In a previous post, I asked if we couldĀ trust no oneĀ in Information Security.Ā The reality is that, at some point, we have to trust. We have to trust that we have the right policy in place. We have to trust our people to do the right thing. We have to trust our tools will do their job.
Of course, we should not blindly trust. We need to evaluate that our tools are doing their job, keeping the bad stuff out and enforcing the policy youāve specified. We need to trust that our people are doing the right thing. Your tools are both enforcing the policy and educating the users about what the policy is, right? And, of course, you need to evaluate the policy to ensure it is both effective and in-line with business objectives.
If Information Security professionals spend all their time doubting everything, not only will they drive themselves crazy, but the real threats will get by.
Along these lines, The marketing folks at Check Point put together a video discussing trust and its very important role in Information Security.