Introduction to the Virtues

Despite what seems to be the popular opinion, security does not have to be a giant burden on the finances or resources of an organization, nor does it have to torment the lives of those charged with maintaining good security practices. Most of what is considered to be "troublesome" in the area of information security can actually be handled by following the simple practices outlined in this book. The simple tricks to security are to be intelligent, thorough, and consistent while maintaining the proper focus. This is not terribly difficult to accomplish, but it does require a new way of thinking about things.

Focusing on the Virtues

Good security is all about proper focus. An incredible amount of money and energy is spent every day implementing individual security measures without ever considering how such measures fit into the overall security profile of an organization. It is imperative that organizations not fall into the trap of focusing on the flashing lights and shiny covers of the newest and most highly advertised security products. We must focus on the concepts that go beyond the technology.

Security in most environments, even large ones, can be successfully implemented and managed when the following guidelines are adopted. I call these guidelines the four virtues of security. To ensure the immediate and long-term security of an organization, the four virtues must be included in every aspect of an organization's IT practices.

The four essential virtues of information security are:

• Virtue I: Daily Consideration Security MUST be a daily consideration in every area.

• Virtue II: Community Effort Security MUST be a community effort.

• Virtue III: Higher Focus Security practices MUST maintain a generalized focus.

• Virtue IV: Education Security practices MUST include some measure of training for everyone.

At first glance, these four virtues may seem simple and obvious, and at the risk of dispelling any great mystique surrounding this book, I will certainly agree; they are simple. There are enough complicated aspects of security to deal with later, but the virtues constitute the core foundation of all good security practices and must remain simple for us and our communities to contemplate, understand, and exercise. Be careful, though. This level of simplicity should not fool anyone into assuming that an environment is already in line with these ideas, or that these virtues are so simple that you can simply skip ahead to the more technical stuff. The virtues are an essential aspect of any good security practice and they have been included for a very important reason. Now, let's explore these concepts as they relate to the security mind.