What are a few good analogies to describe the benefits of a strong security program?

Question

Given communication is king, what are some of the favorite analogies you like to use to describe the benefits of security to organizations needing security but new to security?

Answer 1

Fine, I'll just quote Krag Brotby:

To successfully navigate an airplane or a security department to its destination, the necessary information includes

• Objective (or destination)
• Current location (relative to the destination)
• Direction (heading toward the destination)
• Speed (how long to reach the destination)

For the pilot, or security manager, it is also necessary to have information regarding

• Intervening obstacles (constraints that may require a change of course)
• Operational health/malfunctions (knowing whether the equipment is working properly)
• Cost/effectiveness (affordability)

There are essentially three fundamentally different kinds of information required for managing and operating an aircraft—or a security program. They are

Navigation (Strategic, Directional):

For aircraft, this is the exclusive purview of a central set of instruments concerned with information about location, heading, and distance to the destination. This is the “linkage” to business objectives— that is, steering the ship to the destination that meets the business objectives of operating an airline. It is analogous to the requirement for setting objectives consistent with the business goals for an information security program and then developing metrics to provide the same information in terms of heading to the destination as well as information on current location.

Program Management (Tactical, Administrative):

For our airplane analogy, this is the information required to manage the actual flying, which includes aircraft heading, altitude, speed and so forth, which is provided by the main instrumentation located directly in front of the pilot. For managing an airplane or an information security program, this information must be real-time or near real-time. It is the feedback that allows effective day-to-day management and administration while maintaining a heading that will achieve the destination.

Operational (Technical, Procedural):

On the typical aircraft dashboard (called the instrument panel), technical information regarding the operation of the machinery is off to one side and referenced occasionally for assurance that the systems are operating in the “green” and that there are adequate resources such as fuel. This information is of no value in determining direction or flight management or whether the destination will be reached except to the extent that failure of the power plant can inform us that we are not capable of reaching the destination.

While navigation and administration are the main security management components, they are dependent on higher-level strategic decisions about the underlying mission of the “flight.” The oft-mentioned notion of strategic alignment therefore is achieved when the operation of the “flight,” or the security program, serves a higher-level organizational purpose such as operating an airline—in other words, when the information security program provides the elements essential to the successful operation of the organization.

The operational component of metrics from a technical perspective are available and commonly deployed. Operational metrics at the physical and process levels are more scarce and less automated. The components that are poorly addressed if at all are navigation and management.

Answer 2

Here's a compilation of security analogies classified by topics: http://www.granneman.com/techinfo/security/securityanalogies/.

Answer 3

It's like being a pilot trying to fly and land a plane without much help from air traffic control, on the busiest day of the year, at the busiest airport in the world, on the largest airliner in the world, full of passengers, all screaming, staff included, co-pilot is oblivious to the issues and is yelling at you to just land the damn plane, and all you have to rely on is your well-made flight plans (you have those, right?) and your ability to read the instrumentation (you know how to do that, correct?). When you do land the plane, it turns out all of the other pilots that were going to all of the nearby cities got busy and so now you have to do the same thing back and forth to this airport for the rest of the day and probably the rest of the holiday season. Every time you get a new plane, it's less well equipped and fails more FAA inspection checks than the previous one, and the co-pilots and air traffic controllers just get dumber and less helpful.

You know, at every moment, that the whole damn plane could come crashing down. Especially since all of the other pilots in the air spinning around you are drunk and high.