--- title: Be Proactive- Adopt Security Culture description: Proactive adoption of the four security pillars; security requirements understanding, security awareness, secure design and coding and security testing always keeps your client delighted. image: https://blog.e-zest.com/hubfs/Information%20Security%20Blog%20-%20Blogathon.jpg --- [![e-Zest logo\_An accion lab company\_Colour](https://blog.e-zest.com/hubfs/images/Logos%20with%20Tagline/Corporate/SVG/e-Zest%20logo_An%20accion%20lab%20company_Colour.svg "e-Zest logo_An accion lab company_Colour")](https://www.e-zest.com/) - [WORK](https://www.e-zest.com/our-work) - [SERVICES](https://www.e-zest.com/our-services) - [Product Engineering](https://www.e-zest.com/digital-product-engineering-services) - [Enterprise Data Services](https://www.e-zest.com/enterprise-data-services) - [Digital Commerce](https://www.e-zest.com/digital-commerce-services) - [Digital Operations](https://www.e-zest.com/digital-operations) - [Digital Consulting](https://www.e-zest.com/digital-transformation-consulting-services) - [Digital Experience Design](https://www.e-zest.com/digital-experience-design) - [INSIGHTS](https://blog.e-zest.com/) - [CAREERS](https://www.e-zest.com/careers) - [ENTERPRISE DATA SERVICES](https://www.e-zest.com/enterprise-data-services) - [GENERATIVE AI](https://www.e-zest.com/generative-ai) - [Healthcare](https://healthcare.e-zest.com) - [Contact Us](https://www.e-zest.com/contact-us) - ![Elevating Product Engineering with AI and ML](https://blog.e-zest.com/hubfs/Elevating%20Product%20Engineering%20with%20AI%20and%20ML.jpg) [BLOGS](https://blog.e-zest.com) #### Elevating Product Engineering with AI and ML As technology evolves and customer choices broaden, there is an increasing ... [Read more](https://blog.e-zest.com/elevating-product-engineering-with-ai-and-ml) - ![e-Zest – An Accion Labs Company gets Recognition as a Contender in the ISG Provider Lens™ Study on Digital Engineering Services 2024](https://blog.e-zest.com/hubfs/e-Zest%20%E2%80%93%20An%20Accion%20Labs%20Company%20-%20Gets%20Recognition%20as%20a%20Contender%20in%20the%20ISG%20Provider%20LensTM%20Study%20on%20Digital%20Engineering%20Services%202024.jpg) [NEWS](https://blog.e-zest.com/news) #### e-Zest – An Accion Labs Company gets Recognition as a Contender in the ISG Provider Lens™ Study on Digital Engineering Services 2024 We are delighted to announce that e-Zest – An Accion Labs Company has been ... [Read more](https://blog.e-zest.com/news/e-zest-an-accion-labs-company-gets-recognition-as-a-contender-in-the-isg-provider-lens-study-on-digital-engineering-services-2024) - ![e-Zest Solutions supports Digital Pune Mission](https://blog.e-zest.com/hubfs/blog-files/Digital%20Literacy%20Bus%20e-Zest.png) [CSR](https://blog.e-zest.com/csr) #### e-Zest Solutions supports Digital Pune Mission **Pune, India:** e-Zest Solutions, a leading digital technology innovation ... [Read more](https://blog.e-zest.com/csr/e-zest-solutions-supports-digital-pune-mission) - [Work](https://www.e-zest.com/our-work) - [Services](https://www.e-zest.com/our-services) - [Insights](https://blog.e-zest.com) - [Careers](https://www.e-zest.com/careers) - [Enterprise Data](https://www.e-zest.com/enterprise-data-services) - [Generative AI](https://www.e-zest.com/generative-ai) - [Innovations](https://www.e-zest.com/innovations) - [Healthcare](https://healthcare.e-zest.com) - [About](https://www.e-zest.com/about-us) - [Contact](https://www.e-zest.com/contact-us) - [Blog](https://blog.e-zest.com/) - [News](https://blog.e-zest.com/news) - [CSR](https://blog.e-zest.com/csr) - [![Linkedin Icon](https://blog.e-zest.com/hubfs/icons/linkedin_icon_white.svg)](https://www.linkedin.com/company/e-zest-solutions/) - [![Twitter Icon](https://blog.e-zest.com/hubfs/twitter-logo-silhouette%20(5).svg)](https://twitter.com/ezest) - [![Facebook Icon](https://blog.e-zest.com/hubfs/facebook-app-logo%20(4).svg)](https://www.facebook.com/61259256638) - [![Instagram Icon](https://blog.e-zest.com/hubfs/instagram-logo%20(4).svg)](https://www.instagram.com/ezestsolutions/) - [![Youtube Icon](https://blog.e-zest.com/hubfs/icons/youtube_icon_white.svg)](https://www.youtube.com/user/ezestcorporate) [![Go to top icon](https://blog.e-zest.com/hubfs/AA%20Assets/top%20button.svg)](https://blog.e-zest.com/be-proactive-adopt-security-culture#top) Hit enter to search or ESC to close Insights e-Zest members share technology ideas to foster digital transformation. - [Blog](https://blog.e-zest.com) - [News](https://blog.e-zest.com/news) - [Podcasts](https://www.e-zest.com/podcasts) - [Healthcare](https://blog.e-zest.com/healthcare) - [CSR](https://blog.e-zest.com/csr) - [Whitepaper](https://blog.e-zest.com/whitepaper) - [Playbook](https://blog.e-zest.com/playbook) - [Media Kit](https://www.e-zest.com/media-kit) # Be Proactive- Adopt Security Culture [Supriya Acharya](https://blog.e-zest.com/author/supriya-acharya) Mar 09, 2022 [Digital Transformation](https://blog.e-zest.com/topic/digital-transformation) [Digital Innovation](https://blog.e-zest.com/topic/digital-innovation) [Business Continuity](https://blog.e-zest.com/topic/business-continuity) [Disaster Recovery](https://blog.e-zest.com/topic/disaster-recovery) [Information Technology](https://blog.e-zest.com/topic/information-technology) [Business Processes](https://blog.e-zest.com/topic/business-processes) [CMMI V2.0](https://blog.e-zest.com/topic/cmmi-v2-0) [CMMI Categories](https://blog.e-zest.com/topic/cmmi-categories) [Information Security](https://blog.e-zest.com/topic/information-security) - - - - As a professional Marketing speaker, Bryan Eisenberg has said, “Facts tell, but stories sell.” Let us understand the significance of information security as work culture through this story. Story: “Hey Hi…” Re(Reactive)-Ramesh called his friend “Pro(Proactive)-Paresh” in the cafeteria of the organization. “Hi! How are you, friend?” Pro-Paresh walked up to him. “Busy?” Re-Ramesh asked him. “Hmm. My new project has just started. I am analyzing the security requirements from the contract.” Pro-Paresh answered. “I think you are overburdening yourself. In case there are any security requirements, then the client will share them with you.” Re-Ramesh said. “I will take your leave now. A lot of work to do.” Pro-Paresh said and went back to work. This was a conversation between two friends Pro-Paresh and Re-Ramesh who were working as Project Managers in an IT organization. Pro-Paresh was always proactive. His favorite quote was “If you fail to plan then you plan to fail.” He used to follow the organization’s policies and procedures while managing his projects. He was always prompt about the security of the client’s intellectual property in every form. On the other hand, the approach of Re-Ramesh was always reactive. He used to start working on the project without having a proper plan, policies, or procedures. A few days later, both of them met again in the cafeteria. Re-Ramesh was sitting all alone at a table, quietly. He seemed dejected, disheartened, and desolate. Pro-Paresh went to him. “Hey, friend!!! All well?” Re-Ramesh: “Nothing is well. Yesterday, a security incident happened in my project. The client was infuriated about it and he raised a complaint. I immediately called all the team members. We analyzed the situation and instantly corrected the web links. However, it DID NOT make the client happy.” Pro-Paresh: “How did the incident happen?” Re-Ramesh: “We missed one security requirement. Actually, the client was at fault. He did not mention it during the requirement collection meetings.” Pro-Paresh: “Oh. Ok. However, I think that you could have avoided such an embarrassing situation by better planning.” Re-Ramesh: “Was it possible? Haven’t you experienced a similar situation in your project ever?” Pro-Paresh: “I have not come across such a situation yet. Let me share my knowledge with you. As far as I have learned from my projects, Information Security is based on 4 pillars; Security requirements understanding, security awareness, secure design and coding, and security testing.” ![Information Security Pillars](https://blog.e-zest.com/hs-fs/hubfs/e-%20zest%20Pillars%20Oeganization-08.jpg?width=570&name=e-%20zest%20Pillars%20Oeganization-08.jpg)Re-Ramesh: “This is interesting.” Pro-Paresh: “The first pillar is security requirements understanding. Most of the time, the security requirements are mentioned in the project contract. Once we sign the contract, the organization is legally bound to fulfil those requirements. It is essential to understand those requirements. You may take the help of the legal team for the same. Additionally, during the requirement development phase, you may specifically discuss with the client and understand if there are any other security requirements.” Re-Ramesh: “The client should share the security requirements with us before we ask him.” Pro-Paresh: “You might be correct. However, clients might expect that a good organization like ours has information security as a best practice. Coming back to the security requirements, understand the organization’s security policies and practices as well. You may take the help of the Chief Information Security Officer to understand them. Lastly, we need to understand the client’s intellectual property as well. It might be in the form of documents, software licenses, previous applications, hardware devices, and developed code. Label the client’s intellectual property as applicable, and secure it physically and logically.” Re-Ramesh: “Got it.” Pro-Paresh: “Security awareness of the team is the second pillar". All the members of the project team must be aware of the security requirements that we discussed in the first point, including the client’s intellectual property. Ensure that each of them has undergone the information security awareness training. Check their awareness randomly. You may take help from the Chief Information Security Officer, Compliance team, and HR team for the same.” Re-Ramesh: “Yes. I will surely do it.” Pro-Paresh: “Now it’s the turn of the third pillar. It is secure design, and secure coding. Discuss with your Tech Lead and make sure that the security requirements are incorporated in application architecture. E.g. input validation, password and session management, SSL authentication, role-based authentication, encryption, etc. Discuss with the client and apply the principles such as separation of duties for access control. Maintain the list of access rights as well. You may also go through the secure design principles according to The Open Web Application Security Project (OWASP). (Darius Sveikauskas, 2021) Apply technology-specific secure coding guidelines and get the security code reviews done at a defined frequency. Due to peer reviews, the project team members are also educated about the security requirements.” Re-Ramesh: “This is really helpful. I am curious to know the fourth pillar.” Pro-Paresh: “The fourth pillar is security testing. The Vulnerability Assessment and Penetration testing ensure that your web application is secure in the public domain. In addition to that, ensure that the test engineer uses the security test cases while testing the security requirements. The test data which is used for testing is also very important. Make sure that no real data is used for testing without the client’s approval. Secure the test data properly.” Re-Ramesh: “Thanks, friend. Today you took off my blinkers. I have understood that information security is as important as delivering the solution on time. I will always keep the four information security pillars in mind. Now onwards, I will make information security as part of my work-culture.” Pro-Paresh: “Great! If you do so, then you will contribute to the organization’s business objective of Client Satisfaction and your client will always be happy as Larry.” Re-Ramesh went back to his work with a new zest, zeal, and zing. His journey towards “Pro-Ramesh” was now begun Moral: Proactive adoption of the four security pillars; security requirements understanding, security awareness, secure design and coding and security testing always keeps your client delighted.     - - - ### Similar Blog [![Elevating Product Engineering with AI and ML](https://blog.e-zest.com/hubfs/Elevating%20Product%20Engineering%20with%20AI%20and%20ML.jpg) Elevating Product Engineering with AI and ML As technology evolves and customer choices broaden, there is an increasing expectation for companies to not only deliver quality ... By Devendra Deshmukh Jul 10, 2024](https://blog.e-zest.com/elevating-product-engineering-with-ai-and-ml) [![How RAG-powered LLMs are Redefining Business Operations](https://blog.e-zest.com/hubfs/v1_Advancing-LLMs-with-RAG-for-Businesses_blog_image_2x.jpg) How RAG-powered LLMs are Redefining Business Operations Large Language Models (LLMs) like GPT process input text and generate output in a single step, based on the data it was trained ... By Harshal Gotmare Jun 24, 2024](https://blog.e-zest.com/how-rag-powered-llms-are-redefining-business-operations) [![Accelerating Data-driven Transformation: The Path to Enterprise Modernization](https://blog.e-zest.com/hubfs/v3_Accelerating-Data-Driven-Transformation--The-Path-to-Enterprise-Modernization_blog_image_2x-1.jpg) Accelerating Data-driven Transformation: The Path to Enterprise Modernization Today, as enterprises stand at the precipice of a new era defined by the convergence of technology and data-driven insights, ... By Devendra Deshmukh Jun 19, 2024](https://blog.e-zest.com/accelerating-data-driven-transformation-the-path-to-enterprise-modernization) [![Reimagining Customer Experience with Emerging Technologies](https://blog.e-zest.com/hubfs/blog-files/Newsletter/2024/Feb%202024.jpg) Reimagining Customer Experience with Emerging Technologies The advent of digital technologies has sparked a paradigm shift in how businesses operate and how consumers interact with brands. ... By Devendra Deshmukh Feb 22, 2024](https://blog.e-zest.com/reimagining-customer-experience-with-emerging-technologies) [![Navigating the Digital Frontier & Embracing Change](https://blog.e-zest.com/hubfs/Blog_Files/v2_december_blog_2x_2560x1334-2%202.jpg)](https://blog.e-zest.com/navigating-the-digital-frontier-embracing-change) [Navigating the Digital Frontier & Embracing Change](https://blog.e-zest.com/navigating-the-digital-frontier-embracing-change) [2023 witnessed rapid advancements in](https://blog.e-zest.com/navigating-the-digital-frontier-embracing-change)[Artificial Intelligence (AI)](https://blog.e-zest.com/7-ways-ai-is-improving-our-daily-lives) and its influence on diverse industry verticals, transcending ... By Devendra Deshmukh Jan 09, 2024 [![The Journey of Quality Management System (QMS) towards Business Management System (BMS)](https://blog.e-zest.com/hubfs/Blog_Supriya.png) The Journey of Quality Management System (QMS) towards Business Management System (BMS) ISO 9001:2015 standard is now arrived and it is one more step towards revolution in the QMS implementation. Actually there are ... By Supriya Acharya Apr 19, 2016](https://blog.e-zest.com/the-journey-of-quality-management-system-qms-towards-business-management-system-bms) [![Risk Management – A proactive approach in Project/Process Management](https://blog.e-zest.com/hs-fs/file-3395403564-png/blog-files/risk-management1.png) Risk Management – A proactive approach in Project/Process Management Risk Management is going to be a mandatory requirement for all ISO standards. Until now, risk management was a requirement of ... By Supriya Acharya Mar 23, 2015](https://blog.e-zest.com/risk-management-a-proactive-approach-in-projectprocess-management/) [![Analogy between ISO 9001:2008 standard and routine life](https://blog.e-zest.com/hs-fs/file-3395402034-png/blog-files/qms.png) Analogy between ISO 9001:2008 standard and routine life I have been working on the ISO 9001 standard since the past 8 years. Establishing processes, preparing new templates and ... By Supriya Acharya Feb 16, 2015](https://blog.e-zest.com/analogy-between-iso-90012008-standard-and-routine-life/) ## Helping Organizations Thrive in the Digital Age [Contact Us](https://www.e-zest.com/contact-us) - [About](https://www.e-zest.com/about-us) - [Services](https://www.e-zest.com/our-services) - [Work](https://www.e-zest.com/our-work) - [Insights](https://blog.e-zest.com/) - [Healthcare](https://healthcare.e-zest.com/) - [Accion Labs](https://www.accionlabs.com/) - - - - - - Dallas - Detroit - Hannover - Vienna - London - Pune © 2025 e-Zest Solutions - [Privacy Policy](https://www.e-zest.com/privacypolicy) - [Cookie Policy](https://www.e-zest.com/cookie-policy) Contact us Contact us e-Zest is a leading digital innovation partner for enterprises and technology companies that utilizes emerging technologies for creating engaging customers experiences. Being a customer-focused and technology-driven company, it always helps clients in crafting holistic business value for their software development efforts. It offers software development and consulting services for cloud computing, enterprise mobility, big data and analytics, user experience and digital commerce.