CISSP Essay #1 - The Business Case for Information Security

I am studying for the Certified Information Systems Security Professional (CISSP) certification.  Since the certification tests the candidate's understanding of concepts, I'm taking some time to pose some essay questions for myself.  First -- explain the business case for information security.

An organization exists because it is able to function in its environment.  For organizations that provide goods or services, the environment has changed significantly in the past 50 years.  Every organization has a structured way to deliver value to their customers.  We call this structure the “business model” of the organization.  

My favorite framework for understanding business models uses nine common elements.  

These include the Customer Segments (CS), the Channels (CH) that allow an organization to reach customers, the Customer Relationship (CR) that enables an organization to serve the customer, the Value Proposition (VP) offered to the customers, and the Revenue Streams (R$) that come from each customer.  

Supporting this outward-facing part of the organization are the Key Resources (KR) that allow an organization to perform Key Activities (KA) to offer the value proposition.  Key Partnerships (KP) either provide key resources or key activities.  Finally, there is an underlying Cost Structure (C$).  

Over the past 50 years, computer-based information systems -- symphonic arrangements of people, processes, and computer platforms that manage information -- have become critical to the overall success of an organization’s business model.  Let’s do a quick back-of-the-napkin comparison of the use of computer-based information systems in 1960 at Walden Books -- an innovator who pushed bookstores into malls in the 1960’s -- with their use at Amazon.com -- an innovator who pushed bookstores onto the Internet in the 2000’s.

Table: Comparison of Computer-Based Information Systems value to Book Sellers

Business Model Element	Information Systems Value to Walden Books in 1960	Information Systems Value to Amazon in 2010
Customer Segments (CS)	None - humans read books	Increasing - information fusion where machines are the primary consumers of published data is infrequent; ebook readers are increasing in popularity, and may become critical in the future
Channels (CH)	None - distribution of books through physical locations	Critical - e-books outsold hardcover books in 2010; 9% percent of customers say they would not buy a “real” book if digital were not available.  In 2009, Amazon became the largest book seller in North America.  Amazon has no physical locations.  Moreover, computers guide the logistics networks that quickly ship books anywhere in the world.
Customer Relationships (CR)	None - sales done in person or self-service at a bookstore	Critical - Amazon uses state-of-the-art algorithms to help people find books among millions and millions of choices.  Amazon’s algorithms “know” a customer based on past buying behavior and correlation with other customer behaviors.
Value Propositions (VP)	None - buy books; niche stores -- buy books on key subjects or really rare books	Critical - find and buy ANY book, and get it in any available format - new, used, hardcover, softcover, ebook
Revenue Streams (R$)	None - payment through check or cash	Critical - payment through electronic forms, including credit card, PayPal, gift card, and automated clearinghouse (ACH) debit cards
Key Resources (KR)	None - physical books are the inventory; physical storefront	Critical - the storefront runs on a computer screen, and content is hosted on vast server farms.  Inventory is either managed by computer or is digital.
Key Activities (KA)	None - the value was increased through the knowledge of customers and books held by the owner and staff.	Critical - the ability to find the right material for the customer based on their interests is done by computer assistance.
Key Partnerships (KP)	None - publishers delivered physical books to wholesalers, then to retailers.	Increasing - especially as ebooks gain in popularity, the paper is going out of publishing; the value of a publishing partner is linked to the number of electronic books that they are willing to publish in various e-reader formats.
Cost Structure (C$)	None - bookstores cannot afford computers; maybe some major publishers use a computer.	Critical - in 2006, Amazon spent 33% of total expenditures on technology and R&D

From this, we can see that the computer-based information system has become a vital business tool.  To one degree or another, most businesses cannot survive a multi-week loss of their information systems.  This should establish at a visceral level the value of the information system; without it, businesses cannot survive today.  Even the late-adopting Amish are using websites to market their niche products.

Well then, given that the impact of loss is significant, what is the likelihood of a multi-week failure?  After all, even the simplest risk calculations multiply the Impact of a loss by the Likelihood of occurrence when calculating the Exposure of the business to the risk.  While we could find actuarial tables that calculate the risks of fire, flood, theft, vandalism, power outages, mechanical failure, human errors, etc., a simpler measure may be to anecdotally ask how many times you have lost data that required you to redo a significant piece of work.  The health of the data backup industry should indicate that computers are not inherently stable.  The more complex and interdependent the information systems are, the more likely they are to be vulnerable to abuse or attack.  

Information security promises to reduce the organization’s exposure to the twin risks of abuse and attack that are inherent in dependent upon information systems.  In 1960, businesses minimized their risk of theft and abuse through the use of double-entry bookkeeping, banks, and the Federal Bureau of Investigation (FBI).  Some businesses refused to trust banks and kept their own money safe in physically secure on-site vaults.  

When the cash is on the computer, information security provides the a measure of the protection that vaults, books, and G-men used to offer.  Some businesses may still choose to stuff their money under the mattress and trust in obscurity for protection.  Increasingly, businesses are recognizing the value of common-sense information security.  The fact that there is such a thing as common-sense information security is an indicator of a rising level of awareness about the importance of protecting our valuable digital property.

Clearly, there is a compelling business case for information security.  However, a business case should not be considered the same thing as an open checkbook.  Information Security is becoming a critical business function in the same way that accounting has become a critical business function.  We would do well to compare the role of accounting and the role of information security in the organization.  I think we will find more similarities than differences.

What is an Information Systems Expert?

Step back 100 years ago.  The year is 1911.  It is the dawn of the Age of Flight.  The automobile is a novelty for the wealthy.  Industrialism has driven many off the farms and into the factories.  Social conscience is growing, with clamors for better labor conditions, equality, and human rights.  The edges of the known world have been explored and mapped with successful expeditions to the North Pole and South Pole.  The Scientific Revolution and the Industrial Age are in full swing in the cities with all of the associated good and evil that accompanies progress.

Yet on the farms and in the countryside, much is unchanged.  The sun rises and sets.  Babies are born and grandparents die.  Seedtime and harvest, summer and winter proceed unchanged.  This is the mainstream.  Substantially unaffected by the whirling world, thorns and weeds are still subdued by the sweat of man and beast.  The tractor has not yet replaced the draft horse.  In this world, there is a close partnership between man and beast in the work of the day.

In this world, the veterinarian is seen as a part of the world of new-fangled inventions.  Trained both scientifically and practically, applying expert knowledge to the care and service of the beasts that enable the farmers to operate, these men are viewed with a mixture of affection and suspicion.  Miracle workers when they defeat a common illness with new antibiotics, buffoons when they overlook a basic part of life on the farm, they must earn their place in the world and win the trust of the farmers who have gotten on just fine without them so far.  

Many of us have enjoyed taking a glimpse into the life of the country veterinarian through the wonderful pen of James Herriot, a country vet who worked among the Yorkshire farmers from 1940 to 1995.  His books chronicle the impact of science and technology on the farm community, both its blessings and its tragedies.  

Step forward 100 years.  The year is 2011.  It is the dawn of the Information Age.  In a few short years, the Internet has changed the way that we communicate.  Once relegated to a few universities and laboratories, the computer and, by extension, the information system has become a ubiquitous part of our culture.  Concerns about privacy, confidentiality, freedom result in major headlines about the unauthorized disclosure of state secrets (WikiLeaks).  Information systems provide us with global awareness, bringing Haiti, Chile, the Gulf of Mexico, Japan, and the rest of the world into our living rooms and raising our appreciation of our common bonds with others around the world.  Information systems give us models that let us think globally, while acting locally.  Many of us have given up on paper maps and rely upon the Global Positioning System (GPS) to get from one place to another.  All of this is fantastically useful!

Yet in the offices and shops, much is unchanged.  The sun rises and sets.  New customers and competitors come and go.  Good times and tough times proceed unchanged.  This is the mainstream.  Substantially unaffected by the whirling world, customers still served using the machines and skills that have worked well for years.  Email and the word processor have largely replaced the memo and the typewriter, but the tablet has not yet replaced the clipboard.  In this world, there is a close partnership between man and machine in the work of the day.

In our world, the information systems expert is seen as a part of the world of new-fangled inventions.  Trained both scientifically and practically, applying expert knowledge to the utility of the system as a whole and the business functions it supports, the geek, the techie, the guy who knows how this stuff works is viewed with a mixture of affection and suspicion.  Miracle workers when they recover a seemingly-lost file after a critical system failure or clean the system of a virus, buffoons when they are ignorant of a basic part of life in the world of business, they must earn their place and win the trust of the business owners and organization who have gotten on just fine without them.