Information Security - More about Implanting Practices Than Just Awareness & Training

With more and more data getting electronic, and with more and more data going on line, information security is becoming a vital discussion and area of concern for organizations, federal agencies, governments, even individuals.

Because of this, many organizations have been spending a certain amount of effort and time in conducting awareness training, and, coming up with ways to make people more aware with hoardings, sign boards and what not. This is done to take the best short-cut approach in making their most vulnerable asset for information security, their people, educate and realize the pros & cons, and to preach awareness about how responsible they should be.

But lets be honest to ourselves? Have we been successful? There are still cases I hear knowing organizations, colleagues, friends, acquaintances compromising their vital information and getting hooked, whether be their own personal credit cards, documents and what not!

I believe that a well presented training and awareness program does invoke thoughts about aspects of information security and realization of being secured, but it CANNOT ensure how the attendees may take that very invoked thought ahead and if they can really implement the thoughts in their lives, unless and until they happen to witness an incidence themselves!

Through this article, I am trying to open a thought process, where we think beyond just training and awareness campaigns, but infact implant the very practices in their people.

Everybody is aware about wearing a seat-belt while driving and helmet while riding, everybody is aware about the fact that smoking tobacco is injurious to health, everybody is aware about the benefits of having good food habits, exercising daily and waking up early. Awareness exist, but practices does not.

As health is important for people to think about, similarly, information security is equally important for organizations to maintain their competitive edge, confidentiality of their data, integrity of their organizational practices, and availability of resources and data as and when required.

By and large, following are the gaps with training and awareness programs:

• Training programs are not aligned with the risk assessment that has identified the potential risk areas to the business and organization;
• Success of majority of training programs are immeasurable;
• Majority of training programs are unrealistic and based on generic aspects i.e. they're not tailor-made;
• Focus is more on presentation, or as a periodic practice of just having a training program but not on what people want.

So what next?

Simple. Just three aspects:

1. Conduct risk assessment to identify risks;
2. Target behavior change;
3. Prepare a yearly timeline and set realistic targets;
4. Engage people personally.

Lets get realistic. Lets start putting efforts in the right direction, because you anyways are or you anyways will have to. Remember, precautions are always easier than corrections! The awareness has to be embedded in the most important and most vulnerable asset of the organization - human resource i.e. people, and at certain stages in some organizations, this has been.

For example, when was the last time, you changed the password of your LinkedIn, Facebook or Twitter account? That's because LinkedIn or Facebook doesn't prompt you to change passwords every 60 days! But, if you work in an organization, where the password is set to be changed in every 60 days, you will do it, and there's no other way out to avoid it. But again, every organization doesn't has this practice implemented or is been restricted to certain users; but they will always talk about securing their data and pass-coding their machines / workstations through passwords!

Tail-gating, phishing emails, malware attacks, you've been talking about it in your training, but no one takes it seriously. Implement practices to curb or catch hold of people to train them that they are doing it wrong.

For ex: create a dummy account, send an email which looks like a phishing mail, see how many open it. Call those people and then train them, that it is not the correct practice and they shouldn't be opening emails, make them aware about the real time incidents of how the accounts of even many CEOs, CTOs were compromised because of phishing emails and the consequences, ask them to report such emails to the network monitoring team (or whosoever can take care of these aspects in the organization). 

You see an unlocked workstation, click it and then tell the custodian that you were abut to send his resignation letter to his boss with a pinch of humor. 

I believe Information Security is one of the most discussed and challenging subjects for organizations, federal agencies, and governments, but at the same time it is one of the most easiest practice to secure the information, only if you follow the basics and the under-lying processes efficiently. The most basic fundamental about information security is the fact that it all depends on the custodian themselves to realize how vulnerable they're and it is them who must follow and embed culture around them to become immune to any InfoSec attacks! It is like snow and rains, which is targeting everything around you, but if you have the right gear, you will walk without feeling a pinch of it.

Making a Blunt edge!

Mood: Business Practices

Archie Andrews has always been my favorite comic strip. We have all grown up reading comic strips, watching cartoons. I still remember, my train journeys from one place to another wasn't without a comic book. But, I recently read in a journal about MBA studies abroad as how these strips can teach us Business practices. 

I wondered how funny, and then I kept thinking sipping my hot chocolate at around 3am at a wintry night all packed in my blanket  yester-night. I had in front of my eyes, all the examples, that I have learnt from people around me & known to me, including a vendor to a friend who has started his own venture. According to what i have been thinking, it's looks so damn simple fact that best Business practices can be learnt from our day to day life happenings or what we see.

If you imagine even the baddie villains we watch in a flick can also be picked up as a best example for Business practices! A wicked looking person we see in Mission Impossibles. They all carry an entrepreneurial imperatives to extremes. Ultimately, a villain (keep aside bollywood movie gentlemen) can be a person who says "Do hell with ethics, I'm gonna bend it my way." They actually start out with a good dream, but then end up with methods that are repugnant.

Example of one Anaconda movie, Anacondas: The Hunt for the Blood Orchid that was showing up on HBO. the guys start with a good intentions to find an orchid flower, but then one of them just goes blind and crazy, keeping aside the life of his own so called colleagues & friends. 

So, what does it says? Its simple if we actually give it a thought. It says you did start up with a good theme, but then you lost yourself in midst looking out for profits, despite the fact that you knew it wasn't the right way to get it. The Spiderman movie, where the person looses control over his own machine on his body. It's just like the way few business practices growing wrong.

Business Administration can be learned from any1 you see or are impressed with. And, we don't just need to follow just the success stories, but also the failure stories. Even the happenings in our life may be a perfect example of Business practices & administration.

Now, can you imagine, how just a thella of a vada-pav sellers, has evolved them into an entrepreneur & starting a chain of outlets!! Richard Branson, for example never started a business with a deep-strain knowledge of it. He just gave a thought & wanted to do it. Just planned a little strategy of connecting to people & there he is, way too ahead. Ratan Tata has taken an almost out of market,Tata name to every household, not only in India, but also in United Kingdom. It's all about how we learn & look at things. 

Now we do know how Apple has always evolved around one person, Steve Jobs. When not being in Apple Co., he himself started the Pixer Animation, a never-miss-name when it comes to entertainment industry. Apple just didn't exist without him. And, when he was back in Apple Co., they are for-tuning their glory.To raise on what I have been pointing, Steve Jobs himself says his idea logy of Business is actually derived from his favorite band-Beatles!He says his model for business is the Beatles- "They were four guys that kept each other's negative tendencies in check; they balanced each other. And the total was greater than the sum of the parts. Great things in business are not done by one person, they are done by a team of people."

BPL Mobile, have been hearing this name from as long back as 7th grade, when I even didn't know about mobile phones & pagers were still in existence. This oldest Mobile operators in India unfortunately have failed to make a mark, despite being the best operator & brand in India's Commercial capital-Mumbai. It all started when Rajeev Chandrasekhar returned back from to India with his idea & started the company when he was just 27. He almost revolutionized mobile operations in Mumbai, and consecutively, India. But then, today I don't own a BPL sim card, because it probably failed to make appropriate business practices & the one time smallies at that time like Airtel ramped the mobile operations in India. They all turned a huge success, but BPL Mobile failed to capitalize on what it should be credited for in India. BPL Mobile now named as loop mobile, is searching for markets & many probably even fail to know what it is. The one time success story for mobile operations is still fighting the market with other giants.

So, how can a simple Vada-Pav seller can beat the heat of the fast-food joints in it's area whether it's McDonalds or KFC to make its presence felt, what BPL Mobile could not, despite being the starters in their own race? How simple mere common men from little known hamlets are making it big in our neighborhood streets by just selling Vada-Pavs or Pav-Bhajis.There are many such examples to watch on the suburban financial streets of Mumbai & Ahmedabad.

A lot of companies complain about factors like recession! All, what I think is, factors like this do not really govern your business practices, because even if it is a recession or it is not, people don't stop eating, people even before recession never wanted to have 2 televisions at one go. Recession can obviously a factor, but it shouldn't be the excuse, because there are businesses that still did run well even during recessions.

 It's all about how they time their entrepreneur ideas, which they have learnt from life and have actually practiced. Wooing clients is just a big bullshit. If people are not happy with what you serve, how will you woo the clients & keep increasing them? The Confectionery store from where we have been ordering our sweets in festive seasons in Ahmedabad from a decade, have slowly transformed their shop into outlets, and now I see their advertisements on national news channels. Its about the way they time, the way they consistently keep the quality of what they serve, and then, at last, the way they try to keep their 'clients' lists increasing.

Marketing a product is only possible when people actually like what you have. So, why Sacha hullaboo over marketing? Companies hire marketing professionals to woo & increase clients, and this just makes me laugh out. I mean a lady calls me from a bank & asks me to buy their credit card, she keeps trying to please me buy it, & when I deny, she just keeps the fone down in a very shrewed way. So, even if i ever agree too swapping  credit cards, that bank would not be in my list of probables for sure. Marketing is about being true to your product and your clients. Working on its drawbacks, and not about selling them in actual.

So, if companies want to define marketing as something they want for wooing clients and increasing the list, they obviously shouldn't name it as 'marketing'. Marketing was all about making your probable clients know what your product is all about, its features, how it can help them. But, this is not the way for obvious. 

With all the examples I have been seeing all these years, I certainly believe each and every business in the world reaches a phase where they can dominate a certain market and are on their highs. It does happens in every business practices. It's at that very point, that the business administrators must not play with the quality & only look for profits, by thinking that they are now on a dominating score. Nope, it's very then that you are actually & unknowingly are destining your business into doom. They may earn some marginal profits at that stage, but in a bigger scenario, they are all waving for a steep fall. 

It really shocked me, when a steel giant like Ispat group faced heavy losses & closed down their plants near Mumbai. And, now the news is, they are taken over by Jindal Steel Works. Ispat has had the best staff in the industry, they had the best mechanism, they had the required torque to sustain themselves in the market. But, still, how could they have a fall? It's more to do with the way we actually look at our business. Profits & losses are a part & parcel of any business practices, but then the attitude that you carry to towards your business is the most important phenomenon. Ratan Tata, obviously stands as a big example. Despite having a very talented team, he seems to be handpicking & looking into every venture he gets into personally. It's not a magic wound for anyone big or small, else the globe would have never seen a Gates, nor any Ambani, nor Mittals. 

Business or anything related to it, starts with the idea we actually want to do, if we are talented in it & what are our demerits. that may wound down our business at any stage. Patience & delivering to the needs 'with a smile' is main essence to be gulped down, that's what i believe. Whether. it's a person coming from a small hamlet & starting a thella or a person with an adequate financial capital to venture into one.

There was a time, when Rajasthan saw very less railways connectivity. The only option to reach quickly to even it's mega-towns like Jodhpur & Bikaner was through roads. The state roadways buses where obviously never thought to be luxurious & affordable people faced a lot of problem traveling. It was then, that a famous bus travel agency opened up with brand new  & luxurious buses. It was instantly a hit. But then, after few many years of dominance, it started losing it's market. More to do with new agencies coming up & the arrogance they were up with their services. the fares would change constantly. It soon lost a elite class bus agency tag amongst the masses to a new bus travel agency, which only had the same bus fares round the season & believed in better customer satisfaction & time-to time picking up & drop. Today, a large section of people from financial city of Ahmedabad to Udaipur prefer traveling through this agency, because of their timely services( because still the railway connectivity between Ahmedabad & Udaipur is a narrow gauge slow line & flying to 250 kms far Udaipur from Ahmedabad isn't a brilliant idea).

It's an easy saying: 'If you aim for the stars but only make it to the moon, remember there are people who have not yet made it to the moon.' Steps and steps are the only way to reach a destination. we humans obviously cannot fly.My college wasn't a pretty well known they started education, but they were smart to make a name in the elite Engineering colleges' list. They went step to step & catered the best slowly and gradually. They built the first two floors of hostel, and then started building next with growing intakes. It was far more sensible in my eyes than the other few colleges, who built a 5-star look ups, but the education staff wasn't the best ones.

So, when people talk about business and new trends that I keep reading about, all I think is what are they doing, because, the only best thing to do is work on what you have & then deliver it. If you really going well with it, market it, else let your marketing people work on it. 

IT obviously helps a hell lot in business & the way the business is driven. Their is nothing without IT these days, whether even talking to your friend. Now, you do not need to obviously ask people been to Shimla for best hotels in the hill station, if you want to back-pack, Just google or go yahoo and you have the best answers. You can look for rates, you can compare them. So, IT helps in enhancing any particular business practice. Because, in today's world wide web, if you not on the net, you don't exist. In fact, you & your business is not considered one.