Some of the advice on offer at security events is interesting, thought-provoking, pertinent and pretty useful for those working in the IT industry; and lots of it is grandmother-sucking-eggs type stuff. And yet it still apparently needs to be said.

At the ISSE security show in Madrid this year, which has always claimed to have one of the more discerning audiences on the security conference circuit - ie the great and good from the information security community - one or two presentations fell into the later category.

Case in point. A presentation on SME security by a researcher from Cardiff University told us that SMEs aren't very good at security. Well, to be fair there was a little more to it than that.

Specific points raised from the research were that very few small firms have requirements in place for security; few test their backup data, even if they actually back up; and most tellingly, only around a quarter said they actually know what information assets they have.

A bit worrying, especially when you consider that SMEs employ about two-thirds of the workforce and contribute in total more to the economy than large organisations.

And then the more useful stuff for security chiefs. Many in the security industry get a lot of value from sharing best practice, looking at the things their peers are doing that have proven to work.

And so Roland Muller, corporate information security officer from Daimler Financial Services, explained the value of security assessments in a multinational organisation. To put it simply: they're very valuable. But the key points Muller made for anyone wanting to do similar were:

1) Get management buy-in for any security assessment scheme.

2) Link the scheme to international standards, rather than a local approach.

3) Maintain regular contact with management and local security guys: "The people who are always the victims".

4) User education is vital: "Policies are written by security guys for security guys. You need a simple way to bring the message to people," Muller said.

October 8, 2008 | Permalink | Comments (1)