Unification: Sooner or Later

or the better part of my career I’ve traveled the world speaking to companies about security; their challenges, strengths, and weaknesses, the regulatory landscape, and technical infrastructures. Ultimately, while the languages may differ as much as the landscape, the security troubles and goals are extraordinarily similar, seemingly unaffected by the diversity in industry and law. But, given the complexity of security, the art of application is best described as interpretation. One’s experience and attitude can translate into security programs that have the power to move mountains, while others continue to struggle. In the 1980s, information security was little more than locking the door to your office. In the 1990s the advent of the Internet and firewalls, closely followed by Intrusion Detection Systems (IDS), raised awareness of the need for security surrounding data. During this time security savvy folks would interact, share, and work as a group to drive the meaning of security through best practices. Soon, the evolution of standards took shape, drawing from the best practices and the community at large, forever setting in motion a trend we continue to this day. Regulations affecting infosec began to make their debut shortly thereafter, leveraging the general consensus found in the standards. Finally, there was the facility for governing bodies to make demands in information security by referencing the standards. Based on the inherent relationships between best practices, standards and regulations, we can begin to draw determinations of the future based on the past. For example, the insurance industry in the U.S. in the early nineteenth century was overcome with fire ravaging production facilities during the industrial revolution. Open flame sources of light, poor construction practices, and the use of flammable materials in buildings facilitated the destruction of property. However, without a standardized and regulated approach to construction concerning fire management, there were few methods available to insurance companies for measuring risk to people and assets. The insurance industry began to create standards and promote them throughout the industry. As they were adopted and refined by builders and manufacturers, these standards were eventually adopted by the government as laws and regulations affecting construction. We see the results even today in design, construction, materials, and protective systems. It took years for the different standards to become fully adopted and converge, establishing a common approach that would promote consistency and in turn help the industry to apply common metrics to risk and, frankly, save lives. As this occurred more regularly, building enough historical and empirical data, governing bodies were able to confidently implement regulatory controls. F E E D I T O R