{"id":252,"date":"2017-04-29T00:04:00","date_gmt":"2017-04-29T00:04:00","guid":{"rendered":"https:\/\/securityeverafter.com\/2017\/04\/29\/know-before-no\/"},"modified":"2023-02-22T11:17:33","modified_gmt":"2023-02-22T16:17:33","slug":"know-before-no","status":"publish","type":"post","link":"https:\/\/securityeverafter.com\/know-before-no\/","title":{"rendered":"KNOW before NO"},"content":{"rendered":"
We can recognize the value in sprinkling information security concepts early and often into software development projects. This approach saves each stakeholder a lot of time and frustration, especially when compared to the opposite direction, which often causes the information security team to learn at the very last minute of a new high-profile project that is about to launch without the proper level of information security engagement.<\/span><\/span> I recently posted this article <\/span>on the\u00a0<\/span>SANS Internet Storm Center<\/a>. <\/span><\/p>\n
\n
\n<\/span>A good friend told me an engaged information security professional leads with the KNOW instead of the NO. This comment struck me and has resonated well for the last several years. It has encouraged me to better understand the desires of the business areas in an attempt to avoid the perception of being the “no police\u201d.\u00a0<\/span><\/span><\/p>\n
\n
\n<\/span><\/span>Projects and initiatives may still warrant a \u201cno\u201d from an information security perspective. Before we go there by default, I respectfully invite all to KNOW before we NO. We can improve engagement with our respective business areas by considering this approach. In what areas can you KNOW before you NO next week?<\/span><\/span><\/p>\n