Net Present Value. Since coming to IT, I have spent much time focused on the topic of business value.  This topic has dominated customer presentations and events, CIO forums, internal discussions several blog posts and even a few twitter discussions that I've been having.  Whether an IT organization is attempting to justify investment to support a new project or communicating the benefit of an existing one, being able to communicate, demonstrate and deliver the value of those projects is critical.

What I have learned is that there are many different ways to communicate the savings or value created by a project.  Matt Beckert, Intel IT finance, and I have spent several hours discussing this topic.  Let me provide the cliff notes (simplified version) and why Intel IT is moving to a standard methodology focused on Net Present Value.

Many times you will hear individuals talk about how much they saved by doing something.  Example, yesterday I saved 10% by using a coupon buying a coffee at Starbucks.  I saved $0.35 on my $3.50 latte. So while I avoided spending $0.35, did I create value for myself – not really.

Value is often a collection of costs that include what I had to spend (my capital outlay), cost avoidance (what I didn’t have to spend), operational cost savings (how my daily costs are affected), additional revenue generated (what I earned), productivity gained (greater output for equal or less input) and several other variables.  Intel IT looks at a variety of business value metrics for our project portfolio.

In the terms of IT projects, the business must invest in something to achieve a goal.  The collective measure of money spent vs. benefit received is a Net benefit.  If I buy 100 t-shirts to sell for a charity and each t shirt costs me $5 and then I sell those t-shirts for $15 each, then the net benefit to my charity of that project is $1,000 (100 x $15 minus 100 x $5).

Expanding on my example further.  What if I did not sell those shirts immediately but I held on to them for five years.  In this case, my net benefit would still be $1,000 from the project but because of inflation, the value of that earnings is worth less to me than if I sold them immediately.  If inflation was 10% per year, then the $1,500 that I earned from sales would [when discounted back with inflation $1,500 / ((1+inflation rate) ^(# years))] would only be worth about $931 in today’s dollars today.  So taking into account the time-value of money, now this t-shirt project was only worth $431 to me in today’s currency or Present Value.

(Readers Aid.  If you anything like me, this topic makes my head spin, Matt helped me build a cheat sheet table that shows the time value of money depending on how long it is held and the annual inflation rate or discount rate applied over that period of time.  See the table at the end of this blog.)

It is possible that I could have earned more than $431 by doing another project or by maybe investing my original capital of $500 in the financial market and getting a better ROI (often called the “hurdle rate” for financial planning).  With many IT projects affecting a many types of cash flows over different time horizons, it is critically important from a financial perspective to compare apples to apples when looking at projects. 

This is why a Net Present Value is so important – it allows business leaders to compare the net value (return on capital) in present value (accounting for time value of money) across many projects, thus prioritizing the most important ones with an eye on the bottom line.

I have to admit, while communicating savings in terms of NPV is a lot more confusing and often less interesting (the numbers are lower than gross undiscounted multiple year savings numbers), it does enable a more level playing field and better articulates the actual impact projects are having on an organization.  For example, in the recent data center paper published by Intel IT, our gross benefit is estimated at $1B, while our NPV is estimated at up to $650 Million - depending on when we make the investments and how quickly we realize the benefits.  Either way you look at it, you can draw one common conclusion: our eight year Data Center IT strategy is creating a lot of business value for Intel.

Read Matt’s perspective on our Data Center Strategy.

Chris, follow me on twitter

NPV Table. The net present value of receiving $1,500 cash five (5) years from today assuming a 10% annual rate of inflation is $931.

It is Time for a Data Security Revolution!

Information technology has lagged behind society’s skyrocketing need to manage and secure data.  Information is growing exponentially and our demands for control and oversight continue to develop rapidly.  Efforts to create or improve current paradigms are fractured and have failed to reach the tipping point of the maturity cycle necessary to catch up.  We have failed.  It is time we shed our entrenched archaic ways and leap forward to revolutionize how data is protected and managed.  The confluence of changes in our culture’s expectations of data, demand we succeed.  A revolution in data security is coming; we can either lead or be trampled by it.

The problem

The world is demanding more control, security, oversight, and awareness of where our data is and how it is being used.  This includes information generated and processed at work, as well as our own personal information including financial, health, and privacy data.  As a society, we are just starting down the road to explore data loss prevention issues, privacy expectations, digital rights management, and electronic discovery requirements.  Additionally, we are just beginning to understand the vast, hidden, and expanding world of data breaches, identity theft, user profiling, and online victimization.  Intellectual property controls are more important than ever to businesses in the information age and the social networking phenomenon is opening our eyes to the need for better security and management of individual’s data and the systems which control it. 

Yet the current behaviors, tools, and infrastructure is vastly insufficient for what we need today and the gap is increasing, leading to a critical failure point in every way for what will be needed a decade from now.  As fast as technology evolves, it simply cannot keep pace given the confines of current structures.  We will be left with a snarl of vague and unrealistic regulations, unsatisfied community demands, incompatible point solutions, tools which can’t scale, and an entire generation of information victims.  A radical change is needed!

The storm is brewing

A confluence of conditions is manifesting to create a perfect storm for radical change.  Consider the following social and technical changes which will change people’s opinion:

·        Data exposures are becoming public, showing the terrible depth of the problem

·        The number of data victims, for identity theft and online crimes, is increasing as are the losses

·        Data, system, and privacy regulations are emerging across the world with complex variations, creating severe challenges for global compliance, interpretation, and compatibility

·        Social media users are realizing the honeymoon is ending, their data is exposed, and being used in ways they never intended

·        Malware is reaching epic proportions.  The trend is shifting to target capturing victim’s data

·        Individual opportunists, organized criminals, and nation states are actively working to control systems, data, and networks

·        Surveillance, profiling, and filtering controls are becoming mainstream to target or seek control of user data

·        The sheer number of people and businesses on the internet is reaching a critical mass to determine how the world communicates, and the engine driving an exponential growth in the amount of data being generated

This problem may be complex in the details, but it is simple in principle.  Basically, we manage data poorly.  If I create a document today and email it to a co-worker, I essentially surrender almost all control.  In a week’s time, I will have virtually no idea who has seen it, how many copies exist, how long it will stay buried on storage devices, or what modifications have been made to it.  I have no control to update the copies, control access, or revoke the files.  Chances are good that after a year I will likely lose it myself or forget the content of the document.  It is terribly inefficient and represents poor overall management of data.

This situation presents as both a technical and behavioral problem.  The personal computer revolution has bestowed the tools to easily create and store data.  The pervasiveness of the internet established the unprecedented ability to share and disseminate information.  The natural limitations of the pencil and paper generation supported modest but adequate physical management solutions.  The creation, distribution, and control were tangible and restricted to local resources.  Our newfound ability to generate and distribute information has not been coupled with equitable management solutions.  Caught in the euphoria of new freedoms, we ignored the capabilities to control and secure.  The shortcomings of technology have been tolerated due to an apathetic and disjointed demand from society.  We have failed as consumers to recognize the importance of our data and the deficiencies in the realization of how it should easily be managed.

It’s the 21st century; do you know where your data is?

Today, data is easily created, lost, transferred, edited, stolen, abused and destroyed with very few mechanisms to prevent, detect, or respond. 

Consider the following:

·        We don’t track who creates files and who owns them

·        Rarely do we consider if files should be secured or how

·        We don’t take steps to determine who should access, view, or edit files and where they can be stored

·        Destroying data after it is no longer useful, is a foreign concept, as is who should be responsible and when

·        We don’t understand who, at any given time, has possession of our data and how to effectively recall it

·        We have little insight to data content.  We rely on short and sometimes cryptic filenames to give clues, but we don’t comprehend contents in a meaningful way

·        Sharing data is mostly ad-hoc for specific files or locations, with little thought of content or other security factors which should be considered

In summary, we are poor custodians of data.  In fact, people keep better track of the clothes in their closet than the information assets they create every day.  I would wager you know where your clothes are, which are clean and which are soiled, and you have designated places for both.  You regularly maintain your wardrobe by cleaning, pressing, matching, folding and storing clothes in an organized manner.  Items are added, minor repairs made, and eventually clothes are purged when they no longer fit, are outdated, or simply not needed.  You plan and may budget when new clothes are required.  Depending on your age and habits, you may even have your name on them for ownership identification.  You organize your closet for easy searching and you know which articles have been loaned out and to whom.  For important items you would likely detect if they went missing and probably have a good idea of likely suspects, as you know and control who has access.  So why do we do such a good job at managing our clothes, yet such a miserable job at managing our data?

People have not yet put the mental pieces together, but they will.  When they do, they will demand technology deliver a solution.  Revolt will be at hand.

Current efforts

A number of current initiatives have been struggling to gain modest traction but will always lack the ability to deliver a complete solution.  Digital Rights Management(DRM) is well known in the online music circles, focusing on file based locks.  Data Loss Prevention(DLP) is a collection of practices and tools which can scan, classify, and block inappropriate transmission of data. 

Structures like Role Based Access Controls(RBAC), Mandatory Access Controls(MAC), Discretionary Access Controls(DAC), and Lattice Based Access Controls(LBAC) have attempted for years to establish controls within homogeneous and small environments, but rarely work as intended in large mixed environments like modern networks.  A variety of secure data repositories have emerged, which do a stellar job protecting a few critical items akin to a vault, but are largely inaccessible, inconvenient, and not scalable.

A quick summary of current solutions highlights why they are not scalable, will fail to provide a complete solution, and likely never be widely adopted.  Each of these does have its place and function but overall they will not deliver what is needed; a comprehensive capability to manage data security. 

1.      Vault solutions:  Secure some files in a locked system or repository and provide access via custom interface applications.  Not scalable for vast amounts of data, poor accessibility, high level of permissions management needed, inconvenient to use, and the trend to use proprietary software will keep the price tag high

2.      Scan and classify DLP systems:  Can apply controls both on clients and networks but relies on rules which are complex and a nightmare to maintain.  Ultimately this is why they eventually just get ignored.  Sustaining accuracy is not practical in environments which change and grow rapidly

3.      Scan and alert/intervene DLP systems:  Similar to Scan and Classify DLP systems, with an added benefit of intervention. Blocking suspect traffic and communications is a double edged sword, which requires high overhead to insure it does not interfere with legitimate business.  These suffer from the same drawbacks as their cousins.

4.      Employee policies:  Policies which rely on manual intervention are hit or miss.  For simple straightforward decisions they can be quite effective.  For complex data decisions, changing environments, and potentially vague situations they fail miserably.  People simply don’t act consistently when faced with complex decisions

5.      System policy (MAC, DAC, and LBAC) solutions:  System based solutions which can work well while data stays on the system but fails when collaboration across systems and users is required.  They simply lack the applicability, scalability, and compatibility across a network with various uses and complex situations of collaboration and security.

6.      Group/role access policies (RBAC): The natural evolution of the MAC, DAC, and LBAC concepts, can work great for small groups and data in an environment which does not change often.  As the numbers and data size grows, the administration increases and ultimately does not scale efficiently.

7.      File lockdown systems (DRM): Locking down files with digital rights (DRM) can work in situations needing a simple access control.  Allowing a file to be opened or not, for example.  But it does not work well when a multitude of access options are needed and other controls are required.  Compatibility also poses a problem when sharing such files across systems.

8.      Secure critical files and data solutions:  File encryption is the major player in this field.  Target only the most critical data and files, and focus on protecting those.  Not scalable with the increasing amount of data organizations are processing and the shift of data across a much broader user and system landscape.  Works great for handfuls of people with a small number of files needing protection.  Those days are gone.

9.      System data protection solutions:  As file encryption has too much overhead necessary to scale, just encrypt the entire system and network.  Works great for lost laptops but does little when the user has logged in and everything is now easily accessible.  Network encryption only protects against sniffing.  A good evolution but not nirvana.  It is a one trick horse for confidentiality.   

10.  Do little to nothing and hope for the best.  Don’t laugh.  You might be surprised with how many financial, health, educational, and governmental systems followed this model for most of the past decade. 

The list goes on.  This is not comprehensive, but does give a taste of some stovepipe solutions which are struggling to evolve even slightly and will never leap forward on their own to meet what will be demanded.

Overview of solution

How do we succeed?  We combine some of these technologies, integrate into the base computing infrastructure, and ease in the necessary user behaviors into the fabric of how people create, use, share, and destroy data.  It must combine an object oriented definition structure and network based management controls. 

Four core aspects for identification, security, and management of files

Data objects must carry specific characteristics to enable the computing environment to effectively and efficiently manage security.  Although discrete parameters may differ based upon data type and parent organization, these aspects represent the necessary structures which work together to enable automation and to define security practices.  Additionally the characteristics themselves must be secured and compartmentalized.

1.    Confidentiality Designation – Level of sensitivity and confidentiality for the data.  This has implications on required controls for data at rest, in use, and in transit.  Also can define requirements for where and who can access and store the data.  Examples might be Top Secret, Secret, Business Confidential , Personal, and Public.  Classifications have implications to the Access and Handling aspects.

2.    Access Rights and Permissions – Who has ability to access, edit, store, copy, transfer, etc. the data objects.  DRM and RBAC technologies and DLP principles are a good start.  The object must securely contain the concepts of ownership and those trusted to use the data in different ways, including to open, edit, destroy, move, copy , and transmit.

3.    Content Synopsis, Tags, and Keywords – Identifying content supports indexing and understanding relationships between files.  It facilitates scanning and auditing against policy as well as automation for determining access, classification, and secure handling requirements.

4.    Secure Handling – Secure handling parameters determine retention, backup, destruction, storage, usage and transport requirements.  These can be set by a default policy and updated based upon other aspects.  Data Lifecycle Management (DLM) provide a good foundation for some practices.

These four aspects cooperate and influence each other.  If for example, file content changes to include secret information, the classification may automatically bump to a secret designation, the secure handling settings will force persistent encryption, and change the access rights to allow access by a smaller community. 

Cookbook of requirements:

This is the wakeup call for firmware, operating system, application and security solution providers.  To change how people manage data, from creation to deletion, will require the major players to work together with standards and Application Programming Interfaces (API’s).  We are not just altering one piece or bolting on additional security, we must change the fundamentals of the very infrastructure we use to manipulate data.

Some inroads have begun.  DLP and DRM systems have established expertise in some preventative, detective and responsive functions.  Social media is leading the way in many respects with tagging, sharing, collaboration and most importantly tracking and metrics.  On the most modern sites, an author can post a video and track how often it is watched, by whom, and if they are using it in other mash-ups.  A great deal of data can be gathered and if analyzed correctly, transformed into usable intelligence.  Social media is the looking glass for what is to come.

These requirements are critical for success:

·        Must apply system wide, embedded seamlessly in hardware, Operating Systems, and applications.  It must include all data which is created, viewed, modified, transported, or deleted by users

·        Must span across users, client systems, and into the backend infrastructure

·        It must be holistic in nature and apply  from creation to deletion (birth to death) for data and files

·        Must possess default security for creation, storage, transit, and when in use

·        Support at a minimum, basis functions of DLP, DRM, meta-data, content tagging, RBAC, client agents, data tracking, and control repositories

·        Maintain a centralized structure for metrics, audits, maintenance, discovery, and reporting

·        Distributed and centralized hybrid system supporting comprehensive scanning, indexing and auditing

·        Enable data tracking, verification, auditing, and ownership administration

·        End-user involvement and empowerment, to directly access and manage control systems and distributed data

·        System interoperability across separately controlled domains and networks

·        Establish end-user ease of use, manageability, and scalability at all integration points:

o  Straightforward setup with additional modular extensibilities

o  Default settings based upon role for confidentiality and handling

o  User interface validation of parameters, and extra owner options, when saving, editing, moving or transmitting files

o  Default access rights based upon groups, tags/keywords, and storage location (for example, inherited rights based upon storage location or of like files)

o  Escalation and resolution options when actions are prohibited by the system

Vision of Success

We have the intellect to succeed.  We can create a new paradigm which meets the needs of legal, privacy, security and most importantly the maturing expectations of everyday people.

Keys to strategic success:

·        Make the capability embedded, easy to use, and secure by default.  Minimize impact and overhead to the users

·        Champion behavioral changes of users and administrators, show the value

·        Drive client Operating Systems and Applications to conform and support standards

·        Leverage security tools to extend services and controls

·        Establish back-end infrastructure support via standards

·        Foster competition to drive affordability, scalability, support and continuous improvement

Key capabilities for value and functionality

·        Automated intelligent determination of initial core file aspects, with validation by users during file management requests (save, transmit, copy, etc.)

·        Automated security controls applied and enforced based upon file aspects and derived control requirements

·        Automated data cleanup, archival, and destruction based upon file aspects and settings

·        Data owners can easily search and organize their files both local and across the network

·        Data owners can easily take control to manage access, confidentiality settings, change file handling parameters, and revoke files across the network

·        Administration can conduct broad electronic discovery searches for files and data content, generate operational metrics, and gain an understanding of where sensitive data is located and how it is being used

·        Automated security alerting and logging to assist with detection of unacceptable actions, resolution to events, and predictive information to facilitate the establishment of future preventative controls

Example Use cases

New document creation

Capturing the meta-attributes at the point of creation is a critical step.  As a mock-up, this email was created and a default set of icons appear in the toolbar, showing the status of the 4 aspects.  These default settings align to Confidentiality Designation, Access Permissions, Content Synopsis, and Secure Handling settings configurable by the organization or user.  They establish base parameters but change dynamically as content is added.

As text is added, the system determines the content to match criteria which changes the classification, associates to a current project, adds to the content tags, and modifies access permissions automatically.  The icons change in appearance to show how the data will be treated.  The user can intercede manually by clicking the icons, which will open the user interface showing more options and configurations.

Saving, moving, deleting or transmitting data

A modified window appears whenever users attempt to save, move, delete or transmit data.  This confirms settings and if needed, solicits additional necessary data to complete the transaction.

End state vision

·        From creation to destruction, data is automatically classified, secured, and under the control of the owner

·        Additional capabilities extend to allow complex management, sharing, security, and tracking

·        End users are empowered to easily organize and revoke their data, control access, and know where it resides

·        Through leveraging technology, data files are treated like assets and security is efficiently managed across user domains

Conclusion:

Change is coming.  The underlying community, regulatory, and behavioral factors are present and becoming more prevalent.  The information technology and security industries must escape the façade and false hope of small improvements and truly revolutionize how data is secured and managed.  This can only be accomplished with aligned industry partnership, a realization of necessity, commitment to user efficiency, common technical standards, and most importantly a shared strategy.  It is possible.  Now is the time to think, discuss, and plan.

Reading from news (http://news.cnet.com/8301-13577_3-10368956-36.html) today, a survey has shown that 54% workplaces block social networks completely. I'm glad to be in a company which is the 10% which allow social-network use at work so I can stay connected with my external partners and industry peers. It seems the debate on whether social media is a effective business tool or a productivity drain is still going on.

In Intel, we are embracing social media as a mean to transform collaboration in Intel. We see the opportunity out weights the potential risk. We are deploying a social media platform for our employees. You can find out more about our social media strategy from our recent white paper (Developing an Enterprise Social Computing Strategy) and the blogs from Laurie Buczek (Why Intel is investing in Social Computingand Intel's Enterprise Social Computing Strategy Revealed).

Personally, I think social media is going to repeat the history of email and instant messaging (IM) at work. Few years ago, there were skeptics about IM at work. Our CIO at that time, John Johnson, took the risk and deployed IM in Intel. Today, it's a productivity tool that I cannot live without. This morning I was troubleshooting a problem with a colleague waiting to broad a plane 16 hours away thru IM. I frequently talk to my colleagues around the world. They could be anywhere in office, at home, or on the road, when I need to connect with them. Whenever they pop up online, I can get hold of them. Without IM, life will be much more difficult and less productive.

I have been participating in a IT pilot program testing out Windows 7 in our environment. We have a Windows 7 group setup in our social media platform where we share BKM and help each other. I got workarounds from the forum for issues I ran into with the beta version of the operating system. I also contribute my findings and solutions back to the group. Together we are creating a rich knowledge base for the Windows 7 program team. The pilot users around the world were helping each other and saving each one of us a lot of time learning about the new OS, troubleshooting and finding workarounds. This is an excellent success story for social media at work. (Find out our Windows 7 experience here: The Value of PC Refresh with Microsoft Windows 7*)

What is your view of social media at work? Is your company putting up a strategy to adopt the technology?

I hate fixing the roof.  In fact, I have been postponing a roof repair over my garage for about 2 years now.  I recently read an article by Peter Kretzmen titled “IT, The CIO, and the Business Need for Roof Projects” and realized that while I can put off my roof repair, IT may not be able to postpone routine upgrades. 

For businesses, technology refresh is a standard business process (ie a roof fix).  The question for IT often boils down to WHEN I should upgrade, not IF. Why? … because hardware technology ages, maintenance costs rise, and software solutions can become unresponsive or obsolete as business needs change, user needs evolve and new technology and software become available. In this economy, cost is king and reducing IT costs has clearly become a critical imperative.

My colleagues in Intel IT recently conducted two separate and independent studies on how frequent we should refresh our PC fleet and data center servers.

PC Fleet Management:  John Mahvi and Avi Zarfaty from Intel IT recently wrote a paper titled “Using TCO to Determine PC Upgrade Cycles”.  The conclusion of this analysis showed that a 3.5 year refresh rate was optimal for total cost management in our IT environment.  Despite the fact that delaying PC refresh this year was initially seen as a cash conservation approach, the analysis showed that not refreshing older PCs increased the business’s overall costs.  As a beneficiary of PC refresh (I got a new laptop a month ago ), I can also personally attest that my productivity has gone up.

Data Center Efficiency:  Matt Beckert and Diane Boyington of Intel IT recently published a paper titled “Realizing Data Center Savings with an Accelerated Server Refresh Strategy”.  This paper discusses Intel IT’s movement to a proactive 4-year server refresh cadence in 2007 and illustrates both the long term savings (up to $250M over eight years) and immediate benefit to the corporate bottom line ($45M saved in 2008). After plans to refresh our servers was slowed earlier this year to preserve capital funds, a re-assessment was done that showed that Intel IT could save $19M by refreshing now vrs waiting until 2010.

Just like you shouldn’t sleep in a house with a leaking roof … it is prudent to not let old hardware create a hole in your IT budget. In today’s economic environment, Intel IT can’t afford a leaky roof and so we are moving forward with proactive business client PC and Server refresh, proven approaches to reduce TCO and boost business value.

Chris Peters, Intel IT

twitter @chris_p_intel

For the last 18 months, Intel has invested a significant effort to develop a full strategy & implementation roadmap for social computing within the enterprise.  I am pleased to announce the release of a white paper Developing an Enterprise Social Computing Strategy that I did jointly with Malcolm Harkins, Chief of Information Security. The paper details our approach towards embracing the use of collaborative technologies while addressing the mitigation of legal, HR and governance issues.  Here are some key areas you will find detailed in the paper:

• The business focus for social computing (also refer to: Why Intel is investing in Social Computing
• Collaborative approach IT, HR and Information Security
• Intel's integrated architecture
• Intel's approach to determine early use cases, business value and vendor/solution evaluations
• Results of a security risk assessment
• Phased implementation plan
• Initial results after 3-1/2 months into deployment & adoption

There are a lot of key takeaways within this paper.  The biggest one that I hope you will walk away with is:  Enterprise 2.0 is a challenging effort.  Yes, there are risks.  But Intel hasn't discovered any new risks introduced with 2.0 technologies that doesn't already exist with 1.0.  We believe the opportunities outweigh the risks. In fact, we are convinced that inaction carries much greater risks: that the enterprise will not realize the benefits that social computing can deliver, and that employees will increasingly turn to external, unsecured tools for communication.  IT has a leadership opportunity to get ahead of and deliver emerging platforms, at a fraction of the cost of "standard" collaborative infrastructure, to enable their business to stay one step ahead of the competition. 

I hope you enjoy the paper.  I welcome your perspectives and learning about that strategy that is yielding success for you.

I was recently trading thoughts with Anton Chuvakin, a respected security metrics professional, in a philosophical discussion of perfection and quality of security.  Admittedly, I was on auto-pilot (operating without the benefit of coffee) rattling away with my ‘Optimal Security’ rhetoric, when Anton posed two thought provoking questions: CAN one "mandate optimal security"?  How do you "mandate flexible"?

I was stopped in my tracks.  This got me thinking.  After fetching a tall cup of coffee to start my brain juices flowing in earnest, I reached back into the pages of history to come up with the following perspective and examples:

I believe, to a certain extent, we can mandate flexibility and optimization.  Surely we can act in ways which deny both.  So why can’t we act in a manner which intrinsically promotes them?

I think back to lessons of WWII and the Maginot line.  The French chose to create a fortification which was static by design and lacked mobility or a capability to adapt to changing enemy tactics.  They invested heavily into this control, which became the backbone of their country's eastern defense.  It was an appalling failure.  Alternatively, the German blitzkrieg, and the stratagems of both Rommel and Patton prevailed.  Flexibility through mobility was far more effective than an elaborate static defense.

I would argue that flexibility can be mandated through proper planning and design.  We have examples in the history of information security.  In the early years of Anti-Virus (AV) products, they were non-memory resident applications which were prescribed to be run once a week.  Updates were a rarity if at all.  That rigid design quickly lost effectiveness, with the rise in velocity of new malware.  AV vendors were forced to adapt.  The overall design has changed to one which is flexible, can be updated to meet emerging malware, and continuously runs in the background to provide persistent security.

Rigid security postures lack the ability to remain effective over time and are likely derived by an equally rigid infrastructure which will struggle to adapt to new threats and changes within the organization.  Create security to be flexible and you enable the service to keep up with the continual changes.

In general, design a system to be flexible and its longevity for effectiveness is extended.  Plan how systems can continuously adjust itself to align to what is 'optimal' and you increase the sustaining efficiency.

We must be strategic in our planning and design of security, lest we suffer the fate of France's Maginot line.

Check out Anton’s Blog for other thought provoking viewpoints; just be sure to have your coffee at the ready.

More on “Optimal security”:

Strategy for Sustaining Optimal Security

Information Security Defense In Depth Whitepaper is Now Available

Fortune Cookie Security Advice - June 2008

Defense In Depth Strategy Optimizes Security

The Four Dirty Questions of Measuring Information Security

What are your thoughts?  Rigid or Fluid?  Have you implemented optimal and flexible?

Optimal security must not only be attained, but also sustained over time.  A good security strategy must be forward thinking to understand how intervention and continual maintenance will be needed, then implement those capabilities as part of a complete service deployment.

'Optimal Security' is the right balance of security spending and losses prevented where business acceptable losses are achieved.  It changes often and likely maintains different targets for the dissimilar parts of the entity.

Organizations are likely to mandate security expectations which typically manifests in a set of configurations, specifications, and operating standards.  The risk is these security controls may be relatively static and entrenched.

Establishing a baseline security is a good practice, but in order to remain effective it must adapt to changes in the environment by remaining dynamic to keep in lock-step with rapidly changing threats, vulnerabilities, and resulting exposures.  It must be a fluid posture, able to rapidly change based upon different internal priorities and external changes.  Sustaining business structure must be designed to continually predict areas needing modification and support design and deployment of those changes.  Rigid security postures lack the ability to remain effective over time and are likely derived by an equally rigid infrastructure which will struggle to adapt to new threats and changes within the organization.  Design security to be flexible and you enable the service to keep up with the continual changes in the information branch of security.

I recently spoke with an organization who had established a security posture which relied heavily on a hardened OS and application build for their systems.  At the time, they deployed a platform which took into consideration all the best configurations for hardening.  They were so confident they had satisfied security requirements they considered the problem solved.  They integrated the security design into their normal platform refresh cycle of system replacement every few years.  They never comprehended the fact they would need to continually update the build to compensate for changes in threats, new vulnerabilities and malware, and evolving business usage models.

The platform’s security, which initially was strong, began to quickly erode.  With no internal mechanism to identify when changes needed to be made, nor the testing and distribution capability, they soon found themselves in a situation where they were responding to individual incidents and changing systems one at a time based upon particular end-user needs.  This created inconsistencies in the builds which was more difficult to support.  Without proper forethought, the security team turned themselves into a firefighting organization, losing the initiative in the war of security.

This is one simple technical example.  The same holds true for the expanse of automated solutions and behavioral security controls as well.  Highly effective and efficient security strategies are forward thinking and understand how intervention and continual maintenance will be needed, then implement those capabilities as part of a complete service deployment.  Overall, the concept of ‘optimal security’ is one of fluid adaptations of controls to meet an ever changing target for risk acceptance.