Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

6/30/2015
11:00 AM
Tsion Gonen
Tsion Gonen
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
Google+
RSS
E-Mail vvv
50%
50%

Getting To Yes: Negotiating Technology Innovation & Security Risk

As enterprises look for ways to leverage the cloud, mobility, Big Data, and social media for competitive advantage, CISOs can no longer give blanket refusals to IT experimentation.

Change has been a constant in the cybersecurity industry over the past few years. One of the more subtle shifts is that CISOs have had to learn to appreciate -- and use -- the word “yes.”

For years, information security executives have been conditioned to say “no” to any new technology initiative that was perceived as presenting potential risks to the organization. The average security practitioner instinctively says no to almost everything. Whether it was no to requests to move into the cloud, to open up a site to external users, to expand use of mobile devices in the workplace, to adopt social media for business applications, the answer was no because of the possible security risks these ventures represented. Saying no became the security chief’s biggest data protection strategy.

But security executives are learning -- and are continuing to accept -- that saying no can actually put their careers at risk. As enterprises look for ways to leverage the cloud, mobility, Big Data, and social media for competitive advantage, giving blanket refusals to IT experimentation and innovation is no longer an option.

Bring-your-own-device and “shadow IT” are now commonplace at many organizations. And the move to the cloud has become so popular that it’s now unimaginable that a security executive would be able to keep business users from accessing cloud-based applications and storage systems.

Not surprisingly, security practitioners have been struggling with this growing need to say yes to different projects. After all, their mission is to identify what they consider to be risks and protect the organization from being hurt by those threats. But saying yes is a requirement in today’s increasingly and connected digital world.

Rather than trying to swim against the current or blindly ignore the security risks these projects might present, CISOs and other technology professionals involved in security need to focus on learning about the business benefits of these initiatives and finding the tools that can help safeguard corporate data and systems in these new environments.

Plan B
Concurrently, as part of this change in thinking, security executives need to be in on the discussions about the business goals of using technologies such as the cloud and mobile devices, so they can gain a better understanding of the value of these initiatives to the organization and how IT assets should be secured.

As security executives accept the consumerization of IT, they also need to switch from a “Plan A” to a “Plan B” security strategy. With Plan A, the thinking has been that the organization is not going to experience a breach and that technology such as next-generation firewalls and intrusion detection will prevent breaches from happening.

Most current security blueprints are based on Plan A, with a heavy emphasis on technologies that protect the perimeter and somehow stop attackers from getting where they shouldn’t be. This made some sense when all the data and users only existed behind the corporate firewall.

It’s becoming quite clear, however, that Plan A is not working as it should be. Consider the number of huge data breaches that have occurred over the last year or two, and you can see that cybercriminals are finding ways to defeat current security defenses.

In today’s security landscape, it makes more sense to move to a Plan B, where the focus is on protecting data. This can involve a number of different technologies that are available today and would be potentially important components of the strategy.

It’s also clear that data encryption should play a major role in any Plan B. Someone is going to get past the network perimeter defenses at some point, so organizations need to make sure that whoever gets in can’t use the data. Another way of looking at encryption in the context of Plan B is that it is the ultimate way to “unshare” data in shared environments.

Many organizations will likely struggle with moving from Plan A to Plan B, simply because the former has been in place for so long. People who work in security programs are accustomed to working with what they are comfortable with -- and this usually means firewalls and other legacy security technologies. But not a lot of staffers today are experts in encrypting an infrastructure. (Hint: if you want a secure career in security, you might want to get into encryption.)

In the final analysis, security executives need to evolve and say “yes” to more new IT initiatives. They can do so while feeling confident they are doing everything necessary to protect corporate information resources by taking a Plan B approach.

Tsion Gonen serves as Chief Strategy Officer for Gemalto's Identity and Data Protection Division. He is responsible for developing global business and product strategies, and identifying and capitalizing on emerging market trends within the information security market. Prior ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.