According to recent research, over a third (38%) of IT professionals believe that collaboration between IT security, risk management and business is poor, non-existent or adversarial. Not only that, but 47% rated their communication of relevant security risks to executives as “not effective”.
With security and compliance a key issue in today’s business environment, this points to a significant problem that potentially puts the organisation at risk. But why is communicating about security so difficult – and how can this be improved?
Communicating any technical concept to a non-technical audience can be challenging, and it’s even more difficult with security, which is often perceived to be a “blocker” rather than an enabler. In other words, people regard it as putting restrictions on the activity that allows them to do their job. As a result business users often prefer to see IT security as something that is solely the responsibility of the IT department. It’s difficult to change this perception without a concerted effort to articulate the role that everyone in the organisation has to play in managing risk.
Organisations that take security seriously appoint roles or assign responsibilities at the executive level. This enables them to implement a business-wide security strategy that addresses change management activities as well as the technical aspects of IT security. In my opinion, a strategy for effective communications will include five key points:
Executive level sponsorship
Setting the right tone at the top is critical to ensure staff take their IT security responsibilities seriously. Management must demonstrate their own commitment to the IT security strategy through prioritisation of resources and their own communication activities.
By offering strong sponsorship to risk management initiatives and stating the importance of these to the organisation’s overall strategy, senior executives are able to prioritise these activities in the minds of staff throughout the organisation.
It is important to remember that most people in the organisation will be unfamiliar with IT security concepts or terminology. It is therefore essential that communications use language that will be understood and that complex ideas are simplified appropriately. For example, describing the risk of a denial of service attack would perhaps be better articulated as the risk of “losing access to IT systems and resources”.
A communications strategy should also recognise that there will be several different audiences within one organisation and outline tactics that relate to each.
Messaging should be tailored to different audiences and clearly articulate the role that each has to play in the IT security strategy. For example, messaging for an IT competency centre will be different from that for a team working in a buying department.
One technique is to ask the audience to consider the consequences of something going wrong. For example, if an organisation suffers a financial fraud it is more likely to be the finance department held accountable than IT. Understanding the repercussions of a failure and how this would affect them personally can often help business users to understand their role in preventing such failures.
Each organisation will be different and this needs to be reflected in the communication channels used. If everyone reads the newsletter then this will be an effective channel. However, if the company intranet has a better readership then that should be used. At the same time, it is also important to include a variety of methods to ensure that the entire audience is reached.
An ongoing process
Communication about IT security is not a one-off activity; it is a continual process. The strategy should define a programme for communications that gradually builds up staff understanding of their IT security responsibilities, their role in safeguarding the organisation’s information assets and why this is important.
It is also important that IT security projects account for change management activities such as communications and training. Consideration of these should be embedded in project management methodology.
Many organisations focus on the technical elements of IT security, with little attention given to the business change aspects. However, effective risk management is not possible without the support of staff throughout the organisation.
Clearly, technology is critical to managing organisational risk. However, it can only be truly effective if everyone throughout the business understands the role they have to play.
Richard Hunt is managing director of Turnkey Consulting