An Unappreciated Reason Why Information Security Policies Fail

Abstract

I’ve had the questionable privilege of working in this field for over two decades now and all that while there has existed an assumption that every information security specialist seems to make, an assumption that needs to be re-examined, an assumption that needs to be radically changed. This assumption is that workers are going to come to the information security trough when they get hungry, when they want some information security sustenance. So many of us information security specialists assume that rank-and-file workers are like horses or cows, that they will come back to the source of expertise when they need guidance. To the contrary, time and time again modern workers show themselves to be independent and quite capable of making local decisions without involving information security specialists. In many companies, these independent workers have for instance set up web pages or even commerce servers without consulting or even thinking about a central information security staff person.