The very best information security professionals are like health care professionals, lawyers, and military commanders. They do much more than implement compliance checklists or set up firewalls: they think critically and use judgment to make decisions and offer guidance. They apply their experience and expertise to the full scale of cyber problems, from system design to developing and implementing cybersecurity programs addressed to an entire mission or campaign.  Most importantly: they adapt.

We need more of these cyber samurai, and that means maturing the information security community and how we educate and train. There are true masters of information security, but we believe that excellence in this field leans heavily on master-apprentice relationships, trial-and-error experience, and the mimetic transfer of knowledge and know-how. These represent very powerful ways to learn, but they don’t necessarily scale or produce quick results. The ISPPs can be a cornerstone of information security education, helping new practitioners build a very deep and very broad insight into what information security is all about, not unlike the Fair Information Practice Principles for privacy professionals, or the Model Rules of Professional Conduct for lawyers.

Moreover, we need more people up and down the chain of command and in other specialties to be able to engage in and (at some level) understand the information security dialogue. The intended audience for this work is anyone making security decisions at any level of an organization: current practitioners, future practitioners, technologists whose decisions interact with or impact security, managers, and stakeholders.