Slashdot Mirror

← Back to Stories (view on slashdot.org)

Why Upper Management Doesn't "Get" IT Security

Posted by ryuzaki0 on from the part-of-your-job-to-explain-it-in-their-terms dept.

Schneier is reporting that the Department of Homeland Security has decided to delve into why upper management doesn't "get" IT security threats. The results aren't terribly surprising to those in the trenches, stating that most executives view security as something akin to facilities management. "Thankfully", the $495 report (if you aren't a "Conference Board associate") helps tell you how to handle the situation.

1 of 126 comments (clear)

  1. Computer people don't "get" business by NineNine · · Score: 4, Interesting

    Of course CEO's don't want to spend a lot of money and time on security. Unless the company makes security software or hardware, it IS an expense. Computer security should be handled with the same priority as physical security (keeping facilities secure) and basic infrastructure (power, water, telephone, etc.). Any CEO that spends an inordinate amount of time on computer security will, and should be fired. Just because you, as an IT person, spends all day reading about security threats, does not mean that upper management should do the same. A good top level manager understands priorities, and handles them accordingly. IT security should be handled as an absolute requirement to run the business (like power and water), but should be handled with the minimum possible expense, since it does not generate any income.

    As a manager, you have to understand that EVERYBODY is screaming at you about their particular area. The marketing people need a bigger budget. The maintenance people are wanting to upgrade this and that. The transportation people need new trucks. That's their job. It's a top manager's job to look at each of these recommendations, and prioritize them in a way that will do the best for the company.

    Seems to me like this blog entry is just another example of IT people being too myopic to get any real handle on how a business is run. In case anybody is scratching their heads as to why IT people rarely climb up the executive ranks to manage large companies, this example illustrates that reason very well. (Usually, in large companies, the people running the show are from marketing or finance. Occasionally operations. Never from IT.)