Risk
9/19/2013
05:26 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Q&A: Security In The Spotlight At Interop

John Pironti , chair of Interop's Risk Management and Security Track, talks risk management and what to expect at the upcoming conference

Security and networking professionals are gearing up for the Interop show in New York next month. So is Dark Reading, which caught up with John Pironti, chair of both the Risk Management and Security track as well as co-chair of the Applications and Collaboration track. Pironti is president of security consultancy IP Architects, and is also an active member of ISACA.

Click here for more articles from Dark Reading.
Click here to register to attend Interop.

Dark Reading: John, tell us a little bit about some of the security themes you have helped to develop with the programming in the Risk Management and Security track at Interop this year.
Pironti: Not unlike at ISACA, at Interop we've really been trying to push the theme and kind of move the bar forward for security professionals to become more risk and security professionals, and to be more embracing of a threat- and vulnerability-based and risk-based approach, not a technology-based approach, to security. We want people to appreciate that, in some cases, it's actually better to be the trusted adviser than it is to be the guy with the hammer.

Dark Reading: Which kind of makes Interop the perfect audience to bring that message to, considering how many security professionals come from the networking world, right?
Pironti: Yeah. The good news there is that we have a lot of maturity because of that. Network security is probably the area of security that is the most mature and has the most specialists available. But we'd like to start pushing lots of data conversations.

Networking, and technology, generally, is really a vessel. We have all these other angles we're working on and all these other requirements at the business level that we have to address. So we're trying to help that professional broaden their horizons and try to understand what their customers and management teams are struggling with.

One theme we're trying to move forward is visibility, because you can't protect what you don't know. And then really moving away from using the word "risk" too easily, and trying to appreciate what risk really means to the business person and what the security professional believes risk to be. These are usually two very different things.

Dark Reading: So better business context for risk?
Pironti: So a security professional can understand all the possibilities and probabilities of a threat and a vulnerability of a technology or of a concept. In order to factor in what's a risk to the business, you have to have consciousness of things like operational risk, strategy risk, financial considerations, HR considerations, and legal considerations. We need to work with them to understand how to get on the same language page so when I say something's a risk, it's couched in a way of saying it's an information risk, but it has a potential impact on your business process

Dark Reading: That ties into some conversations we've had with others about generally having risk rolled into enterprise risk management. What are you seeing there?
Pironti: ISACA and I have been having that conversation for a while. Maybe we separate IT security operations from information risk management. But they are two things that are very heavily integrated, and they should talk to each other and deal with each other regularly. Let the technology group still maintain the controls and understand how we're going to meet those controls. But let the risk group define what the control objectives need to be.

[Do you see the perimeter half empty or half full? See Is The Perimeter Really Dead?.]

Dark Reading: Looking at general trends, what would you say security people should be paying attention to that will be on the Interop radar -- trends like software defined networking (SDN)?
Pironti: I think SDN is great. I think we're at the fun time talking about SDN. At Interop you have networkers, and we love this stuff. This is our bread and butter. I think that like other standards we've had, we're high in the hype cycle right now. We still have to wait for the standards to play. It is a logical step forward, though, from a provisioning and maintenance and management perspective. But I don't think it's going to replace overnight what we do for traditional networking, or traditional operations or application management, or things of that nature.

Every couple of years we come up with something new that is going to change the world. SOA, cloud -- this is the third time we're trying cloud; we just keep calling it something different. Remember in 2001 and 2002 -- we were all going to do NAC? Now NAC is back. And it actually makes sense, finally. So I think the security professional needs to keep an eye on how data is becoming more pervasive, and how it's being extended beyond their boundaries and what that means. [They also need to understand] what are the capabilities of some of these new trends that are coming online and how they'll impact not only their internal operations, but how they'll interact with other organizations.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6306
Published: 2014-08-22
Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3563
Published: 2014-08-22
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

CVE-2014-3587
Published: 2014-08-22
Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file. NOTE: this vulnerability exists bec...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.