Perimeter
4/11/2012
11:14 AM
Connect Directly
RSS
E-Mail
50%
50%

Be Ready To Clean Up That Mess

Compliant systems do more than prevent problems -- they help solve problems that happen

In our assessment and consulting projects, we often find clients who see compliant systems as those with the best wall of protection, like a great castle surrounded by the seas and cliffs. Granted, great security is wonderful. But it is not the end of the story; security alone will not make your organization compliant.

If you dig into any of the various laws and regulations that require compliance in various industries, you'll find they do not assume secure systems can never be breached. Full, impenetrable security is never the final metric of compliance. Secure systems are very important, but the ability to detect problems and address them is also critical.

In Kelly Jackson Higgins' recent Dark Reading article, "Damage Mitigation As The New Defense," Dave Piscitello, senior security technologist for ICANN, shared the current security reality: "Organizations that are only now coming to the realization that their network perimeters have been compromised are late to the game," he said. "The criminal application of collected/exfiltrated data is now such an enormous problem that it's impossible to avoid."

If your security and compliance efforts are focused primarily on preventing breaches and leaks, then you'll be woefully unprepared to properly respond when things go wrong. Compliant systems include processes and procedures for checking the security and steps for a prompt response.

The day after a data breach goes public or the CEO asks where the data went is not the day you want to be developing a response plan on the fly. Any unplanned, impromptu responses can even contribute to making the problem worse.

Any company or IT leadership that believes their security is complete and total has yet to face reality. They're living on borrowed time. As the old saying goes, "The problem with making systems foolproof is that fools are so darn ingenious." And so are those with ill intent.

Today's reality is that we can never make a system completely secure and still reasonable to use. There are simply too many continually evolving threats to ever be prepared to stop them all. Proper detection and response are not reactions -- they are processes that can be defined and documented.

Can you plan a response for every possible problem? Of course not. Smart plans include a framework of response steps with room to adjust the plan as necessary for specific situations. That's more than just good response planning -- that's good business planning.

Assuming you'll never be attacked, hacked, breached, or betrayed is not only naive, it is arrogant and risky for your organization and career. A strong compliance program understands that the world is always evolving, and therefore so must our processes for both security and for problem response.

Glenn S. Phillips, the president of Forte' Incorporated, works with business leaders who want to leverage technology and understand risks within. He is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish.

Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0103
Published: 2014-07-29
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

CVE-2014-0475
Published: 2014-07-29
Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.

CVE-2014-2226
Published: 2014-07-29
Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtains sensitive information via unspecified vectors.

CVE-2014-3541
Published: 2014-07-29
The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.

CVE-2014-3542
Published: 2014-07-29
mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) is...

Best of the Web
Dark Reading Radio