Perimeter
4/11/2012
11:14 AM
Connect Directly
RSS
E-Mail
50%
50%

Be Ready To Clean Up That Mess

Compliant systems do more than prevent problems -- they help solve problems that happen

In our assessment and consulting projects, we often find clients who see compliant systems as those with the best wall of protection, like a great castle surrounded by the seas and cliffs. Granted, great security is wonderful. But it is not the end of the story; security alone will not make your organization compliant.

If you dig into any of the various laws and regulations that require compliance in various industries, you'll find they do not assume secure systems can never be breached. Full, impenetrable security is never the final metric of compliance. Secure systems are very important, but the ability to detect problems and address them is also critical.

In Kelly Jackson Higgins' recent Dark Reading article, "Damage Mitigation As The New Defense," Dave Piscitello, senior security technologist for ICANN, shared the current security reality: "Organizations that are only now coming to the realization that their network perimeters have been compromised are late to the game," he said. "The criminal application of collected/exfiltrated data is now such an enormous problem that it's impossible to avoid."

If your security and compliance efforts are focused primarily on preventing breaches and leaks, then you'll be woefully unprepared to properly respond when things go wrong. Compliant systems include processes and procedures for checking the security and steps for a prompt response.

The day after a data breach goes public or the CEO asks where the data went is not the day you want to be developing a response plan on the fly. Any unplanned, impromptu responses can even contribute to making the problem worse.

Any company or IT leadership that believes their security is complete and total has yet to face reality. They're living on borrowed time. As the old saying goes, "The problem with making systems foolproof is that fools are so darn ingenious." And so are those with ill intent.

Today's reality is that we can never make a system completely secure and still reasonable to use. There are simply too many continually evolving threats to ever be prepared to stop them all. Proper detection and response are not reactions -- they are processes that can be defined and documented.

Can you plan a response for every possible problem? Of course not. Smart plans include a framework of response steps with room to adjust the plan as necessary for specific situations. That's more than just good response planning -- that's good business planning.

Assuming you'll never be attacked, hacked, breached, or betrayed is not only naive, it is arrogant and risky for your organization and career. A strong compliance program understands that the world is always evolving, and therefore so must our processes for both security and for problem response.

Glenn S. Phillips, the president of Forte' Incorporated, works with business leaders who want to leverage technology and understand risks within. He is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish.

Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Must Reads - September 25, 2014
Dark Reading's new Must Reads is a compendium of our best recent coverage of identity and access management. Learn about access control in the age of HTML5, how to improve authentication, why Active Directory is dead, and more.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5485
Published: 2014-09-30
registerConfiglet.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via unspecified vectors, related to the admin interface.

CVE-2012-5486
Published: 2014-09-30
ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.

CVE-2012-5487
Published: 2014-09-30
The sandbox whitelisting function (allowmodule.py) in Plone before 4.2.3 and 4.3 before beta 1 allows remote authenticated users with certain privileges to bypass the Python sandbox restriction and execute arbitrary Python code via vectors related to importing.

CVE-2012-5488
Published: 2014-09-30
python_scripts.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to execute Python code via a crafted URL, related to createObject.

CVE-2012-5489
Published: 2014-09-30
The App.Undo.UndoSupport.get_request_var_or_attr function in Zope before 2.12.21 and 3.13.x before 2.13.11, as used in Plone before 4.2.3 and 4.3 before beta 1, allows remote authenticated users to gain access to restricted attributes via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
In our next Dark Reading Radio broadcast, we’ll take a close look at some of the latest research and practices in application security.