Securing decentralised organisations

This paper compares efforts required to secure a centralised organisation and a conglomerate (holding structure). Achieving a uniform level of security across a conglomerate is more challenging due to the nature of the organisational structure — ie every subsidiary is independent, so each can define its own processes and select how to implement global security guidelines. Implementing security measure in a conglomerate is an equivalent of managing a distributed project. Having a very strong governance function is the only way to make such an endeavour successful. Governance function, by itself, is not sufficient, but additional impetus must come from individual headquarters and the holding company itself. Security is different from other organisational functions (eg payroll, sales, etc.) because of the relationships between individuals from different subsidiaries, which can be used to more easily compromise the organisation.