Perimeter
7/18/2012
02:26 PM
Connect Directly
RSS
E-Mail
50%
50%

Risks Deferred Are Risks Accepted

Decisions to delay compliance and security efforts do not delay the risks

The client did something I’ve seen many times before. The staff considered addressing obvious compliance and security issues, and then decided to postpone that work. While they said they were simply going to push the work back a few months, as typically happens, the postponement became indefinite.

Or perhaps more accurately, the postponement will be indefinite until a costly problem exposes these ignored risks as real, costly and immediate.

Like most clients, they claimed a number of reasons to postpone this work: cash flow, timing, budget restrictions, pending new projects, disruption to other projects, and the time required by management and staff.

Sounding sincere about their need to address these compliance and security issues, clients say, “This is going to be a lot of work, and we need to take care of other matters first so we can better focus on this with less distraction.”

Yet despite claiming to believe compliance and security work is important, clients usually minimize their concerns about risk. After all, they say, as they’ve grown their business, the risks have never materialized, and they really need to put their cash into the growth of the business.

As a business owner, I realize there are times you must make risky decisions. I know there are times where you do have to postpone important work because of something as simple as cash flow or lack of manpower. However, these risky decisions should be made with a sincere evaluation and acceptance of the risks, not by turning a convenient blind-eye and manufacturing emotional justification.

Too many leaders become overwhelmed by the size of the risks they have created -- or allowed to be created -- over time. When these issues become obvious, for whatever the reason, the most common response unfortunately is not to attack these risks full-blast or even to start whittling them down. No, the most common response is to push all these risks into the back of a dark closet where they can be ignored, where they can be put out of sight and out of mind.

Business leaders who decide to defer addressing real security and compliance risks must understand they are essentially self-insuring this risk. They have accepted the risks, even if that acceptance is by default or denial.

If a problem develops from these ignored compliance and security risks, it will be the business that pays the cost, whether it be cash, distraction, reputation, and, perhaps even, sanctions. Perhaps some risks are worth taking, but in most cases I see few leaders acknowledge the true risks and actual consequences. Apparently ignorance is bliss even when the ignorance is by choice.

Glenn S. Phillips, the president of Forte' Incorporated, works with business leaders who want to leverage technology and understand the often hidden risks within. He is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish.

Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2413
Published: 2014-10-20
Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php.

CVE-2012-5244
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) return, (2) display, (3) table, or (4) search parameter to functions/suggest.php; (5) the id parameter to functions/widgets.php, (6) the category parameter to...

CVE-2012-5694
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allow remote attackers to execute arbitrary SQL commands via the (1) agentPhNo, (2) controlPhNo, (3) agentURLPath, (4) agentControlKey, or (5) platformDD1 parameter to frameworkgui/attach2Agents.p...

CVE-2012-5695
Published: 2014-10-20
Multiple cross-site request forgery (CSRF) vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allow remote attackers to hijack the authentication of administrators for requests that conduct (1) shell metacharacter or (2) SQL injection attacks or (3) send an SMS m...

CVE-2012-5696
Published: 2014-10-20
Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 does not properly restrict access to frameworkgui/config, which allows remote attackers to obtain the plaintext database password via a direct request.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.