For Cloud Computing, IT practitioners may need to think like lawyers
Great article from Infolawgroup.com talking about how things have changed and how the lines between strartegic legal thinking and strategic IT planning seem to be gettting closer and closer…
Some Excerpts..
So, what does “legal defensibility” mean in the security context?
While some security professionals have begun to address the concept from the security side, my article comes at it from an attorney’s perspective.
In a nutshell legal defensibility is an integrated and holistic strategy for reducing legal risk with respect to an organization’s information security program. The goals are not only “good security” (which is paramount for both preventing a breach and for defending it in court), but also security that can be adequately defended in a legal context with the goal of reducing legal and liability risk:
The focus of legal defensibility is understanding how a plaintiff ’s attorney, judge, jury, or regulator will view an organization’s security posture in light of applicable legal requirements. Under a legal defensibility analysis security choices become legal positions or arguments to be used to persuade legal decision-makers that an organization’s security was legally sound, and increase the likelihood that a judge, jury, or regulator will find a company legally compliant. Ultimately, there may not be a clear “right” or “wrong” answer, but rather a more or less persuasive legal argument/position on security.
Employing a legal defensibility strategy goes beyond superficial “checklist-oriented” compliance and recognizes that ambiguities exist in the law, that if not properly addressed could adversely impact a company.
It recognizes the need for a close working relationship between legal and security that allows both roles to understand how the other operates.
It requires changing the security team’s frame of reference slightly so enable them to understand how their decisions will be scrutinized in a legal realm. Under a legal defensibility model, security decisions become legal positions to address issues like “reasonable security,” risk and compliance with specific regulatory mandates.
Here are some related posts:
Category: Featured, Litigation, Resources
