IT security: protecting organizations in spite of themselves

It is a mantra of the profession that any search for strictly technical solutions that do not take the human and organizational elements into account is doomed to failure. This becomes especially interesting when it is borne out in an inherently technical realm, populated with techies. In this article, the authors share highlights from a field study of IT security at three companies. All of the companies the authors visited were having problems in the following areas, all of which are crucial to developing and implementing an effective IT security strategy: 1. Maintaining a holistic, comprehensive perspective on the issue. 2. Disseminating and institutionalizing practices throughout the organization. 3. Achieving an effective level of partnership with the larger business around security.