Who would want ‘pretty good security’ when they could have ‘great security’ or ‘bullet proof security’ or ‘state-of-the-art security’? I think most companies do if they really stop to think about it. 

 

Let me define the term - ‘pretty good security’ is the level of security strategy, awareness, technology and manpower that appropriately addresses the threats to your information assets in the most cost effective and efficient way possible. It is security that serves the business, not security kingdom building. It is security that works with new initiatives, not against them. It is a security guy that thinks in terms of problems and solutions.

 

We use ‘pretty good’ security every day when we use our ATM card and its 4 digit pin code. 4 digits! Not 8 alphanumeric characters with capitol and lower case letters, numbers and punctuation – 4 numbers. It works. The banks and credit card companies have enough data to support the fact that this is a reasonable and cost effective balance between security and functionality.

 

I bought my son a new watch over the weekend. It is a Coleman (the lantern people) brand, water resistant to 50m, has a metal case and the day and date on the display. It was $12 at an outlet. He is 8 years old. Is a Rolex a better watch? A Seiko? Undeniably – but the Coleman is a ‘pretty good’ watch and it met my criteria for quality, functionality and price. 

 

‘Pretty Good’ security isn’t minimalistic and it isn’t necessarily inexpensive. I’ve done plenty of security assessments and penetration tests for companies that have mistaken one for the other and have left gaping holes in their defenses. It isn’t about being cheap, it’s about being strategic. It isn’t reducing security budget and telling folks to get creative – it’s about ingesting the message at ‘C’ level and making more efficient decisions with a clearly defined security strategy in mind. It’s the fence at the top of the cliff – not the ambulance down in the valley.