Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Given communication is king, what are some of the favorite analogies you like to use to describe the benefits of security to organizations needing security but new to security?

share|improve this question

3 Answers 3

up vote 4 down vote accepted

Fine, I'll just quote Krag Brotby:

To successfully navigate an airplane or a security department to its destination, the necessary information includes

  • Objective (or destination)
  • Current location (relative to the destination)
  • Direction (heading toward the destination)
  • Speed (how long to reach the destination)

For the pilot, or security manager, it is also necessary to have information regarding

  • Intervening obstacles (constraints that may require a change of course)
  • Operational health/malfunctions (knowing whether the equipment is working properly)
  • Cost/effectiveness (affordability)

There are essentially three fundamentally different kinds of information required for managing and operating an aircraft—or a security program. They are

Navigation (Strategic, Directional):

For aircraft, this is the exclusive purview of a central set of instruments concerned with information about location, heading, and distance to the destination. This is the “linkage” to business objectives— that is, steering the ship to the destination that meets the business objectives of operating an airline. It is analogous to the requirement for setting objectives consistent with the business goals for an information security program and then developing metrics to provide the same information in terms of heading to the destination as well as information on current location.

Program Management (Tactical, Administrative):

For our airplane analogy, this is the information required to manage the actual flying, which includes aircraft heading, altitude, speed and so forth, which is provided by the main instrumentation located directly in front of the pilot. For managing an airplane or an information security program, this information must be real-time or near real-time. It is the feedback that allows effective day-to-day management and administration while maintaining a heading that will achieve the destination.

Operational (Technical, Procedural):

On the typical aircraft dashboard (called the instrument panel), technical information regarding the operation of the machinery is off to one side and referenced occasionally for assurance that the systems are operating in the “green” and that there are adequate resources such as fuel. This information is of no value in determining direction or flight management or whether the destination will be reached except to the extent that failure of the power plant can inform us that we are not capable of reaching the destination.

While navigation and administration are the main security management components, they are dependent on higher-level strategic decisions about the underlying mission of the “flight.” The oft-mentioned notion of strategic alignment therefore is achieved when the operation of the “flight,” or the security program, serves a higher-level organizational purpose such as operating an airline—in other words, when the information security program provides the elements essential to the successful operation of the organization.

The operational component of metrics from a technical perspective are available and commonly deployed. Operational metrics at the physical and process levels are more scarce and less automated. The components that are poorly addressed if at all are navigation and management.

share|improve this answer

Here's a compilation of security analogies classified by topics: http://www.granneman.com/techinfo/security/securityanalogies/.

share|improve this answer
    
+1 Very nice. But there's really nothing there that speaks to a "security program", or even security in general. –  AviD Nov 15 '10 at 9:17
    
Nice, but I think it's generally preferred that Answers have actual information in them instead of just referencing a link. –  Iszi Jan 28 '11 at 16:42

It's like being a pilot trying to fly and land a plane without much help from air traffic control, on the busiest day of the year, at the busiest airport in the world, on the largest airliner in the world, full of passengers, all screaming, staff included, co-pilot is oblivious to the issues and is yelling at you to just land the damn plane, and all you have to rely on is your well-made flight plans (you have those, right?) and your ability to read the instrumentation (you know how to do that, correct?). When you do land the plane, it turns out all of the other pilots that were going to all of the nearby cities got busy and so now you have to do the same thing back and forth to this airport for the rest of the day and probably the rest of the holiday season. Every time you get a new plane, it's less well equipped and fails more FAA inspection checks than the previous one, and the co-pilots and air traffic controllers just get dumber and less helpful.

You know, at every moment, that the whole damn plane could come crashing down. Especially since all of the other pilots in the air spinning around you are drunk and high.

share|improve this answer
    
Whoever voted me down should go read Krag Brotby –  atdre Nov 15 '10 at 14:32
    
I fail to see how this answer describes benefits of security which is what the OP asked in their question. –  Nev Stokes Nov 15 '10 at 17:57
    
@Nev: How about my other comment then? –  atdre Nov 15 '10 at 23:14
    
Better by far! ;) –  Nev Stokes Nov 16 '10 at 15:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.