First, an admission; this is NOT all about Fraud, it’s about data security in general …very general. I chose ‘Fraud’ because every spell check I’ve ever used autocorrects my name to it, people even pronounce my name as it, and it’s considerably more catchy that ‘Froud on Data Loss Risk Mitigation in Line With Business Goals’, which is actually more accurate.

My vision for this blog is; “To translate security concepts into a language usable to the business.” In other words, to simplify its application to help businesses grow responsibly.

The security industry is fast becoming as complex and specialised as the law, making the business saving techniques it can provide inaccessible to the people and organisation who need it the most. While this is good for the security professional, and the bad guys, it’s not good for the businesses struggling to keep everyones data safe.

The best analogy I’ve heard is [paraphrased]; “Why do cars have brakes?” The answer; “So you can go faster.”

While paradoxical, it’s absolutely true, and the perfect analogy for how security is perceived. The security professional is not there to stop the business from doing something, it’s there to help the business do something properly. Too often security is compared to buying insurance; you don’t want to spend the money, but you know you have to. The true benefits of security are subsequently lost.

This blog will attempt to bring to light as many of the latest security mis-concepts, and hot topics, and put them into a manageable perspective. This will include; PCI, EU Data Privacy Directive, BYOD, Cloud, Big Data and so on.

While I am an inch deep and a mile wide in my approach, I will bring to bear others’, far more profound knowledge on these and other subjects, so that the end consensus is not driven by my own [far from] humble opinions. I will moderate, and translate, I will not dictate.

The forum will only be as successful as the input from you, the audience, so I will also be posting ‘Guest Blogs’ to keep things interesting, and to delay the day when you all realise I have no idea what I’m talking about.

I am composing a Glossary of Terms so that we can all speak the same language. Security professionals all seem to derive tremendous pleasure from coining a new phrase, or the next ubiquitous acronym, but all this does is confuse. We all need to start dealing with concepts, not labels, or our message will either be lost, or worse, misinterpretted.

And finally, in words attributed to Aristotle; “Those who can, do. Those who understand, teach.”, it is our duty as security professionals to show our clients HOW we do what we do, and not to just do it for them, only then can we ever truly call ourselves trusted advisors.

I welcome any and all feedback, comment, suggestions, so please be as active as your time allows.