Network Security Blog

I’ve been mulling RaviC’s post, Security as a core competence, for the last week or so.  I like his idea of selling security to management as a ‘core competence’, but unless security is a core part of your business and what they do, I think your doomed to failure.  If your company is a manufacturer of widgets, most people aren’t going to care how secure your company’s network is.  If you deal with credit cards and personally identifiable information all the time, you have a chance but even then it might be hard.

Really, I don’t think any business is going to buy into security as a core competence unless you can demonstrate to management that they’ve lost business directly because of a lack of security.  And even then, it’s an incident around lack of security that’s more likely to get action rather than the idea of being proactive about security. 

If your company does operate in an environment where security can be used as a sales tool, think about incorporating your sales department in your efforts to push security up the ladder.  If you have your VP of Sales talking about how how security will allow them to approach a market they haven’t been in before or get a sale they missed last year, management will see the dollar signs.  It’s probably a lot healthier way to sell security in the organization too. 

I will say that I think this is closely tied to the ROI savings model, but instead of stating what you didn’t lose, your stating the opportunities the company will create with security.  Management gets a lot more excited about opportunities than they do about loss avoidance.

Technorati Tags: security, McKeay, core competence

Trackback URI | Comments RSS