Sermon - TLIS - 0.1.1 - Security is a hindrance with no benefit
Leviticus 18:5
Keep my decrees and laws, for the person who obeys them will live by them. I am the Lord.
Deuteronomy 4:8
And what other nation is so great as to have such righteous decrees and laws as this body of laws I am setting before you today?
Joshua 1:7
Be strong and very courageous. Be careful to obey all the law my servant Moses gave you; do not turn from it to the right or to the left, that you may be successful wherever you go.
Joshua 24:15
But if serving the Lord seems undesirable to you, then choose for yourselves this day whom you will serve, whether the gods your ancestors served beyond the Euphrates, or the gods of the Amorites, in whose land you are living. But as for me and my household, we will serve the Lord.
Matthew 22:37-40
Jesus replied: “‘Love the Lord your God with all your heart and with all your soul and with all your mind.’ This is the first and greatest commandment. And the second is like it: ‘Love your neighbor as yourself.’ All the Law and the Prophets hang on these two commandments.”
Business men do not understand security. As I have mentioned elsewhere, frequently, I do not understand this lack of understanding on their part. Managers in a business, whatever they manage, whatever level they manage, manage two things: one is risk and the other is people. They may possibly manage some other things, but they have to manage these. We, in security, manage risk. We are doing half of the job of management. Why is it that business people so signally fail to understand security?
One of the major areas of misunderstanding is that business people, and employees and workers in the business as well, see security only as impeding the business in some way. Workers tend to see security as setting up requirements that only hinder them in the performance of their jobs. Employees, generally speaking, want to do their jobs and do their jobs correctly. They see the requirements that we, in the security field, set up, as being a hindrance and impedance and drag on their ability to perform their job.
Given this perception, it is no wonder that nobody likes security. The problem is, the perception is wrong.
Security is not just an impedance or hindrance with no benefit. Security is there, in fact, to ensure that the workers and employees can continue to do their jobs. We, in the security field, set up policies, procedures, login requirements, and other aspects of security so that someone from the outside of the company, who may be intent on stealing resources or information from the company, or trying to create trouble for our company, is not able to do so.
When we ask a normal worker to use the assigned login credential and to choose a strong password that they can remember, we are trying to ensure that nobody from outside will be able to use that login credential, guess the worker's password, and then use that credential in order to steal resources, delete information, corrupt information, or do various kinds of damage to our systems and information bases. We are trying to protect the company, and we are trying to protect not only the worker's job, but their ability to perform their job.
But, business people, business owners, managers, and even employees and workers see security as a hindrance to the smooth operations of the business. Not only that, particularly in regard to the managers, they see security as a cost centre. It is an expense and does not return any value. There is no revenue generated by having people do their jobs in a secure manner. At least that's the way most managers see it. The fact that, if security does not protect the systems and then somebody does attack the systems, nobody is going to make any revenue at all, doesn't seem to enter their consideration.
We probably don't do ourselves any favour, in the security field, by saying, when management comes to us and says that they want absolute 100% guaranteed security for their systems, that this is impossible. We, in the field, know that 100% perfection simply isn't achievable. The closer you want to get to that impossible standard, the more expensive it becomes.
Part of our job is to do cost-benefit analysis. We have established security protection to a certain level, and it costs a certain amount of money or resources. We then have to consider: if we increase the security, how much is that going to cost the company? How much benefit will the extra protection bring to the company?
Once again, you are going to be asking yourself, and me, "What does this have to do with Christianity?" Well, most people see Christianity as a hindrance as well. Christianity, and religion in general, are seen as a "no fun" state of mind. This is a philosophy which says that anything that is fun is bad. Religion, overall, is seen as a whole series of "thou shalt nots". That's the way that we are perceived.
And, of course, this attitude is also incorrect.
God has not laid down the law so that we can have no fun. God has provided his law and direction to us so that we can have the most fun that there is: in a relationship with Him.
Let's take some of the aspects of modern life that people consider to be antithetical to the Christian way of doing things, or that the Christian way of doing things is antithetical to modern life. Allow me to use one particular example: alcohol.
I don't drink. In my case, it's not so much that my family didn't drink, although they didn't, but the fact that, by the time I got into university and was going to parties where drinking was available, I had already taken organic chemistry. When I was offered various alcoholic drinks, all that I could taste was industrial solvent. I couldn't really see the point in trying to develop a taste for the stuff, and so I didn't.
But, of course, most people do, and most people don't see anything wrong with drinking. And, indeed, there isn't necessarily anything wrong with drinking. Drinking to excess does create problems, but alcohol, in and of itself, is not necessarily a bad thing. Yes, wine is certainly consumed in the Bible, and anyone who says that all of the mentions of wine in the Bible are actually just references to grape juice are definitely fooling themselves. There isn't really anything wrong with alcohol per se.
My dad was a teacher, and then a principal. He, as a principal, was responsible for staff parties, to a certain extent. He hosted a couple every year. My family did not drink alcohol, so these parties were dry parties. There were no alcoholic beverages served at these parties, particularly when they were at my parents' house.
I taught in another school, with a different principal. That principal made his own wine, and his wine was fairly famous among the school staff for being particularly strong in terms of its alcoholic content. It was also considered to be rather raw on the throat, but I'll have to take somebody else's word for that, because of course I never drank any of the stuff.
The point is simply that here are two situations, with two people in the same job, creating two very different types of parties. My dad's parties were dry. The other principal's parties were definitely alcohol-soaked.
My parents recounted that, among the staff members, there were comments to the effect that they really appreciated the fact that the parties were dry. There was no trouble at the parties, nobody ever got drunk, and there were no unpleasant incidents at these parties. I don't want to say that having alcohol at a party inevitably leads to unpleasant consequences, but there is certainly a great deal of evidence that suggests that it does happen on occasion. If there is no alcohol, these types of consequences can't arise.
So people at my parents' parties tended to have more fun. Without unpleasant aftereffects.
When I worked in logging camps, there was a lot of drinking that went on. Even when the camp was supposedly a dry camp, alcohol got smuggled in on a regular basis and was definitely consumed. The loggers would show up in my office in the morning stating that they got a bottle of alcohol and had a wonderful time last night! That statement would be followed up by one of two options explaining why they had a wonderful time last night. Option A was that I'm sick as a dog this morning. Option B was that I can't remember what I did last night.
I never understood the logic behind those two justifications proving that they had a wonderful time the night before.
I'm not sure that I picked the right rule when I picked on alcohol. After all, there isn't any actual commandment against drinking. (Not unless you consider Proverbs 31:4 it is not for Kings; Lemuel it is not for Kings to drink wine not for rulers to crave beer.) It isn't a major problem for an awful lot of people. It's a problem for society overall, and it's a terrible problem for some people. But it isn't exactly universal.
Pride. Possibly I should have picked on pride. But that's a lot more complex.
In any case, there are all kinds of things that we could pick on. The point is not any specific sin or commandment. Any specific issue even. The point that I want to make is that what God tells us to do is, as I have noted in a different sermon, for our own good. God's directions to us are not a heavy-handed person yelling at us to keep off his lawn, but a parent, giving us advice that will help us in life.
There is another point to be made here with respect to the issues and approach of security. I have mentioned that a lot of people ask us to give them 100% guaranteed protection, and have mentioned that there is no such thing. In the same way, there is no such thing as 100% righteousness. Well, there is, for God, of course. But not for us. And that presents us with a little bit of a problem in terms of people saying, "Well, if we cannot be righteous, then why even try?" The answer is that we should always strive for perfection, even though we are pretty sure we are never going to meet it.
And, of course, there is more benefit to Christianity. In the same way that there is more benefit to a business in having security then simply the protection of assets. Security, by forcing you to study what is and isn't important in your business, and what are and aren't important assets, forces you to understand more about your business, and therefore make better business decisions.
In the same way, there are more benefits to Christianity. There is the relationship with God, to begin with. There is support and provision from God. Not that it doesn't come to those who don't believe in him, it just has to come a little bit more indirectly.
There are somewhat intangible and ineffable benefits. I really enjoy CS Lewis's Narnia chronicles, the series that is most identified by the book "The Lion the Witch and the Wardrobe." Those who love the series probably have a favorite scene in it. My own favorite scene is one from one of the lesser known books, and even within that book it is probably a scene that is passed over in many times. In it, the characters have been captured, and an evil witch is attempting to gaslight them, and convince them that there is no Narnia, there is no overworld (they are being held underground). A character, deliberately injuring himself in order to clear his mind, makes an absolutely impassioned and beautiful speech about how if the sun and sky and Narnia and other aspects of believing in Narnia (which stands in for a belief in Christianity in the books) are all such false childish imaginings, then it's rather odd that their fictional imaginings are so much better and more substantial than the world they see around him them.
God is not anti-fun. God loves us. God wants us to be happy and has made all kinds of provisions for us to make us happy. God's directions are not to stop us from having fun, but to ensure that we can continue to enjoy all the wonderful things he has provided for us.
See also: Sermon 45 - The Difficulties of Law
Theological Lessons from Information Security
Sermon - TLIS - 0.2 / 47 - Integrity/Robert Slade is a world renowned speaker
Sermon - TLIS - 1.1.3 - Functional and Assurance Requirements
Sermon TLIS - 1.1.5 - "Footprints" and key performance indicators/metrics
Sermon - TLIS - 1.1.7 - Security Frameworks
Sermon - TLIS - 1.2.1 / 34 - Edit, Audit, Prophet
Sermon - TLIS - 1.5.1 - Manage Everything
Sermon - TLIS - 1.7.1 - Organizational Roles and Body Parts
Sermon - TLIS - 9.8.5 / 73 - Muster station, safe and secure
Sermon - TLIS - 10.3.1 - Intellectual Property
Sermon - TLIS - 10.5.1 - Privacy
Sermon TLIS - 10.6.1 / 54 - Liability and Negligence
No comments:
Post a Comment