Recently, Thinking Problem Management wrote on the concept of Hansei-Kaizen.  That started me thinking about Information Risk Management, Information Security, the role of the security group and the analytical function. The following isn’t necessarily a revelation, but as I’ve a friend interviewing for a CISO-type job at a Fortune 20 this week and they are focused on a not dissimilar business management philosophy, I thought I’d write a little about the subject.

Hansei-Kaizen is the process of relentless reflection (Hansei) and continuous improvement (Kaizen).  It might be thought of as part of the Deming Plan, Do, Check, Act cycle.  In fact, Taiichi Ohno, father of Toyota’s production system (Lean Manufacturing) is quoted as saying:   “Check (in PDCA) is Hansei”.

image from the awesome Panta Rei weblog

Now those who have had exposure to Six Sigma and management theory are already probably very well acquainted with the concept of Kaizen.  I think anyone who has held a security management position would argue that continuous improvement is a very admirable goal.  And I don’t think we need to talk necessarily about what improvement is and why it needs to be continuous.

But what is usually not given a great deal of consideration in  our profession is this concept of “relentless reflection”, the “Hansei” bit. And a lack of Hansei can be a source of frustration to those we work with and report to.  In fact, there’s a great presentation by Dr. Hwang Chi Hong available via search engines that explains:

Hansei (reflection) alone only generates staff unhappiness.  Kaizen (continuous improvement) alone only wastes creativity.

Cool huh?

So what’s this got to do with Risk Analysis?

If we can agree that continuous improvement is an admirable goal for security management, security departments, and even security vendors, then in light of the quote above we have some questions to ask ourselves;

• what is this relentless reflection (Hansei),
• what should we be relentlessly reflecting about, and
• how much work is being put into, and how good are we at, Hansei?

I’d like to focus on that for the next few blog posts this week, because I think that adding structure around this concept may be a “pragmatic” (Hi Mike!) compliment to many of the CISO  “self-help” books I’ve been seeing.

I suppose it’s not dissimilar from putting a handgun in a schoolyard although it’s really hard to tell intent in either case. Often times the research done on this site and others of it’s kind are academic and are helping to solve the problems. Granted that same information can empower less scrupulous types, so that’s at least partially the intent of the law. However, I would bet money that this does little, if anything, to stop the proliferation of exploitation materials. This will no doubt simply force hackers to move their equipment offshore or go more underground - which could be bad for investigators, and for researchers alike.