User-Centered Security

Bring your own device policies are another area of information technology where security professionals can find their best intentions stymied by users’ attempts to work around policies that don’t consider the user experience first. This came up in conversation with a classmate recently, and there are two primary cases where users circumvent BYOD policies. First, due to a shortage of resources users may not have access to organization-provided mobile devices. Second, users may prefer using their own devices because the organization’s provided devices are old, have an interface the user is unfamiliar with, or are inconvenient to carry or use. The latter case played out in the most recent US Presidential election, with one candidate’s use of her personal IT system rather than the approved government system during her time as Secretary of State becoming a major campaign issue. While most of us don’t need to worry about this level of exposure, either scenario can easily inspire users to...

As much as we would like to be able to defend every part of our information systems environment to the utmost, at the end of the day organizations have limited resources and we need to prioritize our efforts. An important part of risk prioritization is determining the value of our various assets, so we can put a dollar figure on the threat posed by a given risk. As Whitman and Mattord discuss, we could use our sunk costs to determine the value of a given IT asset or determine the potential cost of replacement of the asset—but it is better if we can determine how much value the asset is adding for the organization and use that in our cost-benefit analysis. Unfortunately, as IT professionals we know a lot about the costs to create or maintain a given asset or system but are not well-positioned to know how useful the system is at the end of the day. However, our users are much better positioned to know the value of a given asset—and we can leverage them to get that informatio...