The Human Factor: 5 Security Blunders People Keep Making
I was asked to do a presentation on trends for a large number of IT folks. Of course, concepts like hyper-converged computing, analytics, mobile, hybrid cloud, and the move away from passwords (finally) came to mind. But at the time, I also happened to be reading a book called Moonshot (I recommend it, by the way) by ex-Apple CEO John Sculley, in which he talks about trends that really don’t have that much to do with servers, services, processors, systems or networking gear.
Let’s talk about some of the trends behind the trends this week.
Empowerment
Customers and employees are increasingly able to find new ways of doing things without relying on their chosen vendors, IT, or even their firms. If they are upset with their cable or telephony provider, they can now can get a service like Ooma or buy a set-top box like NVIDIA Shield and get the content directly. And many are choosing to do so. Employees used to have to beg IT for services; now they can contact Amazon Web Services, or Google, or even Microsoft and get what they need quickly.
This is empowerment, and as Peter Parker’s uncle once said, “With great power, comes great responsibility.”
Not Taking Responsibility
While we have conveyed incredible power to these people, and realize, “these people” include us, we haven’t properly conveyed the related responsibility. This is at the heart of why we have so many security breaches. People have gained the knowledge, power and access to do incredible things but they lack the tools and the training to ensure they don’t do more harm than good. Responsibility and security ownership should have transferred with this control but it clearly has not, and still resides largely with law enforcement and the security department.
Yes, we occasionally fire people, but in the exit interviews, you’ll see that the firing is a surprise. People generally never realize the risks they were taking in the first place. I imagine if a lot of folks fully understood the risks of using some of the cloud services and products they buy on expense money, they’d go back to letting IT provide them instead.
This is why we have so many breaches and why tools like Varonis are so incredibly popular. We have to make up for the fact that so many of our employees have great power but haven’t accepted the related responsibility.
Lack of Strategic Thinking
Many of the problems with corporate governance are the result of executives who, thanks largely to a preoccupation with quarterly goals and a lack of strategic training, can’t spell strategy. This is how we get CEOs who can’t do the job, see top executives hired without background checks, see placement practices that treat jobs that require special skills as if they are generic, and why we see so many executives flame out because of affairs or bad behavioral judgment. It is also why we see so many really bad products from experienced companies. They are focused on getting the thing out the door and simply not thinking about what will happen if the product totally sucks.
This is a really pronounced problem that’s giving us an increasing number of people in key business and political jobs who can’t perform. This is clearly having a major adverse impact on business and government.
Wrapping Up
The scary part of all this is that we are giving a lot of people more power but not conveying the responsibilities and strategic thinking that is needed to use that power wisely. Think about it: Risk management and strategy used to be the job of executives. Now we turn that over to people in staff jobs like Risk Managers and CTOs who have little to do with day-to-day operations and little authority when it actually comes to making strategic decisions. These folks often get the blame but they don’t generally have the authority to prevent the related problems in the first place. Even if they try to do their jobs, their voices are generally drowned out — as we saw in the market collapse — by an ever greater need to improve quarterly performance, even at the expense of long-term survival.
It’s like giving guns to people and training them how to shoot without adequately explaining when to shoot, or making them understand the related responsibilities of gun ownership. Even worse, we’re often giving folks who have no control over the shooting those same responsibilities.
So, to be clear, much of what we’re doing in technology is designed to empower employees and customers, but, I think, we are doing far too little to ensure that this incredible power is used wisely.
Rob Enderle is President and Principal Analyst of the Enderle Group, a forward-looking emerging technology advisory firm. With over 30 years’ experience in emerging technologies, he has provided regional and global companies with guidance in how to better target customer needs; create new business opportunities; anticipate technology changes; select vendors and products; and present their products in the best possible light. Rob covers the technology industry broadly. Before founding the Enderle Group, Rob was the Senior Research Fellow for Forrester Research and the Giga Information Group, and held senior positions at IBM and ROLM. Follow Rob on Twitter @enderle, on Facebook and on Google+.
