Title: Communities of Interest
Course: IN 2001 Principle of Information Assurance > Section: Module 1: Chapter One

Communities of Interest

Each organization develops and maintains its own unique culture and values.  Within each organizational culture, there are communities of interest.  As defined here, a community of interest is a group of individuals who are united by similar interests or values within an organization and who share a common goal of helping the organization to meet its objectives.

There can be many different communities of interest in an organization.  The three that are most often encountered and which have roles and responsibilities in information security, are listed here. In theory, each role must complement the other but this is often not the case.

Information security management and professionals

These professionals are focused on protecting the organization’s information systems and stored information from attacks.

Information technology management and professionals

Technology managers often focus on operating the technology operations with a focus on cost and not necessarily on security.

The goals of the IT community and the information security community are not always in complete alignment, and depending on the organizational structure, this may cause conflict.

Organizational management and professionals

Both IT and information security professionals must remind themselves that they are here to serve and support this community.

A secure system is not useful to an organization if the business goals of the organization cannot be furthered.

Information Security: Is it an Art or a Science?

With the level of complexity in today’s information systems, the implementation of information security has often been described as a combination of art and science.

The concept of the “security artesan” is based on the way individuals have perceived systems technologists since computers became commonplace.

Security as Art

There are no hard and fast rules regulating the installation of various security mechanisms.  Nor are there many universally accepted complete solutions.

While there are many manuals to support individual systems, once these systems are interconnected, there is no magic user’s manual for the security of the entire system.  This is especially true with the complex levels of interaction between users, policy and technology controls.

Security as Science

We are dealing with technology developed by computer scientists and engineers—technology designed to operate at rigorous levels of performance.

Even with the complexity of the technology, most scientists would agree that specific scientific conditions cause virtually all actions that occur in computer systems.  Almost every fault, security hole and systems malfunction is a result of the interaction of specific hardware and software.

If developers had sufficient time, they could resolve and eliminate these faults.

Security as a Social Science

There is a third view: security as a social science.

Social science examines the behavior of individuals as they interact with systems, whether societal systems or in our case, information systems.

Security begins and ends with the people inside the organization and the people that interact with the system, planned or otherwise.

End users who need the very information the security personnel are trying to protect may be the weakest link in the security chain.

By understanding some of the behavioral aspects of organizational science and change management, security administrators can greatly reduce the levels of risk caused by end users and they can create more acceptable and supportable security profiles.