Sometime ago a colleague and I were discussing the security arrangements for a particular site. We agreed on the asset we were trying to protect but could not agree on the security solutions that had been deployed and this quickly became quite a heated discussion. I believe that security in its purest form is quite simple, yet if this is true why is it one of the most emotive topics for me right up there and alongside with religion, football and now coalition politics.
I suppose the purpose of writing this blog and sharing my experiences, questions and concerns is a way of me trying find out more and attempt to understand what it is about security that makes everyone an expert. I understand that the physical or technical security application to a site, risk or areas is important, but will always strongly maintain that without the right people, processes and procedures it doesn’t matter about the Rolls Royce kit if it’s not being utilised properly.
I was fortunate to present at the recent Counter Terror Expo 2010 on providing assurance to senior management of security risks. Whilst preparing I found myself getting angry at the lack of people in the security world actually talking about this subject and noted that there are lots of ideas, discussions, plans and strategies about what the government do and how parts of the Critical National Infrastructure (CNI) are assisted by that, but the gulf between public and private I think is just too great. What happens to the private company, limited company or the small business that would not have exposure to or have the staff to understand the CONTEST strategy or the HMG Security Policy Framework (which I believe is being widely touted and over used as the way forward) what does it mean to any of them? The same could be said for most other areas of the (and for now I use the words loosely) ‘security world’ as what do they do about countering fraud, personnel security and screening arrangements for the insider threat.
Following my presentation I received feedback from a couple of visitors who said it was interesting and that they hadn’t really given providing assurance much thought, "my Finance Director could understand some of our security risks that way, thanks". Now I am not suggesting it was a pinnacle of my career but I took this feedback as a compliment (don’t get many so I’ll take it) but thought maybe I should open this discussion up to others, maybe I could post some of the questions that I don’t think I could answer without comparing it to religion, football or politics. So here goes…..it’s a simple one really….. Ready….....
What is Security?
I really hope anyone visiting this blog can help me, I am guessing there's no absolute right or wrong answer but any comment will assist in my quest, thanks for reading.
I suppose the purpose of writing this blog and sharing my experiences, questions and concerns is a way of me trying find out more and attempt to understand what it is about security that makes everyone an expert. I understand that the physical or technical security application to a site, risk or areas is important, but will always strongly maintain that without the right people, processes and procedures it doesn’t matter about the Rolls Royce kit if it’s not being utilised properly.
I was fortunate to present at the recent Counter Terror Expo 2010 on providing assurance to senior management of security risks. Whilst preparing I found myself getting angry at the lack of people in the security world actually talking about this subject and noted that there are lots of ideas, discussions, plans and strategies about what the government do and how parts of the Critical National Infrastructure (CNI) are assisted by that, but the gulf between public and private I think is just too great. What happens to the private company, limited company or the small business that would not have exposure to or have the staff to understand the CONTEST strategy or the HMG Security Policy Framework (which I believe is being widely touted and over used as the way forward) what does it mean to any of them? The same could be said for most other areas of the (and for now I use the words loosely) ‘security world’ as what do they do about countering fraud, personnel security and screening arrangements for the insider threat.
Following my presentation I received feedback from a couple of visitors who said it was interesting and that they hadn’t really given providing assurance much thought, "my Finance Director could understand some of our security risks that way, thanks". Now I am not suggesting it was a pinnacle of my career but I took this feedback as a compliment (don’t get many so I’ll take it) but thought maybe I should open this discussion up to others, maybe I could post some of the questions that I don’t think I could answer without comparing it to religion, football or politics. So here goes…..it’s a simple one really….. Ready….....
What is Security?
I really hope anyone visiting this blog can help me, I am guessing there's no absolute right or wrong answer but any comment will assist in my quest, thanks for reading.
Security means different things to different people and there are lots of people working in security who do not properly understand ‘what security is’! Security does have bit of a stigma attached to it and this is mainly because security is perceived by many as purely people stood next to a door whilst wearing a uniform and maybe also the words ‘police, army, power crazy, can’t get a job elsewhere, little Hitler’s’ all spring to mind, but the modern day security professional is much more than this. Most days I have to wear the hats of many different professionals including ‘HR, Legal, Auditor, Investigator, IT, CTSA, Risk Manager and Business Manager’ too name a few – how many other non security professionals can truly say they have this combination of experience!
ReplyDeleteIn order for security to be taken seriously the ‘tone from the top’ has to be right, you should have the supporting polices in place and some kind of assurance mechanism to make sure security risks are being effectively managed and mitigated.
In private and public organisations security is called lots of different things, but their responsibilities are very similar. So ‘WHAT IS SECURITY’................how’s about - the combined polices, procedures, persons to protect an organisation against danger, loss or criminals?? It you want more than I will need two sides of A4 paper please. Rgs, PD