Network Security Blog

Amrit Williams has written up the Top 5 Abused/Misused/Misconstrued Terms in Information Security and Rich Mogull made the list of ‘also rans’. I’m pretty sure Rich’s name is just there as link bait, but it’s amusing none the less. Amrit is a good writer and always sprinkles a large amount of sarcasm and cynicism in his writing, so this is worth taking a few minutes to read.

The thing that puzzles me slightly about this list though is that four of his top five have fallen out of general usage, at least in my experience. “Paradigm Shift” got so overused a few years ago that no one I know uses it unless they’re making a joke. Or if they’re in marketing, then the joke’s unintentional. The same goes for “* is dead”; at least I hope people who are still using the term are joking. Maybe not and I should take some of those articles seriously.

The one inclusion on the list I have some issue with is “Security ROI”. The term itself is definitely overused, but the concept it’s trying to capture is something we need to pay more attention to, security’s role as a core part of business. ROI is poorly suited to measuring success for security, but we do need to move away from the concept of security as a technology and towards including security as a core part of business. This includes ways of measuring success and failure, though failure is much easier for us to identify. On the other hand, maybe I just proved Amrit’s point, that it’s an overloaded, overused term and we should find something better suited to the concept.

Language is fluid and we’re constantly creating new terms and adding new meanings onto old terms. Maybe Amrit can revisit this article and come up with another list next year. Of course, that’d mean he’d actually have to come up with real criteria, rather than just listing the terms that made him grumpiest this morning.