Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
The New Security Architecture
Threaded  |  Newest First  |  Oldest First
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
11/20/2013 | 10:03:18 AM
Investment priorites
Ed, You paint a pretty sobering picture for IT security executives & the new paradigm you describe will clearly require a major shift in thinking. What are some suggestions on  how IT senior management and audit teams  should start to refocus protection their efforts?  Your point noting that "the most basic tenet of today's corporate audit involves testing controls to ensure 100 percent compliance with corporate policy" sounds to me like it wil l be to be a heavy lift.

 
David F. Carr
50%
50%
David F. Carr,
User Rank: Strategist
11/20/2013 | 10:08:05 AM
Compliance vs. security
I was left wondering by the statement about audit requirements focusing too much on compliance issues. Is that in conflict with the security imprerative for some reason? Or you just saying that security needs to be given an even higher priority?
Susan Fogarty
50%
50%
Susan Fogarty,
User Rank: Apprentice
11/20/2013 | 11:51:42 AM
Re: Compliance vs. security
David, my interpretation was that the strict focus on compliance is taking away from organizations' ability to protect their most critical/sensitive resources, which Ed notes should be the goal. 

Another point I found really interesting was the statement that "cloud-based protections are minimal defenses against all of these threats because of the network visibility required to detect and mitigate them." I was surprised to hear that coming from AT&T. Is there no hope for network-operator-based security improvements to help screen out more of the threats?
Kim Davis
50%
50%
Kim Davis,
User Rank: Apprentice
11/20/2013 | 12:12:47 PM
Re: Compliance vs. security
I've been hearing healthcare IT professionals recently describing how they're torn between the need to release patient data to patients, security concerns, and compliance issues.  It's a minefield.
Ed Amoroso
50%
50%
Ed Amoroso,
User Rank: Apprentice
11/21/2013 | 1:08:44 PM
Re: Compliance vs. security
Susan, for AT&T customers, our network is their first line of defense. In fact, we track hundreds of millions of security events every day to protect our network and our customers from malicious threats. The challenge for businesses is that Internet traffic comes into their corporate networks from a variety of sources, so it's important to have visibility into your organization's specific network. This level of visibility is also critical for detecting unauthorized access to your corporate assets.
Susan Fogarty
50%
50%
Susan Fogarty,
User Rank: Apprentice
11/21/2013 | 5:21:27 PM
Re: Compliance vs. security
Ed, thanks so much for your response. I'm aware that the carriers are constantly monitoring their networks for developing threats. I guess I am surprised that we haven't seen as that much uptake in managed security services by enterprises so that they can take advantage of that. There seems like a lot of potential that could really be leveraged.
Ed Amoroso
50%
50%
Ed Amoroso,
User Rank: Apprentice
11/21/2013 | 1:07:39 PM
Re: Compliance vs. security
David, compliance is not going away and it's become part of the job for those of us responsible for protecting corporate networks. However, as Jerry points out below, controls are not 100% foolproof and are inadequate when it comes to dealing with a live adversary. Consequently, a business that passes all of its audits can still be extremely vulnerable to attack. I believe effective programs give high priority to security innovation and to developing a team that can mitigate threats in real-time.
Ed Amoroso
50%
50%
Ed Amoroso,
User Rank: Apprentice
11/21/2013 | 1:04:12 PM
Re: Investment priorites
Marilyn, I think an important first step for senior management is ensuring that CSOs are bringing a solid foundation of networking and cybersecurity expertise to audit discussions. In the future, I expect we'll see more highly technical security professionals sporting PhDs and a deep understanding of networks, infrastructure, and devices. These technical experts know the importance of adopting threat detection and mitigation practices, rather than putting all the organization's time and energy into compliance.
JerryJ
50%
50%
JerryJ,
User Rank: Apprentice
11/20/2013 | 1:21:33 PM
Compliance Testing Doesn't Go Away
Ed, you wrote "...most basic tenet of today's corporate audit involves testing controls to ensure 100 percent compliance with corporate policy. This mentality needs to change..." It may be semantics, but I respectfully disagree. You always need to test controls. Too often, in my experience, an adversary has take advantage of a failed control that was thought to be in place. That said, you need to be certain you've selected and implemented the correct controls to begin with, recognizing that the technologies we deploy and the motives, skills and modus operandi of the adversary are ever evolving.

You finished your thought with "...so businesses can prioritize investments on protections that will yield the best possible security posture." This I agree with 100%. I was once on a panel speaking on risk management and was asked, "so does risk management eliminate the need for the compliance checklist?" My reply was, "No. Risk management is a way to prioritize the compliance checklist." I would also add that risk management is a way to evolve the compliance checklist.
Susan Fogarty
50%
50%
Susan Fogarty,
User Rank: Apprentice
11/20/2013 | 6:04:42 PM
Re: Compliance Testing Doesn't Go Away
Jerry, I like your analysis. The problem comes when companies equate compliance with security and think if they are complaint, then everything will be fine. But there are a lot of other protections that may be needed. A risk assessment should point those out.
Ed Amoroso
50%
50%
Ed Amoroso,
User Rank: Apprentice
11/21/2013 | 1:09:17 PM
Re: Compliance Testing Doesn't Go Away
Jerry, we actually agree on the first point, but perhaps it wasn't clear before. I was not suggesting that compliance and control testing should go away, but that these tactics alone are not a perfect reflection of your security posture and can distract a security team from critical priorities. For example, you can have the appropriate controls in place and functioning properly, but if an employee is caught by a phishing email and adversaries gain access to your network, they can work around all your controls. This is one reason why network visibility is so important. You need to understand what is going in and out of your network at all times because today's adversaries can adjust their tactics in real-time, so businesses need to have the ability to recognize those tactics and react quickly.
BillatDellSoftware
50%
50%
BillatDellSoftware,
User Rank: Apprentice
11/21/2013 | 8:25:04 AM
Determining risk calue
Ed, this is an excellent article insofar as it looks at the changing IT landscape and how that impacts security in the enterprise both today and in the future.  I work for Dell Software and spend a good deal of time speaking with customers who are experiencing very similar challenges.  One of the topics I would like to hear more about from you is how you go about prioritizing assets.  You mention in the article that you need to invest more to protect "high value" assets than you do for "lower value" assets.  How do you go about determining those risk values?  Do you allow the business to classify apps and content?  Do you have an automated tool that strives to check each document and assign risk to it?
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
11/21/2013 | 10:15:11 AM
Re: Determining risk calue
These are all great questions about prioritizing assets and determining risk, Bill. Let's throw them out to the security community to see what risk management strategies and tactics are working and not working in their respective organizations.

Also want to point you to Dave Kearns' column: Understanding IT Risk Management In 4 Steps X 3, which outlines a risk management matrix that combines the probability of harm and the severity of harm. 
BillatDellSoftware
50%
50%
BillatDellSoftware,
User Rank: Apprentice
11/21/2013 | 10:29:35 AM
Re: Determining risk calue
Marilyn, Thanks for the tip on the Dave K article.  I really like the last line: "Over the longer term, the only alternative to risk management is crisis management, and crisis management is much more embarrassing, expensive and time consuming." 

We are providing Dave a review of our IAM business in a few weeks.  I'll be sure to bring this one up.  Thanks!

 


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20686
PUBLISHED: 2021-09-17
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2021-38402
PUBLISHED: 2021-09-17
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could lead to a stack-based buffer overflow while trying to copy to a buffer during font string handling. An attacker could leverage this vulnerability to ex...
CVE-2021-38404
PUBLISHED: 2021-09-17
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in a heap-based buffer overflow. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVE-2021-38406
PUBLISHED: 2021-09-17
Delta Electronic DOPSoft 2 (Version 2.00.07 and prior) lacks proper validation of user-supplied data when parsing specific project files. This could result in multiple out-of-bounds write instances. An attacker could leverage this vulnerability to execute code in the context of the current process.
CVE-2021-41326
PUBLISHED: 2021-09-17
In MISP before 2.4.148, app/Lib/Export/OpendataExport.php mishandles parameter data that is used in a shell_exec call.