Mr. Daniel Castro, Senior Analyst, for the Information Technology and Innovation Foundation, recently contributed a blog entry to The Huffington Post on the topic of information protection policies in the wake of the leakage of Congressional leaders facing ethical probes. This was a subject-matter in which I talked about in my blog back in October, 2009. His analysis and conclusions are similar to the ones that I have been espousing for some time now. Like any other organization that has experienced a release of unauthorized data, the response by Congressional leaders was erratic and futile.
Their suggestion for dealing with data leakage should come as no shock or awe – enact more laws. This is something that has not worked in the past, and will not work in the future. Unless organizations, like the U.S. Congress, focus on a robust solution centered around people, processes, and technology (note technology is last, but of equal importance), then data leakage will continue. From an analogous perspective, when the automobile was first invented the controls, both internal and external, to the product were in its infancy. The "rules of the road" (or processes) were minimal at best (i.e. you could drink and drive, there were very little stop lights/signs, etc.), and the technology reflected that (i.e. seatbelts, windshield wipers, headlights, etc.).
As innovation drove the technology of the automobile to be better (i.e. you need strong brakes to make a car go faster), so did the "rules of the road". At some point we stopped blaming the auto manufacturers for rear-end collisions, and started putting the onus on the drive because of her/his "behavior." This is what organization’s, like Congress, need to do in order to prevent the unauthorized release of data.
To read more from Mr. Castro’s article, please click here: Wack-a-mole Security: Bad Policy, Bad Legislation