How Infosec Can Learn from Healthcare and Aviation

For the past few days, I have been immersed in the world of medicine and hospitals, a world that is crucial to human survival. Interestingly, the field of information security (infosec) often views itself through a similar lens.

Recently, a member of my family was admitted to a 24/7 care facility, which offered a unique perspective on operational efficiencies that seemed so simple and so effective:

• Each staff member adheres to a fixed working time frame.
• After completing their shift, they carefully hand over responsibility to the next person.
• This handover cycle is facilitated by a common record keeping, detailing all actions taken, allowing for seamless continuity and accountability.**

When aligned with infosec, we face a very different reality:

• The sector is grappling with severe staff shortages.
• Handovers, when they occur, are often disorganized, leading to complications that could have been prevented.

These reflections were further reinforced in a recent seminar where speakers drew parallels between the aviation industry and infosec, concluding that implementing thorough checklists and documentation could be revolutionary for our field. I’ve long advocated that infosec is more art than science, largely because there is a prevailing belief within our community that our work is shrouded in ‘magical’ complexity.

However, the simplicity and efficiency observed in healthcare underscores significant opportunities for improvement in infosec. Perhaps it is time we reconsider our rejection of structure and documentation, realizing that these elements can coexist with the artistry and agility that defines our field. Implementing a more standardized approach may be the key to advancing our practices, ensuring not only sustainability but also improvement of our important work.