Given communication is king, what are some of the favorite analogies you like to use to describe the benefits of security to organizations needing security but new to security?
Fine, I'll just quote Krag Brotby:
To successfully navigate an airplane or a security department to its destination, the necessary information includes
For the pilot, or security manager, it is also necessary to have information regarding
There are essentially three fundamentally different kinds of information required for managing and operating an aircraft—or a security program. They are
Navigation (Strategic, Directional):
Program Management (Tactical, Administrative):
Operational (Technical, Procedural):
While navigation and administration are the main security management components, they are dependent on higher-level strategic decisions about the underlying mission of the “flight.” The oft-mentioned notion of strategic alignment therefore is achieved when the operation of the “flight,” or the security program, serves a higher-level organizational purpose such as operating an airline—in other words, when the information security program provides the elements essential to the successful operation of the organization.
The operational component of metrics from a technical perspective are available and commonly deployed. Operational metrics at the physical and process levels are more scarce and less automated. The components that are poorly addressed if at all are navigation and management.
Here's a compilation of security analogies classified by topics: http://www.granneman.com/techinfo/security/securityanalogies/.
It's like being a pilot trying to fly and land a plane without much help from air traffic control, on the busiest day of the year, at the busiest airport in the world, on the largest airliner in the world, full of passengers, all screaming, staff included, co-pilot is oblivious to the issues and is yelling at you to just land the damn plane, and all you have to rely on is your well-made flight plans (you have those, right?) and your ability to read the instrumentation (you know how to do that, correct?). When you do land the plane, it turns out all of the other pilots that were going to all of the nearby cities got busy and so now you have to do the same thing back and forth to this airport for the rest of the day and probably the rest of the holiday season. Every time you get a new plane, it's less well equipped and fails more FAA inspection checks than the previous one, and the co-pilots and air traffic controllers just get dumber and less helpful.
You know, at every moment, that the whole damn plane could come crashing down. Especially since all of the other pilots in the air spinning around you are drunk and high.