Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

6/30/2015
11:00 AM
Tsion Gonen
Tsion Gonen
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
Google+
RSS
E-Mail vvv
50%
50%

Getting To Yes: Negotiating Technology Innovation & Security Risk

As enterprises look for ways to leverage the cloud, mobility, Big Data, and social media for competitive advantage, CISOs can no longer give blanket refusals to IT experimentation.

Change has been a constant in the cybersecurity industry over the past few years. One of the more subtle shifts is that CISOs have had to learn to appreciate -- and use -- the word “yes.”

For years, information security executives have been conditioned to say “no” to any new technology initiative that was perceived as presenting potential risks to the organization. The average security practitioner instinctively says no to almost everything. Whether it was no to requests to move into the cloud, to open up a site to external users, to expand use of mobile devices in the workplace, to adopt social media for business applications, the answer was no because of the possible security risks these ventures represented. Saying no became the security chief’s biggest data protection strategy.

But security executives are learning -- and are continuing to accept -- that saying no can actually put their careers at risk. As enterprises look for ways to leverage the cloud, mobility, Big Data, and social media for competitive advantage, giving blanket refusals to IT experimentation and innovation is no longer an option.

Bring-your-own-device and “shadow IT” are now commonplace at many organizations. And the move to the cloud has become so popular that it’s now unimaginable that a security executive would be able to keep business users from accessing cloud-based applications and storage systems.

Not surprisingly, security practitioners have been struggling with this growing need to say yes to different projects. After all, their mission is to identify what they consider to be risks and protect the organization from being hurt by those threats. But saying yes is a requirement in today’s increasingly and connected digital world.

Rather than trying to swim against the current or blindly ignore the security risks these projects might present, CISOs and other technology professionals involved in security need to focus on learning about the business benefits of these initiatives and finding the tools that can help safeguard corporate data and systems in these new environments.

Plan B
Concurrently, as part of this change in thinking, security executives need to be in on the discussions about the business goals of using technologies such as the cloud and mobile devices, so they can gain a better understanding of the value of these initiatives to the organization and how IT assets should be secured.

As security executives accept the consumerization of IT, they also need to switch from a “Plan A” to a “Plan B” security strategy. With Plan A, the thinking has been that the organization is not going to experience a breach and that technology such as next-generation firewalls and intrusion detection will prevent breaches from happening.

Most current security blueprints are based on Plan A, with a heavy emphasis on technologies that protect the perimeter and somehow stop attackers from getting where they shouldn’t be. This made some sense when all the data and users only existed behind the corporate firewall.

It’s becoming quite clear, however, that Plan A is not working as it should be. Consider the number of huge data breaches that have occurred over the last year or two, and you can see that cybercriminals are finding ways to defeat current security defenses.

In today’s security landscape, it makes more sense to move to a Plan B, where the focus is on protecting data. This can involve a number of different technologies that are available today and would be potentially important components of the strategy.

It’s also clear that data encryption should play a major role in any Plan B. Someone is going to get past the network perimeter defenses at some point, so organizations need to make sure that whoever gets in can’t use the data. Another way of looking at encryption in the context of Plan B is that it is the ultimate way to “unshare” data in shared environments.

Many organizations will likely struggle with moving from Plan A to Plan B, simply because the former has been in place for so long. People who work in security programs are accustomed to working with what they are comfortable with -- and this usually means firewalls and other legacy security technologies. But not a lot of staffers today are experts in encrypting an infrastructure. (Hint: if you want a secure career in security, you might want to get into encryption.)

In the final analysis, security executives need to evolve and say “yes” to more new IT initiatives. They can do so while feeling confident they are doing everything necessary to protect corporate information resources by taking a Plan B approach.

Tsion Gonen serves as Chief Strategy Officer for Gemalto's Identity and Data Protection Division. He is responsible for developing global business and product strategies, and identifying and capitalizing on emerging market trends within the information security market. Prior ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15208
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can ...
CVE-2020-15209
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one....
CVE-2020-15210
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and ...
CVE-2020-15211
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices f...
CVE-2020-15212
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `outpu...