Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
The State of IT Security: Its Broken
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Susan Fogarty
50%
50%
Susan Fogarty,
User Rank: Apprentice
12/23/2013 | 12:55:21 PM
Re: Tailored approach
John, Thanks for your response. I believe the distrust of automation is something IT folks are going to need to reach beyond in order to progress. In order to keep up with the pace of modern day threats and even simple business processing speed, we can't rely on manual human reaction time anymore.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/20/2013 | 7:29:11 AM
Re: Tailored approach -- change is hard!
I'm glad to hear that what you're advocating doesn't require a ginoromous jump in skills for security practitioners, John. But I agree that change is hard and it will be challenging for many people and organizations to move off the status quo to a variable risk model  that is radically different.

For readers, I'm curious:  What do you think would be the hardest aspect of shifting from a static to a dynamic security risk assessmsent strategy?
JohnPirc
50%
50%
JohnPirc,
User Rank: Author
12/19/2013 | 10:52:41 PM
Re: What about the data?
Thank you Stratustician.  I couldn't agree with you more on data identification and classification.  Having an understanding of where data resides and the value of that data is more than half the battle.  This goes hand and hand with knowing your attack surface. I didn't want to boil the ocean in this paper but you bring up very good points that should not be overlooked!
JohnPirc
50%
50%
JohnPirc,
User Rank: Author
12/19/2013 | 10:47:06 PM
Re: Tailored approach
Thank you Thomas. I would have to disagree with you.  I'm not advocating "perfect security" but a reasonable pragmatic approach to the problem.  If we rely on "hope" and remain vigilant with current security practices than we will never keep pace with the threat.
JohnPirc
50%
50%
JohnPirc,
User Rank: Author
12/19/2013 | 10:34:15 PM
Re: Tailored approach
Thank you Susan. The analysis needs to be performed in real or near-real time.  I agree with your point that most security pros tend to distrust automated systems. I use to think the same way about automated systems and that was something that I learned from the industry as a best practice.  The question I would ask is: "how is that working for you today?".  I don't mean that to sound harsh but we have to do something different and approach the problem from a different angle. 
JohnPirc
50%
50%
JohnPirc,
User Rank: Author
12/19/2013 | 10:06:02 PM
Re: Tailored approach
Thank you Daniel and I couldn't agree with you more.
JohnPirc
50%
50%
JohnPirc,
User Rank: Author
12/19/2013 | 10:04:06 PM
Re: Tailored approach
Thank you Marilyn. Sorry for the delayed response...I've been traveling. I think you will always have knowledge gaps within any industry.  I think practitioners have the skills to adopt my approach.  The biggest hurdle is doing something that seems radically different from current defensive approaches. I will admit that what I wrote just scratches the surface and I plan on adding even more context after the Holiday break with a white paper.   
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/17/2013 | 3:34:04 PM
Re: What about the data?
That's a great point Stratustician, about classifying data in order to know how to protect it. In fact, I have a columnist who will be writing about that topic very soon. (So stay tuned!)

In the meantime, maybe you can share some of your experiences dealing with data classification & security -- good and bad!

 
anon5605928117
50%
50%
anon5605928117,
User Rank: Apprentice
12/17/2013 | 9:34:33 AM
Re: Tailored approach
While it may not be fixable, certainly the conceit that individuals can memorize a hundred different long random passwords (provided they remember their incompatible userIDs) is as irrational as Mr. Spock's surprise when people act like people.    We need to understand people first.
Stratustician
50%
50%
Stratustician,
User Rank: Moderator
12/16/2013 | 8:01:20 PM
What about the data?
I'm surprised that no one brought up one of the key fundamentals of security that would help (hopefully) reduce a lot of the complexity of securing data: asset identification.  I personally find that a lot of the confusion and security points of failure relate to not understanding what data exists, where it is, and how it is used.  It seems like a basic idea that if we have a good idea about what we have, we can build better security policies around it instead of trying to protect everything by throwing everything and anything at the problem and hoping nothing gets through.
Page 1 / 2   >   >>


News
Former CISA Director Chris Krebs Discusses Risk Management & Threat Intel
Kelly Sheridan, Staff Editor, Dark Reading,  2/23/2021
Edge-DRsplash-10-edge-articles
Security + Fraud Protection: Your One-Two Punch Against Cyberattacks
Joshua Goldfarb, Director of Product Management at F5,  2/23/2021
News
Cybercrime Groups More Prolific, Focus on Healthcare in 2020
Robert Lemos, Contributing Writer,  2/22/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Building the SOC of the Future
Building the SOC of the Future
Digital transformation, cloud-focused attacks, and a worldwide pandemic. The past year has changed the way business works and the way security teams operate. There is no going back.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-24100
PUBLISHED: 2021-02-25
Microsoft Edge for Android Information Disclosure Vulnerability
CVE-2021-24101
PUBLISHED: 2021-02-25
Microsoft Dataverse Information Disclosure Vulnerability
CVE-2021-24102
PUBLISHED: 2021-02-25
Windows Event Tracing Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-24103.
CVE-2021-24103
PUBLISHED: 2021-02-25
Windows Event Tracing Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-24102.
CVE-2021-24105
PUBLISHED: 2021-02-25
Package Managers Configurations Remote Code Execution Vulnerability