Opinion: Getting to governance

Asserting information security's place at the management table

Looking over his glasses with a librarian's stare, an executive recently told me, "You IT people love the word governance, but it just seems too...." His voice trailed off as he searched for a way to tactfully convey his sense that "information governance" was a linguistic wedge designed to throw open the doors of board-level access for unkempt geeks and help desk managers. Instead of "governance," more comfortable phrases were suggested: "information policy board," "data management" or perhaps "IT steering committee."

Governance is a powerful word, and its use in an IT context implies that information is important -- which of course it is. Stripping away the trappings of applications, systems and networks, information is the core asset of most organizations. Establishing information governance is not, as some might think, the elevation of firewall administration to a board-level duty, and it doesn't mean the security controls that protect information subvert all other business processes.

Quite to the contrary, if information governance is planned and managed properly, information security controls end up being close parallels to, or integrated within, existing business processes. It is the establishment and maintenance of a connection between the organization's most valuable assets and the organization's control structure. Embracing governance concepts is the admission that we have assets we've ignored and that there needs to be some sort of structure that makes information tangible, addressable and protected.

"We've got some rules around here"

When challenged to explain information governance to executives, it's easy to digress into academic and philosophical debates over the centrality of information in a business. But that structure -- identifying information so that it's tangible and can be protected -- is the essence of governance. It's the explicit statement that there are rules about how people use processes and technology that affect or protect information.

The good news is that the concepts surrounding governance are becoming more easily understood as the professional dialogue and community body of knowledge becomes more mature and refined. A few years ago, one might have had to dig through the ISO 20000 IT service management (or the IT Infrastructure Library) and ISO 27001 (security management) standards to find the right words about establishment of a "management system" and to explain the desired governance framework for an information-heavy organization. Now there are numerous voices -- some better than others -- providing definitions and discussion on the topic.

More recently, respectable certifications have become available for professionals involved in the establishment or operation of information governance systems. For example, the Information Systems Audit and Control Association (ISACA) is administering its first test for the Certification in the Governance of Enterprise IT (CGEIT) this fall.

To measure is to know, as the adage goes, and as more people buy into these programs and refine the collective understanding, the closer we collectively get to Dan Geer's goal in Measuring Security (download PDF): "To move from a culture of fear to a culture of awareness and then a culture of measurement."

Who's in charge?

Establishing a structure is all well and good, but even when information is recognized as a high-value asset, many organizations still stuff the responsibility for its definition and protection down into low-level records and IT roles. This simply doesn't work, because those roles often don't have the authority to properly implement or manage the controls, and the new responsibilities take second place to existing job tasks.

For example, information classification (download PDF) is required in order to qualitatively categorize and determine what controls are appropriate to protect information, but does an IT director have the authority to mandate a classification scheme for an organization? Such attempts are often dismissed as data classification, when in fact the effort ought to apply across business units.

Likewise, would it be appropriate for IT to change the business rules for access to information because of a technical limitation or new feature? It's unfortunately common for organizations to become enamored with new connectivity features in a data repository or interface and to use that to open remote access or data interchange for remote partners. But just because you can doesn't mean you should. Access changes should be driven forward by business need and backward by risk. Technical capability is a secondary question for IT.

A limiting factor is that the larger cycle of information includes requirements gathering, governance, metrics, process controls, technical controls and audit -- and then a loop back to revision of requirements, governance feedback and adjustment, and so on, again and again. IT owns the middle of this sequence, but not the requirements, audit, or other beginning or end tasks. Someone needs to lead the beginning and end to ensure the middle (the IT part) connects and aligns with the rest.

This is why IT managers or directors are a poor choice for information governance leaders: One can't simultaneously be responsible for the implementation of controls and the audit of whether those controls work properly. A governance leader might be a senior manager or director who handles information in all forms (such as physical and electronic records management), or an executive responsible for compliance. But putting information governance program establishment or reform under the IT organization makes it control-focused, not asset-focused or performance-oriented.

Being serious

After a while, the emergent pattern one sees in information governance and effective security closely matches proper business process. Security nirvana is achieved when security controls asymptotically become indistinguishable from right and proper business process, and alerts from business process variances and security control breaches are one and the same.

Bruce Schneier recently espoused the idea that security has to be "sold" on one side of the balance sheet or the other; either it enhances the profit centers and adds to the bottom line, or it reduces actual loss. However, when information security controls end up being close parallels or integrated within existing business processes, it means less selling, less disconnection and fewer moments where executives perceive information governance as some kind of power grab from IT.

When information governance is treated like any other critical asset-control process, it's possible to move forward and make security less independent of the business. And that's what we're after, isn't it?

Jon Espenschied has been at play in the security industry for enough years to become enthusiastic, blasé, cynical, jaded, content and enthusiastic again. He is director of security consulting at Consciere LLC, and he continues to have his advice ignored by CEOs, auditors and sysadmins alike.

Copyright © 2008 IDG Communications, Inc.

7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon