97 Things Every Information Security Professional Should Know

Chapter 8. And in This Corner, It’s Security Versus the Business!

Ben Smith

Too many promising careers are derailed by the belief that working in information security is purely a technical job.

Many of us arrive into the information security space via the technical realm. Perhaps you got started through hands-on configuration of firewalls and routers, or managing your organization’s domain server, or developing secure interfaces to databases, or working an IT help desk where you kept raising your hand when someone called in with a security question. Or all of the above.

And as your knowledge expands, along with your career, you may even move up within your organization: from a frontline engineer or analyst, to a network architect, to a team lead, to a people manager. Each step up the ladder tends to expose you to a wider set of technologies and responsibilities.

At some point during all this upward mobility, a light bulb switches on. Some of us notice it, but many do not.

Every organization grows silos over time, partitioning corporate functions into separate management buckets. It’s expected, and largely natural, but over time the presence of these silos can be unhealthy—even a threat to your organization’s ability to scale your business.

Nowhere is this threat more pronounced than in an organization where the information security team is unaware, or unwilling, to take the time ...