Creating a Culture of Security

Will New OECD Guidelines Make Intelligent Enterprises More Secure?

The first time the Organization for Economic Cooperation and Development (OECD) released security guidelines for information systems was in 1992. Those guidelines assumed that all data stores were "islands" remaining inaccessible over public networks. Ten years, several international meetings with representatives of 30 member countries, an Internet revolution, and countless cyber crimes later, the OECD has published its first revision to these guidelines, OECD Guidelines for the Security of Information Systems and Networks. (See www.oecd.org.)

From the perspective of enterprise managers working on the security, reliability, and confidentiality problems of doing business in an interconnected world since the early 1990s or even earlier, the OECD may appear to have come to the party late - and without a present. The guidelines are merely nine brief paragraphs that describe in vague terms how businesses, governments, and individuals all need to participate in creating a "culture of security."

The guidelines, with statements such as, "Security standards policies, measures, and procedures should be coordinated and integrated to create a coherent system of security," may seem general and obvious to enterprise IT managers. But Australian government official Peter Ford, the chair of the OECD's Working Party on Information Security and Privacy, wrote, "If these principles appear to be no more than common sense, the working party will believe it has done its job."

Although self-interest may have led you to adoption of solid information system security practices already, the OECD guidelines may yet benefit you. The OECD's end goal is to improve conditions for business by raising confidence in electronic commerce. By working through the governments, the private sector, and civil organizations in member and nonmember countries to improve everyone's competence with IS security, the OECD hopes to both diminish risks of electronic commerce and boost trust in it worldwide.

Government agencies have begun trying to convert the general guidelines into policy and resources with the help of private business representatives. In the United States, the Federal Trade Commission (www.ftc.gov/opa/2002/08/oecdsecurity.htm) and U.S. Department of State (www.state.gov/r/pa/prs/ps/2002/12518.htm) have made public announcements supporting the guidelines.

— Jeanette Burriesci

In this Issue: