97 Things Every Information Security Professional Should Know

Chapter 11. “No” May Not Be a Strategic Word

Brian Gibbs

No. It is the easy way out, so delete it from your vocabulary.

As an information security professional, you generally are working for someone in an organization. The simplistic goal of an organization is to make a profit. Your role is to help that organization to understand and accept risk. There is a concept around balance where you can be 100% secure and 0% functional or 0% secure and 100% functional. Helping the organization find the correct balance is your role.

How do you go about saying no? You simply do not start with no. If you are in senior leadership, ask to schedule a meeting to review the idea or item in more detail. Then ask probing questions around this idea or item. You may surprise yourself with the additional information you gather. The initial no reaction may start to fade away with ideas on making this more secure and enabling the organization to proceed forward in a safe and secure method. Even if you still “feel” the answer is no, you should document the risks and present them back; if the organization decides to accept the risk, that is fine. You did your part by establishing the known risks and learning more about the idea or item without saying NO!

If you are a more junior member of the team, you can assist as requests come in by applying similar processes. It never hurts to pick up the phone or schedule ...