Information Security Management - Conclusion

Over the course of the last 12 weeks, my blogs covered a wide range of topics.  My topics tied into what interested me the most each week for the class.  I wanted to get the most out of this class and out of writing the blog so I picked things that interested me the most.

On the first week, I introduced myself in my blog and got into a silly list of “definitions” for the acronym COBOL.  In the course of my almost 26 years as a programmer, I have heard many times that COBOL is a verbose language that will “die” soon.  And guess what?  It has not “died” yet and will likely be around after I retire in another 20 years (give or take depending on when I am ready to move onto the next chapter of my life).  I have not programmed in COBOL since 1999 but I have never regretted the 10 years I did it.  I even taught COBOL for four years and still remember the silly joke I made about never missing a period when you code in COBOL.

My blog went onto cover various topics such as Agile, penetration testing, disaster recovery, information security policies and readability, best practices for information security, security risks, personal firewalls, and even got into security risks of terminating an employee.  Most of the topics I picked I had at least minimal understanding of before I took on the topic.  I have had exposure to most of these things I covered in my blog during my career.

In terms of my sources, they were quite varied for my blogs.  The only source that I lean to for research is Google.  By using Google searches for my topics each week, I ended up getting a wide variety of sources.  It is rare that I end up on the same site repeatedly for my sources.  I first find a bunch of links and then start reading a bit from each source that I find until I find a source that resonates with what I want to write about.  I then try to read from at least a couple of sources before I write my blog so I get a combination of viewpoints (including my own).  Then I can provide a more balanced opinion on my topic.

I feel blogging can be a very valuable tool for not only the reader but the author of the blog.  By writing the blog, it helped me to organize my thoughts.  It also pushed me to dive deeper into topics that I was learning for this class.  I don’t think that blogging is for everyone.  Some people hate writing.  I work in a field where documentation has huge value but is also something most technical people hate to do.  I think that some do well at documentation and others do poorly and should leave it to people who love doing it.

The biggest recommendation I have about an information security blog is that it is important that no sensitive information be included in the blog.  I always wrote my blog considering whether what I was writing was sensitive and would be inappropriate to write about.  A blog can be valuable to a company but it should also consider whether the information is OK to be publicly discussed.  Maybe a secure blog that only internal information security staff could get to would be a better option for an information security department.