Perimeter
4/11/2012
11:14 AM
50%
50%

Be Ready To Clean Up That Mess

Compliant systems do more than prevent problems -- they help solve problems that happen

In our assessment and consulting projects, we often find clients who see compliant systems as those with the best wall of protection, like a great castle surrounded by the seas and cliffs. Granted, great security is wonderful. But it is not the end of the story; security alone will not make your organization compliant.

If you dig into any of the various laws and regulations that require compliance in various industries, you'll find they do not assume secure systems can never be breached. Full, impenetrable security is never the final metric of compliance. Secure systems are very important, but the ability to detect problems and address them is also critical.

In Kelly Jackson Higgins' recent Dark Reading article, "Damage Mitigation As The New Defense," Dave Piscitello, senior security technologist for ICANN, shared the current security reality: "Organizations that are only now coming to the realization that their network perimeters have been compromised are late to the game," he said. "The criminal application of collected/exfiltrated data is now such an enormous problem that it's impossible to avoid."

If your security and compliance efforts are focused primarily on preventing breaches and leaks, then you'll be woefully unprepared to properly respond when things go wrong. Compliant systems include processes and procedures for checking the security and steps for a prompt response.

The day after a data breach goes public or the CEO asks where the data went is not the day you want to be developing a response plan on the fly. Any unplanned, impromptu responses can even contribute to making the problem worse.

Any company or IT leadership that believes their security is complete and total has yet to face reality. They're living on borrowed time. As the old saying goes, "The problem with making systems foolproof is that fools are so darn ingenious." And so are those with ill intent.

Today's reality is that we can never make a system completely secure and still reasonable to use. There are simply too many continually evolving threats to ever be prepared to stop them all. Proper detection and response are not reactions -- they are processes that can be defined and documented.

Can you plan a response for every possible problem? Of course not. Smart plans include a framework of response steps with room to adjust the plan as necessary for specific situations. That's more than just good response planning -- that's good business planning.

Assuming you'll never be attacked, hacked, breached, or betrayed is not only naive, it is arrogant and risky for your organization and career. A strong compliance program understands that the world is always evolving, and therefore so must our processes for both security and for problem response.

Glenn S. Phillips, the president of Forte' Incorporated, works with business leaders who want to leverage technology and understand risks within. He is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish.

Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-1414
Published: 2015-02-27
Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.

CVE-2015-2072
Published: 2015-02-27
Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA 73 (1.00.73.00.389160) and HANA Developer Edition 80 (1.00.80.00.391861) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) ide/core/plugins/editor/templates/trace/hanaTraceDetailService.xsjs or...

CVE-2015-2075
Published: 2015-02-27
SAP BussinessObjects Edge 4.0 allows remote attackers to delete audit events from the auditee queue via a clearData CORBA operation, aka SAP Note 2011396.

CVE-2015-2076
Published: 2015-02-27
The Auditing service in SAP BussinessObjects Edge 4.0 allows remote attackers to obtains sensitive information by reading an audit event, aka SAP Note 2011395.

CVE-2015-2101
Published: 2015-02-27
Cross-site scripting (XSS) vulnerability in the Navigate bar in the Navigate module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.