I am a firm believer that language matters; the words you choose inform what you do. With that in mind, I urge all information security practitioners to stop “Enabling” the business and start “Facilitating” the business.
The Merriam Webster dictionary defines “Enable” as follows:
1 a: to provide with the means or opportunity
// training that enables people to earn a living
b: to make possible, practical, or easy
// a deal that would enable passage of a new law
c: to cause to operate
// software that enables the keyboard
2: to give legal power, capacity, or sanction to
// a law enabling admission of a state
Interestingly, the antonym listed for “Enable” is “Prevent”.
Whereas the definition for “Facilitate” is:
: to make easier : help bring about
// facilitate growth
The antonym that was given for “Facilitate” is “Complicate”.
The term enabling has always held passive and somewhat negative connotations. Think of it as standing by and enabling someone’s addiction. As practitioners, when we enable a business to take on risk, we are presented with the business addiction to risk, and make it possible for them to take on risk.
The term facilitating has much more of an active connotation. We are no longer passive participants and much more active partners. When we facilitate the business, we practitioners are now active partners and work with the business to integrate security into the risk it needs to take.
As an observation about the evolution of the information security practice, we transitioned from preventing the business from doing things to enabling them. It is time for us to evolve to facilitate the business.