CSO’s…Differences Between Information Security and Information Asset Protection!

Michael D. Moberly  October 5, 2012

The context,…‘if a hole is found in my company’s or my client’s proprietary information fence, the job of information security is to patch the hole, but, the job of an information asset protection specialist is, in addition to helping patch the hole, DETERMINE…

1. What caused the hole in the fence to occur/form in the first place, and were there precipitating circumstance or triggering factors…?
2. Under what circumstances was the hole in the fence initially discovered…?
3. Who, if anyone, knew the hole in the fence existed before it was discovered, but did not report it…?
4. How long did the hole in the fence exist before it was discovered…?
5. What information assets moved through the hole in the fence before it was discovered and patched…?
6. Is there evidence that the information/data-based assets that moved through the hole in the fence before it was discovered and patched were specifically targeted or merely arbitrarily acquired…?
7. How much (economic) hemorrhaging and/or impairment to (asset) value, materiality, competitive advantage, brand, reputation, ownership, trade secrecy and/or strategic planning, etc., occurred as a result of information assets moving through hole being in the fence…?
8. Is it known who the recipients of the information assets that moved through the hole in the fence are, before it was discovered and patched…?
9. How will the recipients likely use – exploit those information assets…?

The responsibilities of information (security) asset protection specialists are now cross-functional and converge with risk management, HR, IT security, intellectual property counsel, audits, valuation, R&D, reputation risk, and brand integrity, among others.

To mitigate adverse effects – consequences do to information asset losses, compromises, and/or misappropriation, an important key is to collaborate with professional domain above with a singular objective;  sustain (protect, preserve) control, use, ownership, and monitor the value and materiality of a company’s information-based (largely intangible) assets!

Comments regarding my blog posts are encouraged and respected. Should any reader elect to utilize all or a portion of this post, attribution is expected and always appreciated. While visiting my blog readers are encouraged to browse other topics (posts) which may be relevant to their circumstance.  And, I always welcome your inquiry at 314-440-3593 or m.moberly@kpstrat.com

This post was adapted by Michael D. Moberly and inspired by a speech made by Dr. Joel Brenner, then Director, Office of National Counterintelligence Executive (ONCIX) to the American Bar Association in Washington, D.C., and author of ‘America The Vulnerable: Inside The New Threat Matrix of Digital Espionage, Crime, and Warfare’.