Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

6/30/2015
11:00 AM
Tsion Gonen
Tsion Gonen
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
Google+
RSS
E-Mail vvv
50%
50%

Getting To Yes: Negotiating Technology Innovation & Security Risk

As enterprises look for ways to leverage the cloud, mobility, Big Data, and social media for competitive advantage, CISOs can no longer give blanket refusals to IT experimentation.

Change has been a constant in the cybersecurity industry over the past few years. One of the more subtle shifts is that CISOs have had to learn to appreciate -- and use -- the word “yes.”

For years, information security executives have been conditioned to say “no” to any new technology initiative that was perceived as presenting potential risks to the organization. The average security practitioner instinctively says no to almost everything. Whether it was no to requests to move into the cloud, to open up a site to external users, to expand use of mobile devices in the workplace, to adopt social media for business applications, the answer was no because of the possible security risks these ventures represented. Saying no became the security chief’s biggest data protection strategy.

But security executives are learning -- and are continuing to accept -- that saying no can actually put their careers at risk. As enterprises look for ways to leverage the cloud, mobility, Big Data, and social media for competitive advantage, giving blanket refusals to IT experimentation and innovation is no longer an option.

Bring-your-own-device and “shadow IT” are now commonplace at many organizations. And the move to the cloud has become so popular that it’s now unimaginable that a security executive would be able to keep business users from accessing cloud-based applications and storage systems.

Not surprisingly, security practitioners have been struggling with this growing need to say yes to different projects. After all, their mission is to identify what they consider to be risks and protect the organization from being hurt by those threats. But saying yes is a requirement in today’s increasingly and connected digital world.

Rather than trying to swim against the current or blindly ignore the security risks these projects might present, CISOs and other technology professionals involved in security need to focus on learning about the business benefits of these initiatives and finding the tools that can help safeguard corporate data and systems in these new environments.

Plan B
Concurrently, as part of this change in thinking, security executives need to be in on the discussions about the business goals of using technologies such as the cloud and mobile devices, so they can gain a better understanding of the value of these initiatives to the organization and how IT assets should be secured.

As security executives accept the consumerization of IT, they also need to switch from a “Plan A” to a “Plan B” security strategy. With Plan A, the thinking has been that the organization is not going to experience a breach and that technology such as next-generation firewalls and intrusion detection will prevent breaches from happening.

Most current security blueprints are based on Plan A, with a heavy emphasis on technologies that protect the perimeter and somehow stop attackers from getting where they shouldn’t be. This made some sense when all the data and users only existed behind the corporate firewall.

It’s becoming quite clear, however, that Plan A is not working as it should be. Consider the number of huge data breaches that have occurred over the last year or two, and you can see that cybercriminals are finding ways to defeat current security defenses.

In today’s security landscape, it makes more sense to move to a Plan B, where the focus is on protecting data. This can involve a number of different technologies that are available today and would be potentially important components of the strategy.

It’s also clear that data encryption should play a major role in any Plan B. Someone is going to get past the network perimeter defenses at some point, so organizations need to make sure that whoever gets in can’t use the data. Another way of looking at encryption in the context of Plan B is that it is the ultimate way to “unshare” data in shared environments.

Many organizations will likely struggle with moving from Plan A to Plan B, simply because the former has been in place for so long. People who work in security programs are accustomed to working with what they are comfortable with -- and this usually means firewalls and other legacy security technologies. But not a lot of staffers today are experts in encrypting an infrastructure. (Hint: if you want a secure career in security, you might want to get into encryption.)

In the final analysis, security executives need to evolve and say “yes” to more new IT initiatives. They can do so while feeling confident they are doing everything necessary to protect corporate information resources by taking a Plan B approach.

Tsion Gonen serves as Chief Strategy Officer for Gemalto's Identity and Data Protection Division. He is responsible for developing global business and product strategies, and identifying and capitalizing on emerging market trends within the information security market. Prior ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Stop Defending Everything
Kevin Kurzawa, Senior Information Security Auditor,  2/12/2020
Small Business Security: 5 Tips on How and Where to Start
Mike Puglia, Chief Strategy Officer at Kaseya,  2/13/2020
5 Common Errors That Allow Attackers to Go Undetected
Matt Middleton-Leal, General Manager and Chief Security Strategist, Netwrix,  2/12/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20477
PUBLISHED: 2020-02-19
PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.
CVE-2019-20478
PUBLISHED: 2020-02-19
In ruamel.yaml through 0.16.7, the load method allows remote code execution if the application calls this method with an untrusted argument. In other words, this issue affects developers who are unaware of the need to use methods such as safe_load in these use cases.
CVE-2011-2054
PUBLISHED: 2020-02-19
A vulnerability in the Cisco ASA that could allow a remote attacker to successfully authenticate using the Cisco AnyConnect VPN client if the Secondary Authentication type is LDAP and the password is left blank, providing the primary credentials are correct. The vulnerabilities is due to improper in...
CVE-2015-0749
PUBLISHED: 2020-02-19
A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack on the affected software. The vulnerabilities is due to improper input validation of certain parameters passed to the affected software. An attacker ...
CVE-2015-9543
PUBLISHED: 2020-02-19
An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is rel...