Security that fits the business

Every security professional has seen it. A strict new control is introduced: complex password rules, blocked file-sharing sites, approval for every software installation. Within weeks, passwords appear on sticky notes, files travel through personal email accounts and teams buy unapproved tools on company cards. On paper, security has improved. In reality, it has become worse, and less visible.

Controls that block work get bypassed. This is not because people are careless or disloyal. It is because they are trying to do their jobs, and when security stands between them and a deadline, the deadline usually wins. Our view is that good security matches the risk and respects how people work. It concentrates effort where it matters most and stays light everywhere else.

Know your crown jewels

Identify the data and systems that matter most. Most organisations have a small number of assets whose loss, exposure or disruption would cause serious harm, and a much larger number whose compromise would be an inconvenience.

• Data: customer and employee personal information, financial records, intellectual property such as designs and pricing, and anything covered by regulation or contract.
• Systems: those that keep the business running, such as order processing, production control, payments and email.
• Access: the administrator accounts and credentials that would let an attacker reach the rest.

Ask the business, not only IT. Department heads usually know immediately which information would be most damaging to lose and which systems they could not operate without. A half-day workshop with them often produces a clearer list than months of technical analysis.

Match controls to risk

Protect critical assets strongly and keep other controls light. This is the heart of proportionate security. Uniformly heavy controls are expensive, frustrating and, as we have seen, often bypassed. Uniformly light controls leave the most valuable assets exposed.

In practice, this creates tiers. A small set of baseline controls applies to everyone and everything: multi-factor authentication, updated software, endpoint protection and backups. These are low friction once in place. On top of that, the crown jewels receive more: tighter access with regular review, additional monitoring, encryption, separate administrator accounts and stricter change control.

A simple three-tier model

1. Baseline, for everyone and everything: multi-factor sign-in, automatic updates, endpoint protection, backups and annual awareness training.
2. Sensitive, for systems holding personal or commercial data: access granted by role and reviewed twice a year, logging of access and downloads, and encryption at rest.
3. Critical, for the crown jewels and administrator access: named approvers for every access request, separate privileged accounts, quarterly access reviews, alerting on unusual activity and tested recovery plans.

Placing each system in a tier is a business decision as much as a technical one. Revisit the placement when a system’s role changes, for example when a pilot tool starts holding customer data or a once-critical system is replaced.

We stopped trying to protect everything equally and started protecting the right things properly. Complaints fell and our risk fell with them.

IT director, professional services firm

Consider a typical design consultancy. Its staff share large files with clients every day, and a blanket ban on external file sharing would stop work. Instead, it provides an approved sharing service that is easy to use, applies stricter controls to the folders holding client contracts and pricing, and monitors for unusual downloads from those folders. Staff no longer need workarounds, and the information that matters most is better protected than before.

Ask users

Their feedback shows where controls cause workarounds. Users know exactly which security measures slow them down and what they do instead. That knowledge is valuable, and most organisations never ask for it.

• Before introducing a significant control, test it with a small group of users and adjust it.
• After introducing it, ask what has become harder and how people are coping.
• Look for signs of workarounds: shadow IT purchases, use of personal accounts, unusual spikes in help-desk requests.
• Make it easy and safe to tell IT that a control is getting in the way.
• Treat every workaround as a design problem to solve, not as a disciplinary issue.

Often the fix is simple. A password policy can be relaxed in exchange for multi-factor authentication. An approval step can be removed for low-risk software. A secure tool can replace the insecure one people were using, provided it is at least as convenient.

Report back on what changed. When users see that their feedback led to a simpler process or a better tool, they are far more likely to raise the next problem early, and far less likely to quietly work around it. That trust is itself a security control, and one of the cheapest an organisation can build.

Make the secure way the easy way

The most effective security measures are often the ones people barely notice. Single sign-on reduces password fatigue and improves security at the same time. Password managers make strong, unique passwords effortless. Automatic updates remove a decision from users entirely. Approved tools that work well remove the temptation to find alternatives.

When choosing between two controls of similar strength, choose the one with less friction. When a control must add friction, explain why, and save it for the places that justify it.

Where to start

Hold a short session with department heads to agree your crown jewels. Then review your current controls against that list: where are you over-protecting low-value assets, and where are critical ones under-protected? Finally, ask a few users from different teams which controls get in their way. Those three conversations will give you a security plan that fits the business, and one that people are far more likely to follow.

Source: Intelliversal analysis.

Frequently asked questions

Does proportionate security mean weaker security?

No. It means concentrating stronger controls where the risk is highest and removing friction where it adds little protection. Overall protection usually improves because fewer people bypass controls.

How do we identify our crown jewels?

Ask business leaders which data would be most damaging to lose or expose, and which systems they cannot operate without. Combine that with IT's view of the accounts and systems that give wide access.

What if regulators require certain controls everywhere?

Apply them where required. Proportionality works within regulatory requirements, not around them, and still helps you design those controls to fit how people work.

Explore Cybersecurity and IT resilience