Partner Perspectives  Connecting marketers to our tech communities.
9/22/2015
09:15 AM
Gavin Millard
Gavin Millard
Partner Perspectives
100%
0%

Buyer Beware: How To Avoid Getting Sucked Into Shelfware

Three simple questions can help ensure you get the most value out of your information security investments.

We’ve all seen slick pitches by information security vendors eager to grab budget. Some are valid, concentrating on the critical controls required in today’s world to protect our data; others are of slightly less need and merit.

Sales will be sales; compensation drives behavior, and when you’re faced with a sales team earning a significant commission from selling tools that protect you from all the “l337 h4x0rs,” sometimes that behavior is less than in the best interests of the buyer. As much as a vendor will advise you on which technology is best suited for the issues faced, remember they are often primarily trying to sell their solution. When was the last time you went to a BMW dealer to look for a new car and, after discussing your requirements, they suggested an Audi? Or even less probable, they said that you should keep what you have and just give it a clean and a service?

This isn’t a rant about sales teams; I’ve worked with some amazing salespeople who care about the customer and the problems they face. This is more about what you should consider before signing on the dotted line.

Security technologies are rarely simple, more often requiring effort to manage and operationalize effectively to gain the level of protection evangelized in the sales process. A good CISO friend of mine once told me that no matter what the vendor of a product tells him (including me), he always calculates the cost of managing any control at a 5:1 ratio -- calculating the operational costs as five times the amount spent on actual licenses. Far too many companies want to throw money at a silver bullet rather than put the effort into actually fixing the problem, which leads to lots of license sales but low return on investment.

Beware Of Shelfware

It seems odd that companies would spend a huge amount of money on a technology and not implement it fully, but shelfware (or underutilized technology) is a known problem in the industry. When Target got popped at the end of 2013, reading the kill chain analysis gave a sobering and clear view of the problem. The retailer had spent a significant amount of money ($1.6 million) on a market-leading anti-malware solution to defend against the very attacks it experienced, but it ignored the alarms raised by the platform, idly standing by as critical data flowed out into the hands of cybercriminals. Target had invested nearly $2 million on a control many would argue is the right approach to addressing the threat of targeted malware. Yet due to an inability to actually operationalize the control effectively, the retailer paid an even bigger price. Simply buying an expensive security technology is useless if it’s not implemented properly.

With every purchase, more consideration should be given to how the product will add value to the overall business. People, process, and technology are often cited as the critical considerations to think about for a control. But for me, I also like to think about measure, validate, and communicate.

I like to pose three simple questions when talking about implementing any control or suggesting an investment in a technology:

  • How will you measure that the control is effectively deployed and fully functional?
  • How will you test and validate that the control is giving the desired level of protection?
  • How will you demonstrate iterative improvements to the overall security of the organization and communicate the value of the investment made?

So next time you’re across the table from a vendor, try posing these questions. Vendors with a desire to help and a solid approach will undoubtedly provide guidance through examples of other work they’ve done with similar customers, metrics to use to measure the operational efficiency, and advice on how to demonstrate the value of the solution.

Vendors love to state that their solution is “almost plug and play,” or that you can “just drop it in and it works like a charm with proactive protection out of the box.” But after the proof of concept is done, the purchase orders are sent, and the license keys are received, make sure you're getting the most value you can from the investment, because security budgets are tight enough already.

Gavin Millard is a trained, ethical hacker who works with medium and large enterprises to address their cybersecurity challenges. With a deep understanding of how attackers plot a breach, he helps bring these companies to a trusted state of IT infrastructure. He previously ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Want Your Daughter to Succeed in Cyber? Call Her John
John De Santis, CEO, HyTrust,  5/16/2018
New Mexico Man Sentenced on DDoS, Gun Charges
Dark Reading Staff 5/18/2018
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
Tenable Network Security provides continuous network monitoring to identify vulnerabilities, reduce risk and ensure compliance. Its family of products includes SecurityCenter Continuous View™, which provides the most comprehensive and integrated view of network health, and Nessus®, the global standard in detecting and assessing network data. Tenable identifies all types of risk on the network — including missing patches, malware and intruders, missing configurations and missing monitoring — so customers can make informed decisions about where they are exposed. Its products reach across cloud, virtual, mobile and traditional IT systems and measure attack vectors in each of these domains. Tenable’s continuous network monitoring solution measures organizations’ compliance in real-time. This ensures that gaps in security coverage and lapses in security programs get detected and prioritized immediately. Tenable is relied upon by many of the world’s largest corporations, not-for-profit organizations and public sector agencies, including the entire U.S. Department of Defense.
Featured Writers
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11354
PUBLISHED: 2018-05-22
In Wireshark 2.6.0, the IEEE 1905.1a dissector could crash. This was addressed in epan/dissectors/packet-ieee1905.c by making a certain correction to string handling.
CVE-2018-11355
PUBLISHED: 2018-05-22
In Wireshark 2.6.0, the RTCP dissector could crash. This was addressed in epan/dissectors/packet-rtcp.c by avoiding a buffer overflow for packet status chunks.
CVE-2018-11356
PUBLISHED: 2018-05-22
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the DNS dissector could crash. This was addressed in epan/dissectors/packet-dns.c by avoiding a NULL pointer dereference for an empty name in an SRV record.
CVE-2018-11357
PUBLISHED: 2018-05-22
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the LTP dissector and other dissectors could consume excessive memory. This was addressed in epan/tvbuff.c by rejecting negative lengths.
CVE-2018-11358
PUBLISHED: 2018-05-22
In Wireshark 2.6.0, 2.4.0 to 2.4.6, and 2.2.0 to 2.2.14, the Q.931 dissector could crash. This was addressed in epan/dissectors/packet-q931.c by avoiding a use-after-free after a malformed packet prevented certain cleanup.