Last week I wrote on the ServerCentral blog a bit about the problem with former Equifax CEO Richard Smith’s testimony to Congress. In his comments, Mr. Smith placed the blame on a single IT employee, who somehow in the total risk, compliance, and governance program of a $13 billion company managed to bring about the loss of 145.5 million people’s data.
This irresponsible perpetuation of a myth that a single person can be responsible for all security in an IT organization damages the security of us all.
The problem with his statement is that any organization who bases their security and compliance in the hands of a single person can only blame their own leadership for their breach. A properly designed governance and control program for an organization of Equifax’s size must have included multiple checks and balances on their risk mitigation program. One person may approve patches, but another person was running vulnerability scans. Then yet another applies the patches and a final person watches the configuration management console to ensure the changes are properly discovered. Just like in financial reporting and audit programs, you design controls to require multiple people to cover a particular risk to prevent incompetence, oversight, or malice.
In the case of Equifax, there is only one person responsible: Richard Smith. A lack of proper oversight and control in their security program belongs on the shoulders of the executive management alone at any organization of any size.
This means even the small companies, the IT teams of two to five people, must be held accountable by their executive leadership. Every CEO, COO, and board of every business has the responsibility to ensure the safety and security of their corporate data. Ask for proof, ask for plans, ask for a program document that outlines the patch policy, reporting, and verification for your company servers, desktops, and network equipment and pay someone to help you understand.
Not all of the work falls on executive management; they should be free to run the business and perform their duties. In small organizations an outsourced service provider, such as my employer, can provide the necessary program management and reporting that frees your staff to be the in-house expert you need. Maybe the reverse is better for you, hiring an outside company to be your expert-in-residence to the board and executive management while your existing IT department handles the execution? Either way, if you aren’t spending money (staff, outsourcing, consulting) on security today, you’ve already lost.
Think about it this way, if you had a massive corporation with almost ten thousand employees and only one person could shake your reputation to the very core of its existence and potentially cost you billions of dollars in fines, is it that employee’s fault? Or is it your fault?
Originally published on LinkedIn.