Security

Partying With Security Instead of Compliance

Leave a comment

DarkReading has posted the following analysis of the difference between security and compliance. I can’t tell if it’s meant to be a joke. It reads a bit like something you might find in The Onion.

I’ll say it. “Security is exciting.” Security is where the fighting with the bad guys takes place. It is where spies (malware) operate, attacks take place (denial of service, breaches), and the kingdom is heroically defended (firewalls, access control, passwords).

The information princess is protected by the secret service agents of the business kingdom. Just like a cool video game, the security teams have new battles to face each day, filled with new technology threats, clever enemies, and often, lots of caffeine.

Meanwhile, most would say that compliance is boring. It is administrative in nature: Meet the requirements on a checklist, convince people to follow rules that don’t interest them and create more work for them, prepare for exams (audits), and try to make everyone generally behave. Compliance is the uptight adult that tells security their party is making a big mess and disturbing everyone else in the house.

Here is the giant gaping hole in the analysis: compliance is an extension of security. It is not an either-or dichotomy.

The Dark Reading analogy to me reads like being a loner at a party who thinks he is cooler than everyone else is far more fun than being a socialite that everyone gets along with. It sounds backwards because it is. The better analysis is that after you decide how cool you are you have the option to convince others of the same. Of course if you can have fun on your own…go ahead, but don’t call it a party.

Security is an isolated, singular, view of controls whereas compliance is a group, shared, view of the same controls.

For example, if you think disabling grauitous ARP is absolutely critical to protecting your network and you are master and commander of your network then you go right ahead and disable it and pat yourself on the back. Self high-five. Was that exciting for you? Now try walking into a global enterprise. Do you think you are going to convince every network and system admin, their managers, not to mention product vendors, that you are going to disable the beloved ARPs? Talk about a party.

Some might want to call the isolated view of the dictator more fun because they are unprepared or willing to put themselves up against any real economic and social/political challenges.

If you are thrilled to meet with experts across many lines of business, listen carefully to their unique requirements and logic, and work together with them on finding the best security fit/solutions to help them fight against bad guys, then compliance will excite you. In other words, if you enjoy taking the theoretical and making it practical, security becomes far more exciting when it becomes compliance. Unfortunately some devolve compliance into checklists, but that’s bad compliance. Hey, there’s bad security too.

Compliance is security applied.

Security

Active Defense: Moving the Discussion Forward

1 Comment

Cyber-attacks against companies, organizations and governments have hit an unprecedented high. The ease with which hackers can launch multiple attacks has also increased.  Hacking has become big business with nation-states, terrorist groups, organized crime and others capitalizing on the theft of information (trade secrets, technology, intellectual property, others) and disrupting businesses they are in competition with. Are the current defenses working?  Unless you live in a shoe box you realize, especially based on daily news reports, that the cyber war appears to be one the good guys are losing.

A change is needed because the problem has gotten out of hand. Current laws hinder organizations from defending themselves while at the same time facilitating the efforts of hackers. So, rather than jumping to the conclusion that any action to defend your organization beyond the currently accepted techniques is illegal, a discussion needs to be started and moved forward about better and more effective options.  It appears it has.

In a recent Washington Post article[1] the issue of defending outside of one’s network and possibly entering the server of another, active defense, was raised.  Again the knee jerk reaction is that it’s illegal, but the conversation continued. 

“[It is] important to enable companies whose computer networks are targeted by criminals and foreign intelligence services to detect who’s penetrating their systems and to take more aggressive action to defend themselves,  said Steven Chabinsky, a 17-year FBI veteran who stepped down this month as the FBI’s top cyber lawyer.    The article continued with Stewart A. Baker, a former senior Homeland Security Department official stating, “The issue . . . is that entering another party’s server and deleting or encrypting data could, under some circumstances, violate a number of state and federal laws — including those against computer fraud or trespassing.”  “But, he said, there is a legal argument to be made that such an action is a reasonable defense of one’s property.  Though common in other contexts, that defense has yet to be tested in the cyber area in court.”

Top officials and leaders in this area predict growth as companies decide enough is enough.  “Former CIA director Michael V. Hayden has said that given the limits of the government in protecting companies in cyberspace, he expects to see the emergence of a “digital Blackwater,” or firms that hire themselves out to strike back at online intruders.”

I agree, this is exactly where we are headed and the discussion must go further.  Based on current laws, technology and state of affairs there is much more companies and organizations can do to defend themselves.  I am not advocating vigilantism, but a military-like operation that helps leaders of organizations walk through possible tools and techniques while evaluating risk, liability and legal issues every step of the way in an effort defend their most precious assets.

That is why Davi and I will be presenting at several upcoming conferences, including ISSA and RSA, a practical and legal approach to Active Defense. I look forward to seeing you there.

[1] Nakashima, Ellen, “Cybersecurity should be more active, official says,” The Washington Post – National Security (September 16, 2012)

Security

PCI Draft ATM Security Guidelines Information Supplement

Leave a comment

The PCI SSC recently released a draft information supplement with suggested best practices to stop attacks by assessing the security of an ATM and its components. The PCI SSC has been focused primarily on protecting PIN devices yet this supplement will address broader issues such as communication and processing by increasingly sophisticated ATMs.

Comments are being solicited from Participating Organizations until November 13, 2012 on the ATM Security Guidelines Information Supplement.