Perimeter
6/29/2012
09:41 AM
Connect Directly
RSS
E-Mail
50%
50%

Not Much To Learn From The Second Kick Of The Mule

Repeating compliance and security failures shows a lack of progress

I grew up in the South, in the small town of Bear Creek, Alabama. A town of less than a thousand people, a tiny public high school, a post office, a small lake, and not much else. Not even a traffic light. Much of the population is not particularly well-educated. However, please note that despite the stereotypes of Southerners, poorly educated does not mean ignorant. In many ways, having little formal education can make you even more dependent on your wits and observations to survive.

Some of the “old country sayin’s” I heard growing up are very valuable and remarkably accurate. For instance, later in life in an engineering statistics class, I would learn that the saying, “If it ain’t broke, don’t fix it” had a solid engineering and statistical basis. In most instances, a new part or machine is many times more likely to fail than one that has been moderately used or perhaps even well-used. Only when extremely old or absolutely worn-out do the odds favor replacement.

Another lesson I learned was, “There is not much to learn from the second kick of the mule.” No matter how many times as a kid you are told to not stand behind a horse or mule, eventually you would forget and ultimately you’d get a sharp kick in the thigh or abdomen. If the kick is on target, it is a pain you don’t forget and one that drives home what you’d been repeatedly told but hadn’t given enough focus and weight.

It is because of this type of lesson that I am often puzzled by companies that keep having the same compliance and security problems. These organizations get kicked by an avoidable problem, stand up, brush it off, and then often wander back around behind the same mules again as if this time it will be different.

These companies tend to focus on rapid recovery and move on, with often little or no time spent learning from the experience. Perhaps they will address the exact source of an exact problem. However, they often fail to work to understand the similar issues just waiting to strike them, costing valuable time, money, and reputation.

Now I understand that in today’s tight and fast-paced business world you have to keep moving forward. This does not mean you have no time to learn from painful lessons. It means the first lessons are a valuable opportunity to avoid expensive repeats of the same painful problems. But you must pay attention to the lesson, knowing that the value is not in learning what hurt, but in learning what action led to the pain.

The way to avoid the pain of a kick is not by finding a new, innovative way to deal with the pain or absorb the blow. It can be as simple as learning where not to stand. The same applies to compliance and security. Make sure to learn your lessons the first time and you’ll avoid the costs of time, money, and pain from valueless repeat lessons.

Glenn S. Phillips, the president of Forte' Incorporated, works with business leaders who want to leverage technology and understand the often hidden risks within. He is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish.

Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MROBINSON000
50%
50%
MROBINSON000,
User Rank: Apprentice
7/12/2012 | 8:22:42 AM
re: Not Much To Learn From The Second Kick Of The Mule
We totally agree that we should learn the lessons the first
time in order to avoid mistakes. We think that when it comes to a breach or an
exploit, the main focus should be on prevention and determining how it occurred
so it doesnGÇÖt take place again. It helps very much to adopt a proactive
attitude. You can read more on this topic here: http://blog.securityinnovation...
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3352
Published: 2014-08-30
Cisco Intelligent Automation for Cloud (aka Cisco Cloud Portal) 2008.3_SP9 and earlier does not properly consider whether a session is a problematic NULL session, which allows remote attackers to obtain sensitive information via crafted packets, related to an "iFrame vulnerability," aka Bug ID CSCuh...

CVE-2014-3908
Published: 2014-08-30
The Amazon.com Kindle application before 4.5.0 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate.

CVE-2010-5110
Published: 2014-08-29
DCTStream.cc in Poppler before 0.13.3 allows remote attackers to cause a denial of service (crash) via a crafted PDF file.

CVE-2012-1503
Published: 2014-08-29
Cross-site scripting (XSS) vulnerability in Six Apart (formerly Six Apart KK) Movable Type (MT) Pro 5.13 allows remote attackers to inject arbitrary web script or HTML via the comment section.

CVE-2013-5467
Published: 2014-08-29
Monitoring Agent for UNIX Logs 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP09, and 6.2.3 through FP04 and Monitoring Server (ms) and Shared Libraries (ax) 6.2.0 through FP03, 6.2.1 through FP04, 6.2.2 through FP08, 6.2.3 through FP01, and 6.3.0 through FP01 in IBM Tivoli Monitoring (ITM)...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.