The "RISKY BUSINESS" Blog

While we can all agree on the importance of protecting information and information systems, it's much harder to agree on how we define the state of being secure.  Is it the state where all information security risks are completely eliminated (not possible)?  Is it the state where all security risks are mitigated to an acceptable level (which risks and whose definition of acceptable)?  Even if we reach consensus and achieve the agreed upon state - we all understand that it is fleeting and will only last until a change (often outside of our control) denigrates it.

It is because the assurance we receive is often only valid at an "instant in time" (e.g., a penetration test) that trust is so important.  If we don't trust that the person/team/organization responsible to ensure critical information is handled in the manner we aspire to moving forward, then we really have little or no assurance. 

We were recently engaged by a pharmaceutical firm to assess whether a third party developed and hosted implementation of a multi-million dollar clinical trials solution achieved the security objectives defined in the contract. The report would also form the basis of a new contract intended to "remedy" the existing challenges. 

The meeting took a very interesting turn when I asked "Should we really be discussing a new contract when it is obvious that the service provider has proven they are not trustworthy?" (the impact of the vendor failing to achieve critical security objectives could cost the pharmaceutical tens of millions)

For my money, no contract, no matter how carefully worded, will make a company trustworthy.  And without trust we have no confidence/assurance that critical information will remain secure.