back by risk. Technical capability is a secondary question for IT.

A limiting factor is that the larger cycle of information includes things from requirements-gathering, to governance, to metrics, to process controls, to technical controls, to audit -- and then a loop back to revision of requirements, governance feedback and adjustment, and so on, again and again. IT owns the middle of this sequence, but not the requirements, audit, or other beginning or end tasks. Someone needs to lead the beginning and end to ensure the middle (the IT part) connects and aligns with the rest.

This is why IT managers or directors are a poor choice for information governance leaders: one can't simultaneously be responsible for the implementation of controls and the audit of whether those controls work properly. A governance leader might be a senior manager or director that handles information in all forms (such as physical records management, as well as electronic), or an executive responsible for compliance. But putting information governance program establishment or reform under the IT organization makes it control-focused, not asset-focused or performance-oriented.

Being serious

After a while, the emergent pattern one sees is that information governance and effective security is equivalent to proper business process. Security nirvana is achieved when security controls asymptotically become indistinguishable from right and proper business process, and alerts from business process variances and security control breaches are one and the same.

Bruce Schneier recently espoused the idea that security has to be "sold" on one side of the balance sheet or the other; either it enhances the profit centers and adds to the bottom line, or reduces actual loss. However, when information security controls end up being close parallels or integrated within existing business processes, it means less selling, less disconnection, and fewer moments where executives perceive information governance as some kind of power grab from IT.

When information governance is treated like any other critical asset control process, it's possible to move forward and make security less independent of the business. And that's what we're after, isn't it?

Jon Espenschied has been at play in the security industry for enough years to become enthusiastic, blase, cynical, jaded, content and enthusiastic again. He is Director of Security Consulting at Consciere, and continues to have his advice ignored by CEOs, auditors and sysadmins alike.