Archive

Archive for the ‘Infosec Management Tips’ Category

Infosec Management Tip: Beware Security Fads

July 20, 2012 Comments off

Tools are a Means, Not an End
One of the biggest shames of our industry right now is that “silver bullet” tools have such a hold on media and mind share. Organizations typically try to deploy the latest product in isolation, without understanding what’s causing the issues they’re seeing. But tools used this way are bound to fail, raid the corporate budget, tie up valuable resources and just obscure the symptoms of the problem for a while longer. Organizations can only fix what’s broken by understanding the problems clearly and developing a solution using proven methods that fixes them. Only then should you start thinking about what tool fits into the solution.

Example: A lot of companies have asked about “tuning” their latest flashy box that’s not working right. But when you get talking to them, you find that the problem isn’t with the product it’s somewhere else. Even if the product was at 100% efficiency, you still wouldn’t be able to solve the problem. One company had spent tens of millions of dollars on SIEM and other tools, but were using business school interns to run the SOC and didn’t have any plan for handling incidents! Another company had a DLP device that sat on the shelf for 2 years, and they hadn’t even clearly defined what data they cared about or where it should and shouldn’t be. Tuning in those situations would only be an expensive way of buying false assurance.

This is part of a series of short tips for Information Security Managers, where Stratigos Security will provide you with some of the benefits of our experience working with others like you. If you like what you read, come back for more!

Infosec Management Tip: Focus on Fundamentals

July 18, 2012 Comments off

Focus on Fundamentals
The basics take attention, consistency, time and iterative improvements. And they’re very effective! But too often we get distracted by other things to do what’s needed. Instead, planning and project management can go a long way towards actually putting the fundamentals into place. Automating and making the basics a part of a routine can free you up to think about other issues and allow you to take action when you find something that really does need attention. And these things usually turn out to be very effective and cost efficient.

Example: I’ve audited a few places with very good security. And they’re the ones who start by giving their IT department the authority to operate (solid, board-approved policies), have standardized processes for things that are followed (formal procedures and light audits), hardening their systems (limited user, no default accounts or passwords), having good network limitations and visibility (segmentation with ACLs and open source IDS sensors that are watched), solid patch management (quarterly cycles with emergency processes, including servers and workstations, not just the OS but also client-side third party software), and good security awareness (human-based training, awareness at the executive level, regular testing and improving based on the results). These are all things that take consistency and improvement over time, rather than expensive tools and huge one-time projects.

This is part of a series of short tips for Information Security Managers, where Stratigos Security will provide you with some of the benefits of our experience working with others like you. If you like what you read, come back for more!

Infosec Management Tip: Cultivate Understanding

July 16, 2012 Comments off

Cultivate Understanding
This is the opposite of running around trying to inform everybody of what you think is the biggest problem. It means getting with them to understand what their problems are, where their risk prioritization is and then find out where your concerns fit in there. Maybe they’re already aware of the threat and aren’t concerned; or maybe they have a way to mitigate it you hadn’t thought of; or maybe they need to listen, but don’t trust Infosec yet. By bringing the business into the Infosec decision making process, there’s more trust, more chance they’ll listen when you talk, more chance you’ll have the right answer for their needs and usually that all means more budget, plus more willingness to go along with what you want!

Example: I know of a company that was going into China to open R&D centers. The CISO was trying to say “no we shouldn’t, it’s too risky because somebody could steal our IP.” But the business knew this – their strategy around it was to lean on other assets like brand reputation (which is actually fairly well protected in China) to prevent against that. In other words, lost IP wouldn’t necessarily translate into lost revenue or profits. In another company the BOD wanted to have their updates and formal reports delivered to an iPad. The CISO worked with Finance to say yes because the costs of securing the digital distribution were less and results better than securing the hard copies. IT and Security helped save money, reduce risk and got a high visibility win for the company.

This is part of a series of short tips for Information Security Managers, where Stratigos Security will provide you with some of the benefits of our experience working with companies large and small. If you like what you read, come back for more!