Why information security is NOT just an IT issue

Time and again, when I talk to business owners and managers about information security, I get the line "that's an IT issue" or "our IT guys look after that".

Whilst I'm well aware that IT and IT security plays a significant role in information security, it is not the Holy Grail many people seem to think it is.

IT is not some kind of magic wand you wave over your information assets to suddenly make them secure. The careful and appropriate use of IT solutions aids information security, but it is not a way of enforcing information security in its own right. Think of IT as a method of securing your information and data whilst it's being used or accessed electronically. That's all IT can ever hope to do.

But, by making information security an IT issue, many senior managers feel they have done their duty, and allocated it to someone who can deal with it. The problem here is that without senior management buy-in, and a top-down culture of security and security awareness among non-IT staff, the 'IT Crowd' can only achieve so much.

Often, IT security controls and processes, implemented without the understanding and support of non-IT staff, will be circumvented. If staff feel that IT is getting in their way, they will do everything they can to work around it or subvert the  controls. This is how we end up with users sharing logins and passwords, or documents being emailed to large groups of people because "So-and-so can't access them".

It is also worth remembering that not all information within a business falls under the control of electronic or IT systems. Almost every business in every industry will have printouts or hard-copies of documents, files and folders, and hand written notes, much of which contains business critical or at least business  important information – otherwise, why would it be there?

To successfully implement an information security programme, managers and business owners need to take ownership themselves. They need to be involved in defining the policies and procedures. Then they need to involve their staff in the process and educate them as to WHY they need to adhere to the policies, HOW to do it and WHAT the consequences will be if the processes and controls are not followed. They can then use the available IT solutions to assist with implementing the controls defined by the policies, whilst also ensuring that all staff are informed and educated as to why they are needed.

Information security is NOT an IT issue, but done properly IT can help you achieve your information security aims. You just need to make sure you've defined your business objectives beforehand, and educated your staff along the way.