In IT Security, it is claimed that good security practice is made up of technology, process and people.
But how do you dis-entangle "Process" from "People" because people implement the process?
In IT Security, it is claimed that good security practice is made up of technology, process and people.
But how do you dis-entangle "Process" from "People" because people implement the process?
But how do you dis-entangle "Process" from "People" because people implement the process?
People come and go - but if there is a good Process, and reasonable documentation of that process, then the system will continue to work smoothly.
Think of Process as the road, and people as the cars. The road helps ensure that cars can go from source to destination, and (generally) avoid collisions, and have signs all along the way to direct them. As long as the road is there, the cars will keep moving; take away the road, and you've got a lot of cars going nowhere.
People are trained and gain experience in processes (and tools), which adds value.
People also think and imagine beyond the processes and tools to improve and evolve the way risks are assessed and treated. And they improve the processes and tools.
The weakest link in security is People, why we say like that is the mistakes (intentional and unintentional) from people are immense.
The People here could be the security professionals who implements policies, who follows the policies, who audit the practices, etc.
Answer to your question, "But how do you dis-entangle "Process" from "People" because people implement the process?" is processes are not defined based on people. The Processes follow best practices in definition of process, implementation and Monitoring (control).
The person who defines process may not be the one follows it, people who defines a standard may not be the one who follows it, and the one who auditing the practice could be another one. This is how the dis-entangle of people from process is ensured.