Partner Perspectives  Connecting marketers to our tech communities.
9/22/2015
09:15 AM
Gavin Millard
Gavin Millard
Partner Perspectives
100%
0%

Buyer Beware: How To Avoid Getting Sucked Into Shelfware

Three simple questions can help ensure you get the most value out of your information security investments.

We’ve all seen slick pitches by information security vendors eager to grab budget. Some are valid, concentrating on the critical controls required in today’s world to protect our data; others are of slightly less need and merit.

Sales will be sales; compensation drives behavior, and when you’re faced with a sales team earning a significant commission from selling tools that protect you from all the “l337 h4x0rs,” sometimes that behavior is less than in the best interests of the buyer. As much as a vendor will advise you on which technology is best suited for the issues faced, remember they are often primarily trying to sell their solution. When was the last time you went to a BMW dealer to look for a new car and, after discussing your requirements, they suggested an Audi? Or even less probable, they said that you should keep what you have and just give it a clean and a service?

This isn’t a rant about sales teams; I’ve worked with some amazing salespeople who care about the customer and the problems they face. This is more about what you should consider before signing on the dotted line.

Security technologies are rarely simple, more often requiring effort to manage and operationalize effectively to gain the level of protection evangelized in the sales process. A good CISO friend of mine once told me that no matter what the vendor of a product tells him (including me), he always calculates the cost of managing any control at a 5:1 ratio -- calculating the operational costs as five times the amount spent on actual licenses. Far too many companies want to throw money at a silver bullet rather than put the effort into actually fixing the problem, which leads to lots of license sales but low return on investment.

Beware Of Shelfware

It seems odd that companies would spend a huge amount of money on a technology and not implement it fully, but shelfware (or underutilized technology) is a known problem in the industry. When Target got popped at the end of 2013, reading the kill chain analysis gave a sobering and clear view of the problem. The retailer had spent a significant amount of money ($1.6 million) on a market-leading anti-malware solution to defend against the very attacks it experienced, but it ignored the alarms raised by the platform, idly standing by as critical data flowed out into the hands of cybercriminals. Target had invested nearly $2 million on a control many would argue is the right approach to addressing the threat of targeted malware. Yet due to an inability to actually operationalize the control effectively, the retailer paid an even bigger price. Simply buying an expensive security technology is useless if it’s not implemented properly.

With every purchase, more consideration should be given to how the product will add value to the overall business. People, process, and technology are often cited as the critical considerations to think about for a control. But for me, I also like to think about measure, validate, and communicate.

I like to pose three simple questions when talking about implementing any control or suggesting an investment in a technology:

  • How will you measure that the control is effectively deployed and fully functional?
  • How will you test and validate that the control is giving the desired level of protection?
  • How will you demonstrate iterative improvements to the overall security of the organization and communicate the value of the investment made?

So next time you’re across the table from a vendor, try posing these questions. Vendors with a desire to help and a solid approach will undoubtedly provide guidance through examples of other work they’ve done with similar customers, metrics to use to measure the operational efficiency, and advice on how to demonstrate the value of the solution.

Vendors love to state that their solution is “almost plug and play,” or that you can “just drop it in and it works like a charm with proactive protection out of the box.” But after the proof of concept is done, the purchase orders are sent, and the license keys are received, make sure you're getting the most value you can from the investment, because security budgets are tight enough already.

Gavin Millard is a trained, ethical hacker who works with medium and large enterprises to address their cybersecurity challenges. With a deep understanding of how attackers plot a breach, he helps bring these companies to a trusted state of IT infrastructure. He previously ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft President: Governments Must Cooperate on Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/8/2018
To Click or Not to Click: The Answer Is Easy
Kowsik Guruswamy, Chief Technology Officer at Menlo Security,  11/14/2018
Veterans Find New Roles in Enterprise Cybersecurity
Kelly Sheridan, Staff Editor, Dark Reading,  11/12/2018
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
Tenable Network Security provides continuous network monitoring to identify vulnerabilities, reduce risk and ensure compliance. Its family of products includes SecurityCenter Continuous View™, which provides the most comprehensive and integrated view of network health, and Nessus®, the global standard in detecting and assessing network data. Tenable identifies all types of risk on the network — including missing patches, malware and intruders, missing configurations and missing monitoring — so customers can make informed decisions about where they are exposed. Its products reach across cloud, virtual, mobile and traditional IT systems and measure attack vectors in each of these domains. Tenable’s continuous network monitoring solution measures organizations’ compliance in real-time. This ensures that gaps in security coverage and lapses in security programs get detected and prioritized immediately. Tenable is relied upon by many of the world’s largest corporations, not-for-profit organizations and public sector agencies, including the entire U.S. Department of Defense.
Featured Writers
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19279
PUBLISHED: 2018-11-14
PRIMX ZoneCentral before 6.1.2236 on Windows sometimes leaks the plaintext of NTFS files. On non-SSD devices, this is limited to a 5-second window and file sizes less than 600 bytes. The effect on SSD devices may be greater.
CVE-2018-19280
PUBLISHED: 2018-11-14
Centreon 3.4.x has XSS via the resource name or macro expression of a poller macro.
CVE-2018-19281
PUBLISHED: 2018-11-14
Centreon 3.4.x allows SNMP trap SQL Injection.
CVE-2018-17960
PUBLISHED: 2018-11-14
CKEditor 4.x before 4.11.0 allows user-assisted XSS involving a source-mode paste.
CVE-2018-19278
PUBLISHED: 2018-11-14
Buffer overflow in DNS SRV and NAPTR lookups in Digium Asterisk 15.x before 15.6.2 and 16.x before 16.0.1 allows remote attackers to crash Asterisk via a specially crafted DNS SRV or NAPTR response, because a buffer size is supposed to match an expanded length but actually matches a compressed lengt...