Risk
9/19/2013
05:26 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%
Repost This

Q&A: Security In The Spotlight At Interop

John Pironti , chair of Interop's Risk Management and Security Track, talks risk management and what to expect at the upcoming conference

Security and networking professionals are gearing up for the Interop show in New York next month. So is Dark Reading, which caught up with John Pironti, chair of both the Risk Management and Security track as well as co-chair of the Applications and Collaboration track. Pironti is president of security consultancy IP Architects, and is also an active member of ISACA.

Click here for more articles from Dark Reading.
Click here to register to attend Interop.

Dark Reading: John, tell us a little bit about some of the security themes you have helped to develop with the programming in the Risk Management and Security track at Interop this year.
Pironti: Not unlike at ISACA, at Interop we've really been trying to push the theme and kind of move the bar forward for security professionals to become more risk and security professionals, and to be more embracing of a threat- and vulnerability-based and risk-based approach, not a technology-based approach, to security. We want people to appreciate that, in some cases, it's actually better to be the trusted adviser than it is to be the guy with the hammer.

Dark Reading: Which kind of makes Interop the perfect audience to bring that message to, considering how many security professionals come from the networking world, right?
Pironti: Yeah. The good news there is that we have a lot of maturity because of that. Network security is probably the area of security that is the most mature and has the most specialists available. But we'd like to start pushing lots of data conversations.

Networking, and technology, generally, is really a vessel. We have all these other angles we're working on and all these other requirements at the business level that we have to address. So we're trying to help that professional broaden their horizons and try to understand what their customers and management teams are struggling with.

One theme we're trying to move forward is visibility, because you can't protect what you don't know. And then really moving away from using the word "risk" too easily, and trying to appreciate what risk really means to the business person and what the security professional believes risk to be. These are usually two very different things.

Dark Reading: So better business context for risk?
Pironti: So a security professional can understand all the possibilities and probabilities of a threat and a vulnerability of a technology or of a concept. In order to factor in what's a risk to the business, you have to have consciousness of things like operational risk, strategy risk, financial considerations, HR considerations, and legal considerations. We need to work with them to understand how to get on the same language page so when I say something's a risk, it's couched in a way of saying it's an information risk, but it has a potential impact on your business process

Dark Reading: That ties into some conversations we've had with others about generally having risk rolled into enterprise risk management. What are you seeing there?
Pironti: ISACA and I have been having that conversation for a while. Maybe we separate IT security operations from information risk management. But they are two things that are very heavily integrated, and they should talk to each other and deal with each other regularly. Let the technology group still maintain the controls and understand how we're going to meet those controls. But let the risk group define what the control objectives need to be.

[Do you see the perimeter half empty or half full? See Is The Perimeter Really Dead?.]

Dark Reading: Looking at general trends, what would you say security people should be paying attention to that will be on the Interop radar -- trends like software defined networking (SDN)?
Pironti: I think SDN is great. I think we're at the fun time talking about SDN. At Interop you have networkers, and we love this stuff. This is our bread and butter. I think that like other standards we've had, we're high in the hype cycle right now. We still have to wait for the standards to play. It is a logical step forward, though, from a provisioning and maintenance and management perspective. But I don't think it's going to replace overnight what we do for traditional networking, or traditional operations or application management, or things of that nature.

Every couple of years we come up with something new that is going to change the world. SOA, cloud -- this is the third time we're trying cloud; we just keep calling it something different. Remember in 2001 and 2002 -- we were all going to do NAC? Now NAC is back. And it actually makes sense, finally. So I think the security professional needs to keep an eye on how data is becoming more pervasive, and how it's being extended beyond their boundaries and what that means. [They also need to understand] what are the capabilities of some of these new trends that are coming online and how they'll impact not only their internal operations, but how they'll interact with other organizations.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-1421
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Craig Knudsen WebCalendar before 1.2.5, 1.2.6, and other versions before 1.2.7 allows remote attackers to inject arbitrary web script or HTML via the Category Name field to category.php.

CVE-2013-2105
Published: 2014-04-22
The Show In Browser (show_in_browser) gem 0.0.3 for Ruby allows local users to inject arbitrary web script or HTML via a symlink attack on /tmp/browser.html.

CVE-2013-2187
Published: 2014-04-22
Cross-site scripting (XSS) vulnerability in Apache Archiva 1.2 through 1.2.2 and 1.3 before 1.3.8 allows remote attackers to inject arbitrary web script or HTML via unspecified parameters, related to the home page.

CVE-2013-4116
Published: 2014-04-22
lib/npm.js in Node Packaged Modules (npm) before 1.3.3 allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names that are created when unpacking archives.

CVE-2013-4472
Published: 2014-04-22
The openTempFile function in goo/gfile.cc in Xpdf and Poppler 0.24.3 and earlier, when running on a system other than Unix, allows local users to overwrite arbitrary files via a symlink attack on temporary files with predictable names.

Best of the Web