Risk
9/19/2013
05:26 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Q&A: Security In The Spotlight At Interop

John Pironti , chair of Interop's Risk Management and Security Track, talks risk management and what to expect at the upcoming conference

Security and networking professionals are gearing up for the Interop show in New York next month. So is Dark Reading, which caught up with John Pironti, chair of both the Risk Management and Security track as well as co-chair of the Applications and Collaboration track. Pironti is president of security consultancy IP Architects, and is also an active member of ISACA.

Click here for more articles from Dark Reading.
Click here to register to attend Interop.

Dark Reading: John, tell us a little bit about some of the security themes you have helped to develop with the programming in the Risk Management and Security track at Interop this year.
Pironti: Not unlike at ISACA, at Interop we've really been trying to push the theme and kind of move the bar forward for security professionals to become more risk and security professionals, and to be more embracing of a threat- and vulnerability-based and risk-based approach, not a technology-based approach, to security. We want people to appreciate that, in some cases, it's actually better to be the trusted adviser than it is to be the guy with the hammer.

Dark Reading: Which kind of makes Interop the perfect audience to bring that message to, considering how many security professionals come from the networking world, right?
Pironti: Yeah. The good news there is that we have a lot of maturity because of that. Network security is probably the area of security that is the most mature and has the most specialists available. But we'd like to start pushing lots of data conversations.

Networking, and technology, generally, is really a vessel. We have all these other angles we're working on and all these other requirements at the business level that we have to address. So we're trying to help that professional broaden their horizons and try to understand what their customers and management teams are struggling with.

One theme we're trying to move forward is visibility, because you can't protect what you don't know. And then really moving away from using the word "risk" too easily, and trying to appreciate what risk really means to the business person and what the security professional believes risk to be. These are usually two very different things.

Dark Reading: So better business context for risk?
Pironti: So a security professional can understand all the possibilities and probabilities of a threat and a vulnerability of a technology or of a concept. In order to factor in what's a risk to the business, you have to have consciousness of things like operational risk, strategy risk, financial considerations, HR considerations, and legal considerations. We need to work with them to understand how to get on the same language page so when I say something's a risk, it's couched in a way of saying it's an information risk, but it has a potential impact on your business process

Dark Reading: That ties into some conversations we've had with others about generally having risk rolled into enterprise risk management. What are you seeing there?
Pironti: ISACA and I have been having that conversation for a while. Maybe we separate IT security operations from information risk management. But they are two things that are very heavily integrated, and they should talk to each other and deal with each other regularly. Let the technology group still maintain the controls and understand how we're going to meet those controls. But let the risk group define what the control objectives need to be.

[Do you see the perimeter half empty or half full? See Is The Perimeter Really Dead?.]

Dark Reading: Looking at general trends, what would you say security people should be paying attention to that will be on the Interop radar -- trends like software defined networking (SDN)?
Pironti: I think SDN is great. I think we're at the fun time talking about SDN. At Interop you have networkers, and we love this stuff. This is our bread and butter. I think that like other standards we've had, we're high in the hype cycle right now. We still have to wait for the standards to play. It is a logical step forward, though, from a provisioning and maintenance and management perspective. But I don't think it's going to replace overnight what we do for traditional networking, or traditional operations or application management, or things of that nature.

Every couple of years we come up with something new that is going to change the world. SOA, cloud -- this is the third time we're trying cloud; we just keep calling it something different. Remember in 2001 and 2002 -- we were all going to do NAC? Now NAC is back. And it actually makes sense, finally. So I think the security professional needs to keep an eye on how data is becoming more pervasive, and how it's being extended beyond their boundaries and what that means. [They also need to understand] what are the capabilities of some of these new trends that are coming online and how they'll impact not only their internal operations, but how they'll interact with other organizations.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6501
Published: 2015-03-30
The default soap.wsdl_cache_dir setting in (1) php.ini-production and (2) php.ini-development in PHP through 5.6.7 specifies the /tmp directory, which makes it easier for local users to conduct WSDL injection attacks by creating a file under /tmp with a predictable filename that is used by the get_s...

CVE-2014-9652
Published: 2015-03-30
The mconvert function in softmagic.c in file before 5.21, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not properly handle a certain string-length field during a copy of a truncated version of a Pascal string, which might allow remote atta...

CVE-2014-9653
Published: 2015-03-30
readelf.c in file before 5.22, as used in the Fileinfo component in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, does not consider that pread calls sometimes read only a subset of the available data, which allows remote attackers to cause a denial of service (uninitialized memory ...

CVE-2014-9705
Published: 2015-03-30
Heap-based buffer overflow in the enchant_broker_request_dict function in ext/enchant/enchant.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

CVE-2014-9709
Published: 2015-03-30
The GetCode_ function in gd_gif_in.c in GD 2.1.1 and earlier, as used in PHP before 5.5.21 and 5.6.x before 5.6.5, allows remote attackers to cause a denial of service (buffer over-read and application crash) via a crafted GIF image that is improperly handled by the gdImageCreateFromGif function.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.