Expert Core: Practical Security

I was recently out camping in a rather busy campground. Nearby was a group of teenage girls, wrangled by mothers who overall lacked the necessary training in crisis management to keep a lid on the brood. At the same time, I was working on a deadline to get a couple pieces written, and I have to say, the challenge was immense. The noise generated by the group of 12 or so girls seemed ebb and flow at rates rivaled only by large crowds at major sporting or entertainment events.

In many ways, this is the focus we face in information security. We are constantly surrounded by noise. Different people in varying parts of the organization are clamoring for attention, or battling with each other, or just generating a lot of background noise, and yet we're expected to buckle down and achieve our objectives. My favorite whipping boy, the PCI DSS, is an excellent example of a large noise potential, providing plenty of salient details, but also generating so much volume that it can drown out your hopes and dreams.