Operations
3/18/2015
05:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

New Security Mindset: Focus On The Interior

Chief privacy officer Jason Straight shares his insights on why organizations are struggling to stop the breach wave -- and manage the aftermath.

Hackers keep on hacking, breaches keep on happening. The cycle continues, as major corporations now routinely get successfully compromised. A key element of the equation now is properly and efficiently responding to an attack as well as managing its aftermath.

The same old security missteps--falling for phishing attacks, not locking down sensitive data internally, giving users too much access, for instance--keep recurring. That's because many organizations aren't putting their security energy in the right places, according to Jason Straight, senior vice president and chief privacy officer at UnitedLex, which provides outsourcing services and support for the legal industry. 

Legal typically isn't properly looped in, either. "As we see with any big breach, it may start out as an IT problem, but very quickly it becomes, in some cases, an existential business crisis. And in almost every case, there are serious legal issues that arise," he says.

An attorney, Straight runs the cyber-risk solutions practice for UnitedLex as well as its internal risk management operation. "We need to get lawyers more involved in cyber-risk," says Straight, who at next month's Interop conference in Las Vegas will give a presentation on insider threats as well as participate as a panelist debating the weakest links in security.

Straight spoke with Dark Reading this week about these hot-button issues. 

Dark Reading: Hack upon hack, breach after breach, we can't seem to stop the wave of attacks out there today. Yet the security industry is exploding with employment opportunities, products, and new startups. What gives?

Straight: [Organizations] are investing security resources in the wrong place. There's a fundamental discrepancy here in that attackers out there for financial gain get paid every time they are right, collecting credit card numbers, SSNs, or whatever [they steal]. They are literally getting paid every time they are right. They have incentive to get better at this.

On the defense side, there are only negative incentives. Whether you're a CISO or security consultant, no one comes by your office at the end of the day and says "Great work today--we didn't have any breaches." When something goes wrong, there's a line outside your door. There are mostly negative incentives. That's an imbalance I don't see going away [soon].

Dark Reading: What are organizations doing wrong in how they're focusing their energies in security?

Straight:  Misallocation of security resources: we continue to be more focused on perimeter protection than on internal controls and monitoring. It's clear that attackers are already inside or could be anytime they want and there's nothing you can do about it on the perimeter. We continue to dump money in there, which is exactly what the security industry wants you to do. There's a ton of money in selling all these tools.

The media is focused mostly on sexy, state-sponsored attacks. You would think external attacks cause all the damage. But study after study, two-thirds of attacks are mundane insider errors, lost equipment, technology failures, or lack of oversight over vendors. All of this is pushing people to continue to spend money in an area where it's not the best use [the perimeter]. I'm not saying forget the perimeter. It's got to be a balance, with a focus on the interior, too. DLP [data leakage prevention], for example, is still massively underutilized, and SIEM has a lot more room to grow.

The big reason people are not focused as much internally is that it's hard. It's easy to gain support to build the castle walls higher; everybody can get behind that.

When you say let's start restricting access internally to sensitive documents, [someone asks], "but wait, is that going to make it harder for me to do my job?" The answer is yes. You have to use two-factor authentication every time you log in from the outside, more complex passwords, more frequent password changes. Internal controls are inconvenient, so it requires a cultural change … It's hard to get support inside.

[Everything you need to know about today’s IT security challenges – but were afraid to ask. Register with Discount Code DRBLOG to save $100 for this special one-day event, Dark Reading's Cyber Security Crash Course at Interop on Wednesday, April 29.]

Dark Reading: The insider threat or risk is huge, obviously. But there's so much debate over how to manage that. What's the best way for an organization to get a handle on this?

Straight: The human layer is definitely the most vulnerable, but I don't agree that it is an intractable problem. There are things you can do to turn this thing around, and if done right, you can transform what is your biggest vulnerability into one of the strongest parts of your security program. Human beings are the most sophisticated detection devices you've got.

You can have one of the greatest user training programs on the planet that's effective for six months, and then everyone forgets everything. It's not one and done. In terms of having a lasting impact, it's better to do in-person [training] and not just online. You need to get everyone in a room to interact and ask questions. Potentially the most important part of creating effective [security] awareness training is you must have 100% support and buy-in from corporate leadership, the CEO, general counsel, CFO, and other business leaders. It needs to be driven by executives.

Jason Straight, senior vice president and chief privacy officer at UnitedLex

Jason Straight, senior vice president and chief privacy officer at UnitedLex

Dark Reading: As an attorney and someone very close to trends in the legal world, how do you see legal's role evolving in security, especially when it comes to handling things in the aftermath of a data breach?

Straight: On the IR [incident response] side, there's a cottage industry that's grown up of a decent number of lawyers who've had trial by fire. They really know how to handle it, how to participate with regulators, and know what the media is asking. But there's still a lot of work to do.

Where we're still having trouble is taking lessons learned in IR and … taking what we've learned from lawyers and applying to broader information risk programs. Lawyers are rarely involved in doing risk assessment. [They] need to be at the table and should be part of the process where we understand what the risks are.

You need to make sure Legal has a formal and well-defined role in IR before there's an incident.

Ideally, you want to make two announcements when you have a breach. The first is, "we've had an incident and an investigation is underway." Keep it very simple. You cannot really start to characterize an incident until you have completed the investigation … and determined the scope of the breach. A lawyer will bring that perspective: "How sure are we?" If you say too much [publicly], it can and will be used against you. Lawyers have a critical role in not only [helping] manage the message, but in anticipating "if we're wrong, will it hurt" the company's reputation? There's a lot of emotion in a breach and people take it very personally. That's a dangerous situation, and a decision can be driven more by emotion than logic. That's where the lawyer comes in.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/8/2015 | 7:42:28 AM
Re: An Outline for a Quick and Dirty InfoSec Governance Team
@Christian, thanks for sharing this. A nice addition to Straight's insights. 
Christian Bryant
50%
50%
Christian Bryant,
User Rank: Ninja
5/7/2015 | 5:15:37 PM
An Outline for a Quick and Dirty InfoSec Governance Team
This was a great interview and one of the most packed I've read in recent weeks with take-away material for research and reflection.  The notes on how focus on the wrong things for organizations when it comes to InfoSec rings true.  While not entirely focused on the "interior" I have a simplistic model below that does put focus on three key areas that ultimately translate to improving the integrity of "interior" data and processes.  

Not to oversimplify Information Security and the complex roles that need to be filled for organization-wide coverage, but these three points are great shortcuts to establishing an InfoSec governance team, especially for small orgs that may not have the resources for a formal loss prevention lifecycle.  Because the environment elements often overlap with these states, you then can have the same person (for very small teams) take more than one function.  

Org Function 1:

* Governs architecture/standards/implementation/lifecycle:  Network data that is in transit, flowing across internal networks and to the outside world (i.e., data on the wire and in the air). 

Org Function 2:

* Governs architecture/standards/implementation/lifecycle:  Data that is at rest on servers, databases, file shares, Intranet sites, workstations, laptops, mobile devices, portable storage, backup tapes, removable media, cloud storage. 

Org Function 3:

*  Governs usage standards/auditing/lifecycle:  Data that is in use in temporary memory on a local machine, an open report or running query on a workstation, an email that has been drafted but not sent, a file being copied to a USB drive, and data being copied and pasted from one local document to another. 

Feeding into all three of these areas would be incident response root cause analysis reports for continuous improvement for each lifecycle and their interfaces. 

A tight, compact approach to InfoSec and one that could improve upon some of the shortcomings this article mentions.

(Nod to Ernst & Young's 2011 data security report for some of the above verbiage.)
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
3/19/2015 | 3:06:13 PM
Re: Perimeter Emphasis

I agree. External and internal; security measures. Unless it is layered it does not really matter what you do in any side of your network perimeter.

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
3/19/2015 | 3:03:51 PM
Re: Excellent interview of a person who has a clear understanding of information security. Thanks!

"You need to make sure Legal has a formal and well-defined role in IR before there's an incident"

I completely agree with this, at the end of the day, an incident would have a legal liability, you may want to cover that aspect of it from the beginning.

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
3/19/2015 | 3:01:23 PM
Re: Excellent interview of a person who has a clear understanding of information security. Thanks!

I would not categorize humans as most sophisticated detection devices, they are sophisticated for sure and because of that could to really detect anything unless it is absolutely made visible to them. If we can take humans out of security equation we will be in better shape.

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
3/19/2015 | 2:56:20 PM
An industry was created
I do not have an evidence to prove what I am saying here, there is a real industry is created on the security, security insurance, security devices and applications  companies are living their golden days. You can not create an industry by just hacking, there must be big investors and supports of this industry that we may not be aware of.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
3/19/2015 | 11:43:12 AM
Perimeter Emphasis
This was a great interview. I didin't realize how much emphasis was put on perimeter defenses and how underutilized internal defenses were until Jason alluded to this. Looking at it now, that fact couldn't have been more prevalent. I agree with his statements in the first step to moving towards increasing the security posture internally is to change the mind set of the human element with frequent human training sessions backed by the executives. Otherwise, we will continue to build these walls to the sky.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
3/19/2015 | 11:20:22 AM
Re: Excellent interview of a person who has a clear understanding of information security. Thanks!
Thank you for sharing your thoughts, @xmarksthespot. I think Straight's perspective as both a lawyer and a cyber security expert make his insights even more interesting and helpful.
xmarksthespot
50%
50%
xmarksthespot,
User Rank: Apprentice
3/19/2015 | 2:50:30 AM
Excellent interview of a person who has a clear understanding of information security. Thanks!
Jason Straight has a clear understanding of core security principles. "I'm not saying forget the perimeter. It's got to be a balance, with a focus on the interior, too":  This is a well-crafted statement by Straight.  Defense-in-depth is a core security principle.

It appears he includes 2 factor authentication as part of internal security, but in my mind it also can be authentication via a site on the web, like some banks are now supporting, which is external.  It seems to me like the one other area internally is encryption of data at rest and data in transit (all internal network traffic). 

The human layer is definitely the most vulnerable, but I don't agree that is an intractable problem. ... Human beings are the most sophisticated detection devices you've got". - Another golden nugget from Mr. Straight. 

He has a good point where the security industry is pushing for people to purchase more and more endpoint solutions out there, and the focus should be internal controls.

Thank you, Jason Straight
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Changing Face of Identity Management
Mobility and cloud services are altering the concept of user identity. Here are some ways to keep up.
Flash Poll
10 Recommendations for Outsourcing Security
10 Recommendations for Outsourcing Security
Enterprises today have a wide range of third-party options to help improve their defenses, including MSSPs, auditing and penetration testing, and DDoS protection. But are there situations in which a service provider might actually increase risk?
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.