Trust Economics

Securing the desktop and still allowing for flexibility – discusses the need to balance the security of a system with the capacity to allow employees to do things that they would feel are acceptable within their job (including catering for those who believe they are within their rights to use Facebook at work!). An interesting quote: “The first stage is understanding what’s going on. Before you can actually control what people can do, you have to have a sound basis for making the decisions about what is and what is not allowed”. This could be interpreted as a requirement to understand employee behaviour in relation to both the resources that are within their reach, and the security controls that are either in place or available to limit or manage access to those resources.

Electronic information sharing is key to effective government – an article that discusses how document-centric information security can promote co-operation between disparate organisations (or distant parts of the same organisation). Information exchange between organisations can lead to increased productivity and knowledge development, but this exchange needs to be secured in a manner that doesn’t simply make the entire process unwieldy.

Can too much IT security be bad for business? – IT professionals attending the IT Security Forum ring alarm bells about how an increased expectation of the use of information security controls affects their organisations. This includes how limiting use of USB storage devices can in turn limit the capacity for information exchange, and concerns about the strict nature of policies concerning the inclusion of sensitive information in unencrypted e-mails.

These articles all highlight a need to balance:

• the use of information security controls in an organisation;
• the potential benefits to an organisation of using the information that is available to it;
• the ways in which members of an organisation use information to realise those benefits.