Security RiskManagementBuilding an InformationSecurity Risk ManagementProgram from the Ground Up

Most information security training programs churn out security practitionerswho know which static security patterns to follow or how to run a tool but, ifchallenged, they can’t explain to you why it should be done that way and theycan’t adapt to situations outside the template that they learned in class. So manyin the field don’t see the value in taking the time to understand the principles ofinformation security and how to apply them to a dynamic environment (sorry, theCISSP doesn’t count as proof that you can apply information security principles).This constant focus on the operational and technical side of information securityis creating a large percentage of security practitioners who have no idea what todo when the situation doesn’t fit their static patterns or, even worse, they mista-kenly apply the same checklists even if they don’t address the actual risks. Thenext time you are interviewing for a security role, try asking the candidate notonly how to implement a security control but also to explain why that control iscritical at all. The scary thing is that most people can’t explain why. They havejust always done it that way or have been told to do it that way and they neverquestioned it. What if the variables change, would they know what to do? Thereality is that most of these practitioners can’t adapt.