Security and networking professionals are gearing up for the Interop show in New York next month. So is Dark Reading, which caught up with John Pironti, chair of both the Risk Management and Security track as well as co-chair of the Applications and Collaboration track. Pironti is president of security consultancy IP Architects, and is also an active member of ISACA.

Dark Reading: John, tell us a little bit about some of the security themes you have helped to develop with the programming in the Risk Management and Security track at Interop this year.
Pironti: Not unlike at ISACA, at Interop we've really been trying to push the theme and kind of move the bar forward for security professionals to become more risk and security professionals, and to be more embracing of a threat- and vulnerability-based and risk-based approach, not a technology-based approach, to security. We want people to appreciate that, in some cases, it's actually better to be the trusted adviser than it is to be the guy with the hammer.

Dark Reading: Which kind of makes Interop the perfect audience to bring that message to, considering how many security professionals come from the networking world, right?
Pironti: Yeah. The good news there is that we have a lot of maturity because of that. Network security is probably the area of security that is the most mature and has the most specialists available. But we'd like to start pushing lots of data conversations.

Networking, and technology, generally, is really a vessel. We have all these other angles we're working on and all these other requirements at the business level that we have to address. So we're trying to help that professional broaden their horizons and try to understand what their customers and management teams are struggling with.

One theme we're trying to move forward is visibility, because you can't protect what you don't know. And then really moving away from using the word "risk" too easily, and trying to appreciate what risk really means to the business person and what the security professional believes risk to be. These are usually two very different things.

Dark Reading: So better business context for risk?
Pironti: So a security professional can understand all the possibilities and probabilities of a threat and a vulnerability of a technology or of a concept. In order to factor in what's a risk to the business, you have to have consciousness of things like operational risk, strategy risk, financial considerations, HR considerations, and legal considerations. We need to work with them to understand how to get on the same language page so when I say something's a risk, it's couched in a way of saying it's an information risk, but it has a potential impact on your business process

Dark Reading: That ties into some conversations we've had with others about generally having risk rolled into enterprise risk management. What are you seeing there?
Pironti: ISACA and I have been having that conversation for a while. Maybe we separate IT security operations from information risk management. But they are two things that are very heavily integrated, and they should talk to each other and deal with each other regularly. Let the technology group still maintain the controls and understand how we're going to meet those controls. But let the risk group define what the control objectives need to be.

[Do you see the perimeter half empty or half full? See Is The Perimeter Really Dead?.]

Dark Reading: Looking at general trends, what would you say security people should be paying attention to that will be on the Interop radar -- trends like software defined networking (SDN)?
Pironti: I think SDN is great. I think we're at the fun time talking about SDN. At Interop you have networkers, and we love this stuff. This is our bread and butter. I think that like other standards we've had, we're high in the hype cycle right now. We still have to wait for the standards to play. It is a logical step forward, though, from a provisioning and maintenance and management perspective. But I don't think it's going to replace overnight what we do for traditional networking, or traditional operations or application management, or things of that nature.

Every couple of years we come up with something new that is going to change the world. SOA, cloud -- this is the third time we're trying cloud; we just keep calling it something different. Remember in 2001 and 2002 -- we were all going to do NAC? Now NAC is back. And it actually makes sense, finally. So I think the security professional needs to keep an eye on how data is becoming more pervasive, and how it's being extended beyond their boundaries and what that means. [They also need to understand] what are the capabilities of some of these new trends that are coming online and how they'll impact not only their internal operations, but how they'll interact with other organizations.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.