Information Security around the World

I spend a good deal of my time travelling around the world giving lectures and helping companies with consultancy. Last week I was in Amsterdam, the week before in Norway, and tomorrow I’m off to sunny Cyprus.

It’s refreshing to interact with security professionals in other regions, as there are marked differences in attitudes, interests and priorities. There are many reasons for this, such as the influence of culture, economic outlook and the level of security maturity.

Local culture influences the level of understanding of human factors, as well as the nature of trust and loyalty. Economic outlook shapes business priorities and budgets. And the level of security maturity, amongst other things, determines the vintage of available solution.

Innovation and openness to new ideas also varies tremendously. London, for example, is a classic example of a well-organised information security community paralysed by Groupthink. There is too much socialising and job rotation to allow room for free thinking. I regularly raise eyebrows by challenging existing assumptions. In contrast, new thoughts and solutions are welcomed in continental countries that enjoy debate and tolerate mavericks. Travel further east however, and a herd mentality begins to set in, though for a different set of reasons.

Security technology has always been popular in the US and the Far East, much less so in Europe. Continental Europe prefers to focus on people and processes. The UK is the home of bureaucracy and exports it aggressively. ISO 27000 is popular in Commonwealth countries but is frequently despised outside. Unfortunately, it is beginning to catch in cultures where staff pay little attention to policies and procedures.

Wherever you go, however, it’s compliance that’s the primary driver for security. Paperwork has assumed centre stage, as it ticks all the boxes and can be copied and implemented at little cost. In contrast, real security can only be achieved by careful attention to people and thoughtful use of technology. The most important asset for the future, however, is smart improvisation and innovation, and unfortunately that’s thin on the ground across all corners of the globe.