Perimeter
6/29/2012
09:41 AM
Connect Directly
RSS
E-Mail
50%
50%

Not Much To Learn From The Second Kick Of The Mule

Repeating compliance and security failures shows a lack of progress

I grew up in the South, in the small town of Bear Creek, Alabama. A town of less than a thousand people, a tiny public high school, a post office, a small lake, and not much else. Not even a traffic light. Much of the population is not particularly well-educated. However, please note that despite the stereotypes of Southerners, poorly educated does not mean ignorant. In many ways, having little formal education can make you even more dependent on your wits and observations to survive.

Some of the “old country sayin’s” I heard growing up are very valuable and remarkably accurate. For instance, later in life in an engineering statistics class, I would learn that the saying, “If it ain’t broke, don’t fix it” had a solid engineering and statistical basis. In most instances, a new part or machine is many times more likely to fail than one that has been moderately used or perhaps even well-used. Only when extremely old or absolutely worn-out do the odds favor replacement.

Another lesson I learned was, “There is not much to learn from the second kick of the mule.” No matter how many times as a kid you are told to not stand behind a horse or mule, eventually you would forget and ultimately you’d get a sharp kick in the thigh or abdomen. If the kick is on target, it is a pain you don’t forget and one that drives home what you’d been repeatedly told but hadn’t given enough focus and weight.

It is because of this type of lesson that I am often puzzled by companies that keep having the same compliance and security problems. These organizations get kicked by an avoidable problem, stand up, brush it off, and then often wander back around behind the same mules again as if this time it will be different.

These companies tend to focus on rapid recovery and move on, with often little or no time spent learning from the experience. Perhaps they will address the exact source of an exact problem. However, they often fail to work to understand the similar issues just waiting to strike them, costing valuable time, money, and reputation.

Now I understand that in today’s tight and fast-paced business world you have to keep moving forward. This does not mean you have no time to learn from painful lessons. It means the first lessons are a valuable opportunity to avoid expensive repeats of the same painful problems. But you must pay attention to the lesson, knowing that the value is not in learning what hurt, but in learning what action led to the pain.

The way to avoid the pain of a kick is not by finding a new, innovative way to deal with the pain or absorb the blow. It can be as simple as learning where not to stand. The same applies to compliance and security. Make sure to learn your lessons the first time and you’ll avoid the costs of time, money, and pain from valueless repeat lessons.

Glenn S. Phillips, the president of Forte' Incorporated, works with business leaders who want to leverage technology and understand the often hidden risks within. He is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish.

Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MROBINSON000
50%
50%
MROBINSON000,
User Rank: Apprentice
7/12/2012 | 8:22:42 AM
re: Not Much To Learn From The Second Kick Of The Mule
We totally agree that we should learn the lessons the first
time in order to avoid mistakes. We think that when it comes to a breach or an
exploit, the main focus should be on prevention and determining how it occurred
so it doesnG«÷t take place again. It helps very much to adopt a proactive
attitude. You can read more on this topic here: http://blog.securityinnovation...
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.