Re: Create management interest?

In-Reply-To: <BAY8-F107Ds01GijnlG0000320b@hotmail.com>

This is a situation that many security pracitioners find themselves in and, to 
be honest, one that causes many people to leave the security business.

The answers you've already had at this site are all good and provide good 
insight to how others approach information security at their place of business.

However, you haven't said how you're trying to create interest in security at 
work. One thing that does trouble me is your reference to ".....the management 
team thinks that software security can be dealt with........." If you are 
trying to create an interest in software security then perhaps none of the 
already-provided advice may apply to you. Also, your reference to your 
management's disbelief that creating policy is "real work" - is there something 
they would rather you were doing with your time?

It is our (security professionals) responsibility to understand how information 
security applies to the business of our employers and to be able to communicate 
that to our employers. If we do that to the best of our ability and our 
employers choose to do nothing then we have carried out our duty as best we can.

I would like to know more about how you're trying to create an interest. Please 
either give more details here or write to me and once I know that I'll be able 
to offer more help.

John A Blackley