97 Things Every Information Security Professional Should Know

Chapter 73. Structure over Chaos

Rob Newby

The security industry, particularly when starting out in it, can seem like a mass of technology and/or processes with no real thread. Or a mass of people with no direction. And often it is one or more of those things.

It does not help that security originated from the most technical of disciplines, information technology. Indeed, many CISOs still report to CIOs, opinions on which range wildly and always elicit frenzied debate—quite another discussion altogether.

Many who work in IT pride themselves in deep knowledge in a particular area: we all like to visit the expert to get our technology fixed properly the first time and we admire deep knowledge more than we admire general knowledge—it is human nature.

Unfortunately, particularly at organizational scale, that also gives rise to silos in working. Technical specialists can be protective of their knowledge and skills, and while few actively act to block others out, use of terminology, acronyms, and pack behaviors among the elite can inadvertently cause a “them and us” type of culture that works against the business. In business, the generalists who can bring teams together win out, which only goes to further drive a wedge between technicians and business practitioners.

What helps with the orientation of cybersecurity within the business and coordination within cybersecurity departments ...