Perimeter
7/18/2012
02:26 PM
Connect Directly
RSS
E-Mail
50%
50%

Risks Deferred Are Risks Accepted

Decisions to delay compliance and security efforts do not delay the risks

The client did something I’ve seen many times before. The staff considered addressing obvious compliance and security issues, and then decided to postpone that work. While they said they were simply going to push the work back a few months, as typically happens, the postponement became indefinite.

Or perhaps more accurately, the postponement will be indefinite until a costly problem exposes these ignored risks as real, costly and immediate.

Like most clients, they claimed a number of reasons to postpone this work: cash flow, timing, budget restrictions, pending new projects, disruption to other projects, and the time required by management and staff.

Sounding sincere about their need to address these compliance and security issues, clients say, “This is going to be a lot of work, and we need to take care of other matters first so we can better focus on this with less distraction.”

Yet despite claiming to believe compliance and security work is important, clients usually minimize their concerns about risk. After all, they say, as they’ve grown their business, the risks have never materialized, and they really need to put their cash into the growth of the business.

As a business owner, I realize there are times you must make risky decisions. I know there are times where you do have to postpone important work because of something as simple as cash flow or lack of manpower. However, these risky decisions should be made with a sincere evaluation and acceptance of the risks, not by turning a convenient blind-eye and manufacturing emotional justification.

Too many leaders become overwhelmed by the size of the risks they have created -- or allowed to be created -- over time. When these issues become obvious, for whatever the reason, the most common response unfortunately is not to attack these risks full-blast or even to start whittling them down. No, the most common response is to push all these risks into the back of a dark closet where they can be ignored, where they can be put out of sight and out of mind.

Business leaders who decide to defer addressing real security and compliance risks must understand they are essentially self-insuring this risk. They have accepted the risks, even if that acceptance is by default or denial.

If a problem develops from these ignored compliance and security risks, it will be the business that pays the cost, whether it be cash, distraction, reputation, and, perhaps even, sanctions. Perhaps some risks are worth taking, but in most cases I see few leaders acknowledge the true risks and actual consequences. Apparently ignorance is bliss even when the ignorance is by choice.

Glenn S. Phillips, the president of Forte' Incorporated, works with business leaders who want to leverage technology and understand the often hidden risks within. He is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish.

Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3304
Published: 2014-10-30
Directory traversal vulnerability in Dell EqualLogic PS4000 with firmware 6.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the default URI.

CVE-2013-7409
Published: 2014-10-30
Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.

CVE-2014-3446
Published: 2014-10-30
SQL injection vulnerability in wcm/system/pages/admin/getnode.aspx in BSS Continuity CMS 4.2.22640.0 allows remote attackers to execute arbitrary SQL commands via the nodeid parameter.

CVE-2014-3584
Published: 2014-10-30
The SamlHeaderInHandler in Apache CXF before 2.6.11, 2.7.x before 2.7.8, and 3.0.x before 3.0.1 allows remote attackers to cause a denial of service (infinite loop) via a crafted SAML token in the authorization header of a request to a JAX-RS service.

CVE-2014-3623
Published: 2014-10-30
Apache WSS4J before 1.6.17 and 2.x before 2.0.2, as used in Apache CXF 2.7.x before 2.7.13 and 3.0.x before 3.0.2, when using TransportBinding, does properly enforce the SAML SubjectConfirmation method security semantics, which allows remote attackers to conduct spoofing attacks via unspecified vect...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.