Security isn’t the end game. It needs to be the journey.

It’s easy to get caught in the flow of the next big thing. Mobility, security, analytics, big data, Internet of Things, cloud, and Everything as a Service seem to dominate the technology landscape in terms of where we as IT professionals should be spending our time.

When we talk about these things, they’re often individually viewed as the end game. If you believe the tech industry, we need to be mining our local big data with business intelligence tools and sending it to the cloud where it can then be crunched and interpreted by cognitive systems, which in turn sends valuable info to an iPhone app, where it can be reviewed and then acted upon. I’m being a little facetious with that example, but that’s exactly how some solutions are being built. I reviewed a firewall monitoring service a few months ago that essentially did just that.

Think about firewall traffic. You couldn’t look at a firewall log of a decent-size company and expect to catch everything, or much at all really, even if that were your full-time job. What this service did was push all the traffic logging to an onsite appliance for onsite data massaging, and then pushed that to the cloud, where it was data mined with some cognitive software in real time. The sheer amount of logging data over the course of a few hours can be incredible. The solution would find all sorts of malicious behavior. It checked for patterns of low-impact penetration attempts over the course of days or weeks, trying to get a weak user ID and password through to a listening service on the other side of a NAT rule. If it found something suspicious, it would notify both a help desk that provided 24/7 response time and local IT contacts who could take a number of predefined actions from an iPhone app. Slick stuff. Hell of expensive, yes...but very slick. And necessary.

This is the kind of solution that needs to be made a priority for a lot of companies, but it’s probably the hardest sell because it doesn’t add the kind of value companies want to get from a major expense. Companies want to see a return on investment, but this kind of solution is just another kind of “insurance” that would likely get the hairy eyeball from the average CFO. Just as backup and recovery has to be justified, or redundant storage, or hot spare disk drives, security is often overlooked or dismissed outright because it offers protection against a potentially unfavorable scenario. High-dollar solutions need to pay for themselves on paper, and security solutions just don’t do that by nature.

Predictive analytics solutions, by contrast, can be shown to be a good investment based on the dollar value returned by the informed decisions your business makes upon them. Cloud computing can offer reduced costs with immediate financial impacts. Mining big data to determine customer sentiment about your product changes can allow your business to provide better customer service and make smarter decisions moving forward. These are all tangible benefits.

In reality, most companies can’t do everything we want to because of cost and resource restrictions, but the pressure is on to at least begin to bring these things into our organizations.

What we need to do as IT professionals is to step back and re-evaluate our strategy rather than the tools we’re using to achieve goals. There’s a big difference.

And if I may be so bold, I would argue that before we go any further with any of the next big things, we need to define ourselves a proper security strategy.

And if I may be so boldly Canadian, I’ll offer a hockey analogy. I come from the school of thought that defense wins championships. With good defense, you can create offensive opportunities. If you stifle and frustrate the opposing team, then they will take penalties to put you at an advantage. You build your team out from the goaltender, then the defensemen, and you ensure you have forwards that play responsibly in their own end of the rink. Tech marketing currently has everyone playing offensively. Five guys only caring about putting the puck in the other team’s net while leaving their own goal unprotected. It explains the current phenomenon of the billions of unsecured devices in the wild that your data could potentially travel through. Who cares about poor encryption on the camera in your fridge, right? Or your car? Or the 0000 password that seemingly every Bluetooth device is saddled with?

The consumer industry is partly to blame regarding high-technology expectations paired with low to no security standards. I wrote about this before in an article called “The Internet of Unprotected Things.” However, I’m going to point you toward another article that should open your eyes to the dangers of consumer technology, or IoT. It’s a couple of years old now, but still packs a punch: “When ‘Smart Homes’ Get Hacked: I Haunted A Complete Stranger’s House Via The Internet.”

What’s really dangerous is consumer-grade technology with lackluster security making its way into businesses because it’s easy, less costly, and has a fastpath setup. BYOD was quickly named Bring Your Own Disaster due to the amount of security breaches as a result of personal devices in the workplace. If an employee gets on a work VPN with a household full of smart devices, then you’re battling not only low-cost, consumer-grade tech in the workplace but the same tech (or worse) being allowed to come in through the firewall.

With a security strategy, we must think long-term and big picture. A clear security strategy sets the vision in place, allowing all users to understand what is expected of them and how technology is used in the organization. A security strategy must have buy-in from our company leaders. They have to own it, not just IT. Executives must have realistic expectations on what IT can deliver and what can be delivered within an acceptable risk level. If we don’t have this understanding, IT (as well as security) will continue to be bypassed in the name of short-sighted progress but will maintain responsibility when something does go wrong.

Without this foundation, you can expect to have a lot of goals scored against your team.

Steve Pitcher works with iTech Solutions, an IBM Premier Business Partner. He is a specialist in IBM i and IBM Power Systems solutions since 2001. Feel free to contact him directly This email address is being protected from spambots. You need JavaScript enabled to view it..

Also Read

Data Privacy Rules Around the World

Data Security: 8 Privacy Principles Every IT Pro Should Know

Why the IBM i Community Needs to Pay Attention to GDPR