Partner Perspectives  Connecting marketers to our tech communities.
9/22/2015
09:15 AM
Gavin Millard
Gavin Millard
Partner Perspectives
100%
0%

Buyer Beware: How To Avoid Getting Sucked Into Shelfware

Three simple questions can help ensure you get the most value out of your information security investments.

We’ve all seen slick pitches by information security vendors eager to grab budget. Some are valid, concentrating on the critical controls required in today’s world to protect our data; others are of slightly less need and merit.

Sales will be sales; compensation drives behavior, and when you’re faced with a sales team earning a significant commission from selling tools that protect you from all the “l337 h4x0rs,” sometimes that behavior is less than in the best interests of the buyer. As much as a vendor will advise you on which technology is best suited for the issues faced, remember they are often primarily trying to sell their solution. When was the last time you went to a BMW dealer to look for a new car and, after discussing your requirements, they suggested an Audi? Or even less probable, they said that you should keep what you have and just give it a clean and a service?

This isn’t a rant about sales teams; I’ve worked with some amazing salespeople who care about the customer and the problems they face. This is more about what you should consider before signing on the dotted line.

Security technologies are rarely simple, more often requiring effort to manage and operationalize effectively to gain the level of protection evangelized in the sales process. A good CISO friend of mine once told me that no matter what the vendor of a product tells him (including me), he always calculates the cost of managing any control at a 5:1 ratio -- calculating the operational costs as five times the amount spent on actual licenses. Far too many companies want to throw money at a silver bullet rather than put the effort into actually fixing the problem, which leads to lots of license sales but low return on investment.

Beware Of Shelfware

It seems odd that companies would spend a huge amount of money on a technology and not implement it fully, but shelfware (or underutilized technology) is a known problem in the industry. When Target got popped at the end of 2013, reading the kill chain analysis gave a sobering and clear view of the problem. The retailer had spent a significant amount of money ($1.6 million) on a market-leading anti-malware solution to defend against the very attacks it experienced, but it ignored the alarms raised by the platform, idly standing by as critical data flowed out into the hands of cybercriminals. Target had invested nearly $2 million on a control many would argue is the right approach to addressing the threat of targeted malware. Yet due to an inability to actually operationalize the control effectively, the retailer paid an even bigger price. Simply buying an expensive security technology is useless if it’s not implemented properly.

With every purchase, more consideration should be given to how the product will add value to the overall business. People, process, and technology are often cited as the critical considerations to think about for a control. But for me, I also like to think about measure, validate, and communicate.

I like to pose three simple questions when talking about implementing any control or suggesting an investment in a technology:

  • How will you measure that the control is effectively deployed and fully functional?
  • How will you test and validate that the control is giving the desired level of protection?
  • How will you demonstrate iterative improvements to the overall security of the organization and communicate the value of the investment made?

So next time you’re across the table from a vendor, try posing these questions. Vendors with a desire to help and a solid approach will undoubtedly provide guidance through examples of other work they’ve done with similar customers, metrics to use to measure the operational efficiency, and advice on how to demonstrate the value of the solution.

Vendors love to state that their solution is “almost plug and play,” or that you can “just drop it in and it works like a charm with proactive protection out of the box.” But after the proof of concept is done, the purchase orders are sent, and the license keys are received, make sure you're getting the most value you can from the investment, because security budgets are tight enough already.

Gavin Millard is a trained, ethical hacker who works with medium and large enterprises to address their cybersecurity challenges. With a deep understanding of how attackers plot a breach, he helps bring these companies to a trusted state of IT infrastructure. He previously ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Data Privacy Careers Are Helping to Close the IT Gender Gap
Dana Simberkoff, Chief Compliance and Risk Management Officer, AvePoint, Inc,  8/20/2018
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
Tenable Network Security provides continuous network monitoring to identify vulnerabilities, reduce risk and ensure compliance. Its family of products includes SecurityCenter Continuous View™, which provides the most comprehensive and integrated view of network health, and Nessus®, the global standard in detecting and assessing network data. Tenable identifies all types of risk on the network — including missing patches, malware and intruders, missing configurations and missing monitoring — so customers can make informed decisions about where they are exposed. Its products reach across cloud, virtual, mobile and traditional IT systems and measure attack vectors in each of these domains. Tenable’s continuous network monitoring solution measures organizations’ compliance in real-time. This ensures that gaps in security coverage and lapses in security programs get detected and prioritized immediately. Tenable is relied upon by many of the world’s largest corporations, not-for-profit organizations and public sector agencies, including the entire U.S. Department of Defense.
Featured Writers
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15601
PUBLISHED: 2018-08-21
apps/filemanager/handlers/upload/drop.php in Elefant CMS 2.0.3 performs a urldecode step too late in the "Cannot upload executable files" protection mechanism.
CVE-2018-15603
PUBLISHED: 2018-08-21
An issue was discovered in Victor CMS through 2018-05-10. There is XSS via the Author field of the "Leave a Comment" screen.
CVE-2018-15598
PUBLISHED: 2018-08-21
Containous Traefik 1.6.x before 1.6.6, when --api is used, exposes the configuration and secret if authentication is missing and the API's port is publicly reachable.
CVE-2018-15599
PUBLISHED: 2018-08-21
The recv_msg_userauth_request function in svr-auth.c in Dropbear through 2018.76 is prone to a user enumeration vulnerability because username validity affects how fields in SSH_MSG_USERAUTH messages are handled, a similar issue to CVE-2018-15473 in an unrelated codebase.
CVE-2018-0501
PUBLISHED: 2018-08-21
The mirror:// method implementation in Advanced Package Tool (APT) 1.6.x before 1.6.4 and 1.7.x before 1.7.0~alpha3 mishandles gpg signature verification for the InRelease file of a fallback mirror, aka mirrorfail.