STE WILLIAMS

I don’t watch much television, but I’ve stumbled a few times upon a popular show called “Doomsday Preppers.” If you are unfamiliar with it, it is a reality show where people explain how they think the world will fall into chaos and their corresponding preparation efforts will ensure their survival.

Every time I watch, I have the same thought: “If real disaster strikes, these people are going to die.”

It’s not that they haven’t given serious thought to a number of problems or are not serious in their preparations. My issue is they all seem to make two mistakes I commonly see many businesses make.

First, they both become so focused on only one or two specific risks, they create an inflexible plan that only works if the disaster occurs EXACTLY as they envisioned it.

And second, in convincing themselves how ingenious their preparations have been, they ignore or dismiss many other significant risks because they, well, feel “prepared.” They have sold themselves on the idea that they are prepared.

For example, even after Hurricane Katrina flooded New Orleans, many coastal New Yorkers still had generators setup in their basements years later when Hurricane Sandy arrived there.

Let’s look at this from a survivalist viewpoint and then from a business point of view. Consider a man living in a typical metropolitan area. Among his many supplies, this man has stockpiled one hundred thousand rounds of ammunition to defend his family and food from desperate, starving refugees (or zombies).

In reality, long before he will have opportunity to use much of his ammunition, he’ll have run out of fresh water. Once his stockpile is depleted, he will run out of water and be forced to leave the city, likely on foot. Unfortunately, his bunker is not portable, and to acquire something as fundamental as drinking water, he’s rendered his entire fortress pointless.

Many business organizations are like the preppers on this show. They focus on selected risks, ignore greater risks, and forget to have their solutions designed for adaptability.

I see organizations that have significant physical defenses — Electronic locks, cameras, expensive firewalls, and maybe even armed guards at the door — yet a single employee with a thumb drive can walk out the door with enough information to steal (and sell) thousands of their client’s IDs. And the company will never know it happened.

We have even seen businesses take compliance and security to such extremes that it creates new risks. If your organization requires users to learn new passwords every sixty days that resemble “Ry#394Wee9,” then your organization ignored one crucial part of security: the human component.

IT departments who use this tactic essentially force all employees to write their passwords on Post-It notes and put them all over their desks. It may have felt secure to someone in IT who thought only about computers and not people, but the result is an incredibly vulnerable company. Too much focus on selected risks.

Can you prepare for every possible risk, threat, or disaster? Of course not. Even if you could, it would not make financial sense. Likewise, should you simply give up, and adopt the opinion that it is impossible to ever be truly secure and compliant? No, there is still incredible value in reasonable security and compliance plans and actions.

What you must do is be sure your plans for security, disaster response, and compliance are all adaptable. Have basics covered, check and update it regularly, and then be sure your plans focus on responding quickly to problems, not merely anticipate the few problems you were able to dream up.

Glenn S. Phillips does not own a zombie assault vehicle. He is the president of Forte’ Incorporated where he works with business leaders who finally realized they need to understand the hidden risks awaiting them. Glenn is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish.

Article source: http://www.darkreading.com/compliance/doomsday-prepping-your-business/240164046