Outsourcing IT security: Bane or Boon?

Should an organization outsource its IT security?

There are many issues involved with outsourcing. Although it has a number of benefits, there are a lot of risks associated with outsourcing. Thus a company should weigh the benefits over the risk of outsourcing.

The following must be considered when outsourcing IT security:

  1. Financial – it takes a large portion of budget when a company hires staffs with specialized for IT security rather than hiring someone who can cheaply provide it. That is why outsourcing is cost effective. IT security for some companies need not be present 24/7 so there is no need to hire IT security staff round the clock.
  2. Hiring & Training – an outsourced IT can hire and train easily because they need more employees.
  3. Guaranteed service and system availability – they can also create an infrastructure to support them so that they can monitor new hacker tools, new security product, new software releases even new vulnerabilities.
  4. Broader view of the internet – outsourced companies can learn attacks from one customer and can apply the solution or knowledge to protect its other customers.
  5. Focus – companies or organizations can focus on in its activities by efficient use of its labor resources while paying the outsourced companies in monitoring IT security.

The following are the risks of outsourcing:

  1. The outsourcing provider has access to the intimate knowledge of the people, IT infrastructure, procedures, approval channels and the weaknesses and limitations of systems (including both IT and non-IT systems) of the organization being served.
  2. The provider may be processing and handling critical information, systems and assets, and have access to sensitive or personal information;
  3. The provider may have valid user IDs and passwords with authorization to access certain highly sensitive systems logically and/or physically.

Issues involved when a company turn over its security to an outside organization

  1. Sharing computer resources with other clients of the outsourcer – some outsourcers share the outsourcer’s computer resources to other companies. With shared Direct Access Storage Device and shared tape a device, the outsourcer’s other clients may be able to access the company’s data, even if processing is not shared. Security software should be implemented to prevent such exposures.
  2. Assurance that the company is not paying for another client’s use of resources – A charge-back software product can solve this problem. In addition, information security software should be used to ensure that only authorized log-on IDs use cost centers belonging to the company.
  3. Information security audit rights of the client company – the outsourcer should give the client’s information security staff the ability to review and update its log-on IDs and access rules.
  4. Outsourcer’s access to client’s data – to ensure the availability of the client’s data, some of the outsourcer’s staff need to access the company’s data. The challenge is to determine what the outsourcer needs to know and what is the appropriate level of authority for data access.
  5. Determining who owns the data and programs – although the client owns its business data; the outsourcer is a mere custodian of that data. The client should determine which data actually belongs to the company and which data requiring the company’s access belongs to the outsourcer.
  6. Data retention, destruction, and backup – Responsibility for data backup should be clearly defined. This decision should take into account the most efficient and cost-effective method of backup.

Security and General Management Issues

    1. Physical security – It should be verified that the outsourcer has adequate physical security to meet the client company’s needs.
  • Change control – the client company should always be informed of any hardware or software changes that could affect it.
  1. Disaster recovery – the outsourcer should have an adequate disaster recovery plan and a contract with a reputable hot-site vendor that has a configuration that will meet the client company’s needs.
  2. Regulatory requirements – the outsourcer should be able to handle any special regulatory requirements the client company may have.
  3. Service-level agreements – the client company and the outsourcer must know exactly, in writing, what to expect from each other.

Stipulations needed to include in service level agreement with an it security outsourcer

  1. When preparing an outsourcing service contract, the organization should clearly define the security requirements of the information systems to be outsourced, such as how all personal and sensitive data should be handled throughout the contract. These requirements should form the basis of the tendering process and become an integral part of the performance metrics.
  2. The outsourcing contract should include requirements for all staff of third party service providers and vendors to sign non-disclosure agreements to protect sensitive data in the systems. The contract should also include a set of service level agreements (SLAs). SLAs are used to define the expected performance for each required security control, describe measurable outcomes, and identify remedies and response requirements for any identified instance of non-compliance. In addition to defining SLAs, the contract should include an escalation process for problem resolution and incident response, so that incidents can be handled according to a pre-defined process to minimize any impact on the organisation.
  3. When engaging IT service providers, an organization should ensure that the vendor employs adequate security controls in accordance with their own organizational IT security policies, wider regulatory requirements or other industry best practices.

To ensure an effective and comprehensive review, inventory detailing

  1. a list of servers and systems within the scope of the project, and which servers / systems are storing sensitive or personal information,
  2. a list of support staff from third party service providers as well as the user ID and access privilege granted to individual support staff,
  3. a list of data, especially sensitive or personal data, transferred to the third party service providers

the same information security requirements and have the same information security responsibilities as those specified for internal staff.

  1. The security control compliance of service providers and users should be monitored and reviewed actively and periodically. The organisation must reserve the right to audit responsibilities defined in the service level agreement, and have those audits carried out by an independent third party.
  2. The organisation should ensure the adequacy of contingency plans and back-up processes provided by the service provider.
  3. The security roles and responsibilities of the service provider, internal staff and end-users pertaining to the outsourced information system should be clearly defined and documented.
  4. It is essential to ensure that all data to be handled by the outsourcing party are clearly and properly classified, and security privileges for access should only be assigned on an as-needed basis for the performance of their work or the discharging of contractual obligations.
  5. Although an information system can be outsourced, the overall responsibility and liability of any breach to sensitive or personal data remains entirely with the organisation.

The Job Interview

Last week, I went to a job interview for an Assistant Branch Manager position in a consultancy agency. I already had a job offer from my “dream” company however I decided to go through this final interview because I have already committed to meet with the General Manager prior to the job offer. I always hated job interviews. Some interviewers don’t know how to bring out the best in their interviewees. Most of the time, it sounds like a police interrogation of what happened and what did you do. But this time, it’s different. I learned a long lost lesson.

Let me recount what had transpired during the job interview.


GM:                  “So can you tell me something about yourself.”

Me:                    Interesting. I’m going to sell myself to a stranger again. More than that, I need to impress him. But I answered him anyway.


                        “Well, I am fondly called as Cris by my families, friends and colleagues. I am 31 years old and a graduate of Business Administration. I can say that I am a self made person. I supported my way from high school to college through scholarships and part time job in fast food restaurants. I value hard work because of that. And that’s why I don’t believe in short cuts as well. After my graduation, I started working as an Account Management Assistant in a local advertising agency in CDO. (The job                     title may seemed fancy at first glance, but really, all I ever did was to make coffee for my spinster boss/owner (who was always stressed out and who thinks her job is the most important job in the world, I added to myself.)  But no matter how menial I thought my job was, I learned to do things right for the first time. (It was a simple task as brewing a cup of coffee, but if I do it right, my boss’ mood will shift from stormy night to beach perfect sunrise. Hence, I will save my colleagues asses as well). Then I have a short stint working as a Medical Representative assigned in Mindanao. I decided to go back to Iloilo to be near to my parents (actually, I moved back to get married at a young age) and got a job as a Store Manager of a big retail store at the age of 24. I started out as a Store Supervisor and was promoted two years after as a Manager. The biggest challenge for me at that time was how to motivate people who are minimum wage earners. I mean, what’s in it for them if they work hard or not? At the end of the day, their paycheck will only reflect the amount that DOLE will           require to employers to pay. But ofcourse, I had to be a good example in order to motivate them. I have to show them that I love my job because it supports me and my family. Make them realize that the pleasure of fulfilling an honest days’ work is beyond monetary measure. It allows me to inspire people as well, which is what I loved the most. Coming from a humble beginning, I want to inspire people to dream big as well for it is not an impossible dream. It really felt good when I walk in                    the malls or some random streets in the city, seeing them smiling at me and asking me how I was. I can’t remember their first names anymore but they sure remember me. (Well, ofcourse, I didn’t have to tell him that my job was a dead end. There were no more growth at that time. And to be honest, I hated my gay boss who was a big a**hole, molesting some of our male clerks.)


                        “I resigned from X retail company because I got an offer from a host family in Norway as an Au Pair. Not quite lucky, my visa was disapproved because I was married. You know, Sir, the time when you were young and you wanted to do a lot of things, always looking for the greener pasture?”

GM:       “Ah, yes, ofcourse.”

Me:        So I decided to join the pharma industry again and joined a French company this time. I stayed there for almost over a year when a friend of mine asked me to join another mulit-national company because there is a vacancy in Visayas and she thinks I have a great chance of being assigned in Visayas. So I joined XYZ company and stayed there for a little more than  4 years.”

GM:       “Yes, I see it’s a very big company. So why did you decided to leave?”

Me:        “I understand your predicament to the situation. In fact, it was one of the hardest decision I ever made. (of course, I cant tell him I wasn’t happy anymore, there were a number of retrenchment from time to time and I eat hateful emails for breakfast everyday, etc, etc.). The industry is quite challenged at this time due to several government restrictions and there was no room for me to grow at the moment. So I decided to make a big shift. Aside from that, my health is quite challenged at that time so I decided to take a break and concentrate on my rehab.”

 GM:      “That was quite impressive. I didn’t know that the pharma industry was quite challenged as well.”

                And he proceeded to ask a few more questions that I find not quite relevant in this blog.


                        “Before I proceed, I’d like to let you know what you are getting into. Im quite surprised a lot had responded to this job posts.”


                        (I can see that. Guessing from the number of interviewees outside, there are about 6 candidates including me for the final interview. Most are in their middle 40s when I made my quick survey. Some are coming from big communications company.)


                        “Let me first tell you what our company is all about. It is definitely not as big as your previous companies but we came from humble beginnings too. I started out our first branch in Cebu and now, with hard work, it is now a total of 5 branches all over the Philippines in 3 years. I guess, our key success areas are being able to work with utmost honesty with our clients. We are making their               dreams come true of being able to migrate and live abroad. It entails risking their lives as well as their finances and families. There are a lot of short cuts in this industry if we’d like to permit it, but I believe that truth will surface in the end, hence more than losing our reputation, I can’t afford seeing broken dreams, wasted time and mismanged finances of our clients. I cannot allow that to happen. So I am                     looking for someone who has both the heart and the skill. The heart to help people achieve their dreams in the most honest way possible, and the skill to help them make it.”


                        “If you remember Mr. D who did the initial interview, he was one of my sales agent at first. After 3 years, I saw that he was ready so I decided to gave him one of my franchise here in Western Visayas. I was so happy when he fetched me in the airport this morning driving a Sorento. I am really proud that I was able to help him achieve his dreams as well. How I wish I could do the same for all                       my other employees.”   


                        “ I am impressed by your experiences. You seemed confident and able to do the job. Im sure you can handle difficult personalities and situations based on your previous job and you do have the skill for the technical aspect as well. In my opinion, you are spontaneous and sincere in what you are saying. You could                 represent any company very well. I always assume sales people to be a bunch of tattletales and a  master of flowery words. But in  your case, you seemed different. I am really going to have a hard time deciding who will I consider in this post. I will be more than happy to see you on board during your training, if ever you’ll be chosen…” (blah, blah… the rest is about the benefits and other details of the job.)


To be honest, I’m not really interested with the job offer. As I’ve said, I already had a job offer from my “dream” company. But what struck me the most is how he sees me and his employees. I care less if what he said was true or not. I realized for the first time that Mr. GM doesn’t only look at what these people can do to his company but AT WHAT HE CAN FOR THEM. Most companies I’ve been with (sorry  to say this but this is my opinion) is only as good as what numbers you can give them. True, I am compensated (even beyond my honest days’ work) but that’s just it. You celebrate your little or big successes in the most coveted Salesman of the Year Award in your designer gowns for some years and mumble some people you want to thank about. Or perhaps share with your listeners some tricks and tips of the trade. Some monetary and travel rewards too. But when you are not delivering the figures, you’re not their kind of person anymore. It’s       a little too harsh bit you are deduced to someone who are just paid to work.


This blog is meant to thank Mr. GM as well for helping me see who I really am. Those job interview answers just comes out of my mouth as an automatic response based on “some twisted” truth and as of what I perceived to be as a good answer. The truth is, he really helps me see who I really was. I neglected the fact that although I may not be the perfect salesman who brings home the trophy every year, I work with passion. I sacrifice a lot of things too for my work. I may have some bad decisions, but don’t we all? I am a human employee, not a robot. I see my work as my extended self, I am very much affected with my company’s “health” as well. I defended my company when opportunity asks me to do so not because I do not want to bite the hand that feeds me but because my company is a reflection of myself. Infact, it  is not my company that chose me, I chose my company the moment I decide I applied to it. It depends on them how they see me to be a good fit in their mission and vision. My only wish is that they may have the eye to see me or their workers as not just as a paycheck but their lifeblood. Small or big effort, employees are reason where it is right now.

 One thing is for sure: if someday, I’ll be given a chance to manage, lead or own a business, the lessons I’ve learned today will be applied. I will chose to inspire people. I will chose how to help people more than consider what they can do for me. After all, in my tombstone, I will not be remembered by my achievements or titles, but by the lives that I’ve touched.


                        Thank you so much for the lesson and for your inspirational story, Mr. GM. Live long and prosper!  


A Drugpusher’s Diary

Cris' Blogs

6:00 am

My alarm scandalously woke me up. I have to chose a “scandalous” tone for my alarm because if I don’t, I may not be able to wake up.

I am still sleepy (I only got 4 hours of sleep) because I decided to stay late last night, doing a very unproductive thing — “facebooking”. I’m tempted to hit the snooze button but my inner self is reminding me to move my lazy ass ASAP. I can’t afford to be late, six times of recorded late in our EBM (Early Bird Meeting every Monday) per semester means suspension from work. I firmly believe that late is the most undesirable reputation I could possibly reflect in my 201 file. Well, lucky me, I didn’t experience such shame in my almost four years of service in this pharmaceutical company.

With the speed of Flash, I have taken a bath, dressed for…

View original post 4,949 more words


I went to see a seer recently, accompanied by a good friend. He was very good, they say.

Well, I’m one of the most skeptic people you’ll ever know. I hardly believe in prophesies because I believe that life is what you make it. Until a seer 11 years ago predicted that my marriage will fail. Had I listened to that seer, I should have avoided such pitfall.

That leads me to deciding to see this seer, Madhu. When I was in Bali, I was tempted to have my palm reading with the famous Ketut Liyer but I was short of time so I didn’t bother. Besides, I read some bad reviews about his prophesy from famous people, so I reconsidered. This guy, Madhu, however is different. He doesn’t look like a 100 year old Yoda man with no teeth. At first glance, you wouldn’t een consider him as a clairvoyant based on his looks. He is the usual 30-ish Filipino guy with a curly top on tees. No amulets and clairvoyant robes. You might even mistake him as Bruno Mars.

In general, these are his predictions and advices to me:

Be more patient. You have a very short patience. You are also a very jealous person
You always want to get what you want, hard working and independent
Your instincts are very powerful. Follow what’s on your mind.
Pray all the time. It makes things happen.
You have talents and skills. Try to focus on those. But you can’t manage your own business because you are of other people’s needs. It is your personality to complain but still you give.
Don’t look at what’s happening that is your bad in your life now. Focus on future joys and happiness.
Stop any addiction that you have now. Eg: internet, etc.
Your life is refreshing now. Time for acceptance and renewal, time for new understanding.
Be positive like before.
Take care of your health
US is your lucky country.
Good news after four days.

It’s your pregnancy year. You’re most likely to get pregnant.

Me: But I don’t have a boyfriend
Madhu: And who is this man I saw in the cards kissing you?
Me: Oh my, you are so good! (I should have kept my mouth shut, nothing escapes him, I guess)
Madhu: Just be careful about this person. Something is wrong with him. You’re going to meet him again.
Me: No way! Everything about him is wrong.

Your birth date represents unstable relations. Preferable relationship for you is LDR. You should marry a seaman,a traveler, an OFW or a pilot.
You don’t want to get hurt again. Your previous marriage is only a pity retribution and because the papers need it.
Don’t expect from a person near you because he is a bisexual.
2014 is your lucky year, 7 and 29 is your lucky day.
You’ll get married again. Lucky year to get married is at the age of 32.

You’ve been stagnant this year, try to be productive. Don’t worry, it’s the end of your bad fortune this year.
You’re a career first before love life woman.
You’ll be a millionaire.

Well, I’m not sure if I’m going to believe in Madhu’s predictions yet. What struck me the most is when he asked to pray. “Seriously, pray. It makes things happen.” It’s not that I don’t believe in prayers, I doubted the intentions behind my prayers. Some prayers are just meant to heal a broken sense of pride. A prayer to provide direction to my lost soul in attempt to find the answers. A prayer for good health, I, myself neglected to take care of. A prayer for broken dreams’ resurrection.

“Believe in the good again.” I don’t know why I need a Madhu to remind me of this in order to believe in the good again. Maybe, I’ve been cynical for a long time that I’ve become disillusioned with my own set of standards of what a good life should be. Indeed, why did I allow a past mishap to redirect my future? Had I lost so much confidence in myself already? Had I failed a lot that makes believing so damn hard? Had I been hurt this much to love again? Had I died long ago that I forgot to live again?

Dusting myself from the cobwebs of disillusionment, I’m going to believe again. To dream. To smile. To live. To love.

Thank you, Madhu for letting me see life in a rose-colored spectacles again.

The World is Too Big For Me, Mom

Mom, why is this world too big for me?

Are my dreams just too small?

or my hopes just too high?

Mom, why is the world too big for me?


I’m confused, Mom.

Isn’t it that dreams are suppose to make human better?

But tell me why I’ve seen people being destroyed by their very own dreams?


I’m hurt, Mom.

With the kind love I loved and gave freely.

Because I trusted it’ll be a love like yours.


I’m afraid, Mom.

That I’ve ran out of bravery.

Coz I haven’t carefully chosen the battle I’m supposed to fight.


I’m sad, Mom.

I can’t hide the sadness.

When all you ever ask is my happiness.


Im lost, Mom.

Lost somewhere between my dreams and reality.

Pray, tell me, is the world just too big for me?


God, I am scared.

I do not know what the future holds for me.

I can’t see past all these trials and mixed signals.

My emotions and ideas are confusing me.

Please hold my hand, don’t let go of me.

God, I am scared.

Why I Left

3:06 am

And I’m still wide awake.  As usual.

I am a certified insomniac. Maybe, it is due to the fact that I don’t have to wake up early to work tomorrow and I have the liberty to sleep anytime I want, at any given day. And so I decided to write. For me, the wee hours of the morning are the best time to write since everybody is asleep and quiet. My mind loves the gift of solitude so much.

It’s been a month since I resigned from my job. I’ve wanted to do that for a long time but the voice of pride is taunting my mind to prove to myself that I’m not a quitter. And there is also the voice of sanity that is crying out for my immediate help. It’s like having two best competing teams inside my head, trying to prove their point or their worth.  There’s also this cold, clammy feeling coating my heart with uncertainties like where will I go or what will happen if my plan won’t work out. What if I’m wrong with what I think is right? And the warm, liberating feeling of having a choice to do so. Two opposing temperatures that are equally strong..

Perhaps, what they say about the universe wanting to be noticed is true. Or maybe, I want the universe to notice me.

Although a heart can be deceiving a lot of times, the universe listens to it. I can hide or deny what my heart desires, but it sneaks out of my mind and do what it wants. Sometimes, it can grow really strong and adamant, even the smartest mind can’t control. It sent out signals to the universe about its own wishes, struggles and even fears and questions. And voilà! The universe, always wanting to be noticed, presents me with circumstances and situations.

I have a very strong sense of respect to the heart. I have proven its strength a lot of times. Even  as a girl, I have received its power. Thus, I believe that when you want something really, really bad, to the point that your heart bleeds for it, the universe conspires to give it to you. Maybe not all the time, but most of the time. Maybe this is why a heart is not made of bones and crystals or glasses. So that it can’t be broken. Maybe, torn into pieces but eventually regenerates on its own. Because it knows it has a purpose. To be my strong guide.

I have reached a certain point in my life when I hated waking up in the morning, thinking how dreadful a particular day will be. My day is an endless routine of always running after someone, some goal, some plan, some expectations, some deadline, some form of security, some responsibility, some things to prove, etc. (Although I am pretty aware that I signed up for this.) I hated what I have become: a hateful person. I complain a lot. I judge people based on what I perceived to be as good or bad. I hate eating in haste and not being able to appreciate the good food because I am always in a hurry. I hate the unfavorable circumstances that affects my sense of self-esteem. I hate not being able to enjoy my week ends. I hate being of service to other people and a stranger to my family. I cannot give what I don’t have and so I can’t love the people around me if I can’t even afford to love myself. I hate getting a little for giving so much. Time and luck is working against me. It was also a time when I am so confused about who I was and what I was here for.

My concerns may seem to be so trivial to some people but not being able to know what am I and why I am here for means the world to me.

Until a friend asked me a very simple question: “Cris, are you even happy now? (paraphrased, sorry friend!) I wanted to scream in his face. Inside, I am yelling with thoughts like: “You think?! Can’t you see I’m a total mess?”. But instead, I keep quiet. Knowing that he had asked me a very good question, because the question itself is obviously, the answer.

Letting go is oftentimes the hardest decision to make but also the most rewarding.

To quote Chris Assaad, “As been said many times before, it is not the goal itself we are really after, but how we will FEEL when we get there. It is not the soulmate that we really want, but the experience of love, connection, and intimacy that we will be able to share with them. It is not the job itself that we are after, but the sense of accomplishment and security that will come with it. It is not the shiny award that we really desire, but the feeling of being enough and the validation of our ability that it represents. And the great mystery of life and the spiritual path is that all of those feelings are available to us RIGHT NOW, not out there but deep within us.

And so it is with PEACE.”

I have no road map right now. To be honest, I am completely lost. But I know that my heart is happy and at peace. Happy and at peace because it gets what it wants: to be free and to  be still.

And so I enjoy waking up slowly each morning. I enjoy not knowing what day or time it is. I enjoy leisurely eating a simple meal. I enjoy a worry free day. I enjoy watching people and the kids at play. I enjoy thinking only about myself and my needs. I enjoy having coffee with friends without hurrying. I enjoy just being with myself in slow motion.

I pray to God that He may continually bless me with this gift of being at peace with myself. And may my strength be always greater than my worst fears. Maybe life may not guarantee me of a better tomorrow, but I do hope that it offers me the opportunity to be stronger and an even better person to withstand its tests.

“When we stop resisting what we don’t want to feel and embrace the state that we are in, we move through whatever it is SO much faster to find our way back to truth and clarity.” -Michael Eisen

Disclaimer: The statements or opinions expressed on this site are my own and do not represent those of whom I am affiliated with.

4 Years After

I suffered in silence. Denied justice to myself. Trying to help myself to crawl out of the dirt I’m helplessly in for a few years now. Yet I decided to forgive thinking I won’t be better off than those people who hurt me if I hurt them back.

Today, I am writing again to release this anger inside me. They bothered me again. And I couldn’t help but be dismayed by the fact that humans are intrinsically selfish. We cannot steer away from our evil ways.

A client/friend called me today to let me know that my sister in law has been trying to ask about me and if I’ve been visiting this client/friend of mine till now. She believed that my ‘ex’ husband left with some money in a bank account named after me after he left me for another woman. How was that?!

I feel so dumb-footed! Where did these people got the nerves to think and act this way? It maybe evil of me to wish that she should be on the same boat as I am so that she will know and realized what I feel and how she is making me feel. Jesus! Her brother left me for another woman while stripping me of everything that I have — pride, justice, self respect… Everything! And here she is, trying to shove her “mukhang pera” face to me. How come did these people continue to live without conscience? Why can’t they just rot in misery & die in vain? I curse this family! I curse his family! If I cannot give justice to myself, surely, Karma will gladly do the favor for me.

And I cannot help but still be appalled by the fact that humans are so selfish. I am a hairline away from filing a civil case to him.

Ugh! I maybe bloody right now, but I won’t bow my head in surrender.

Why Can’t I Just Die, Mom?

Tonight, I hear my silent screams of hopelessness again.

Why did this life choose me?
Will I ever be happy?
Will I marry and have some kids someday?
Will I be able to live a life of purpose?

Questions asked by a selfish person like me.

When I think of the future, tears start to fall,
I still can’t understand why fate is difficult to change.
I tried, really hard to glance up in the sky,
Trying to catch even just a ray of light.
But the dark clouds, stubborn as I am,
Refuses to let me have even just a grain of hope.

When others are perhaps scared and crying,
I am fighting by myself,
Not trying to stop —
Always trying to look for words, sentences that might encourage myself.
But I do grow weary too.
Trying to fight my weaknesses and self doubt.
Trying to fight myself.
I don’t have the strength anymore.

Sometimes, I don’t know what to believe anymore.
I am afraid.
I am hurt.
I feel unloved.
I feel unwanted.

I tried searching for a warm hand.
To hold me, to walk with me.
But each pair of hands seemed busy.
Minding its own life.

Why did this life choose only those who are strong?
As if being weak is a curse?
Why did this life choose to go on?
When there is nowhere else to go.

Mom, why can’t I just die?