Kevin Beaver's Security Blog

Be it in healthcare or infosec, the short term is for losers

With all the doctor & hospital visits I’ve gone (and am still going) through with family members in the past few years, I’ve come to the conclusion that many (most?) healthcare providers – especially those smart doctors society holds on a pedestal – absolutely cannot see the big picture. They can’t think past the appointment time slot in which they’re currently working, much less next year and beyond.

Adding to the problem, the left hand never talks to the right so everyone is engaging in their own area of “expertise” yet nothing gets done at a higher level and the patient is the one who ends up suffering because of this approach. Here’s an example of what I’m talking about…this is the hospital meal that my father received after going in for a suspected heart attack:

What’s wrong with this picture!? Luckily, for us, it ended up being symptoms from a hiatal hernia. Whew. But still…? Come on healthcare professionals! Hey, at least our beloved Obama is going to fix this…(ha!).

The problem of not seeing the big picture is very common among business execs and even many IT professionals who just don’t get what information security is all about. We see it everywhere, especially when data breaches occur…But we also see it when our own peers claim the sky is falling because of the latest Adobe Reader zero day exploit or the Web interface on someone’s printer is susceptible to CSRF. Amazing….sad.

The desire for immediate gratification leads to a lot of bad choices. Ask any success/achievement expert and he or she will tell you that the lack of time perspective is one of the greatest problems in society – arguably the one thing that holds people back the most. It certainly has an impact on IT and information security.

If you want to stand out among the noise and the ignorance associated with IT and information security, think long-term in all the decisions you make. Don’t expect short-term perfection in your security program. Instead, aim for incremental improvements over time.The missing link is actually making those incremental improvements over time…As Henri Frederic Amiel once said “The person who insists upon seeing with perfect clearness before he or she decides, never decides.” This is no doubt the root cause of the problems we can’t seem to solve.