Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
The State of IT Security: It’s Broken
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Susan Fogarty
50%
50%
Susan Fogarty,
 User Rank: Apprentice
12/23/2013 | 12:55:21 PM
Re: Tailored approach
John, Thanks for your response. I believe the distrust of automation is something IT folks are going to need to reach beyond in order to progress. In order to keep up with the pace of modern day threats and even simple business processing speed, we can't rely on manual human reaction time anymore.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
 User Rank: Strategist
12/20/2013 | 7:29:11 AM
Re: Tailored approach -- change is hard!
I'm glad to hear that what you're advocating doesn't require a ginoromous jump in skills for security practitioners, John. But I agree that change is hard and it will be challenging for many people and organizations to move off the status quo to a variable risk model  that is radically different.

For readers, I'm curious:  What do you think would be the hardest aspect of shifting from a static to a dynamic security risk assessmsent strategy?
JohnPirc
50%
50%
JohnPirc,
 User Rank: Author
12/19/2013 | 10:52:41 PM
Re: What about the data?
Thank you Stratustician.  I couldn't agree with you more on data identification and classification.  Having an understanding of where data resides and the value of that data is more than half the battle.  This goes hand and hand with knowing your attack surface. I didn't want to boil the ocean in this paper but you bring up very good points that should not be overlooked!
JohnPirc
50%
50%
JohnPirc,
 User Rank: Author
12/19/2013 | 10:47:06 PM
Re: Tailored approach
Thank you Thomas. I would have to disagree with you.  I'm not advocating "perfect security" but a reasonable pragmatic approach to the problem.  If we rely on "hope" and remain vigilant with current security practices than we will never keep pace with the threat.
JohnPirc
50%
50%
JohnPirc,
 User Rank: Author
12/19/2013 | 10:34:15 PM
Re: Tailored approach
Thank you Susan. The analysis needs to be performed in real or near-real time.  I agree with your point that most security pros tend to distrust automated systems. I use to think the same way about automated systems and that was something that I learned from the industry as a best practice.  The question I would ask is: "how is that working for you today?".  I don't mean that to sound harsh but we have to do something different and approach the problem from a different angle. 
JohnPirc
50%
50%
JohnPirc,
 User Rank: Author
12/19/2013 | 10:06:02 PM
Re: Tailored approach
Thank you Daniel and I couldn't agree with you more.
JohnPirc
50%
50%
JohnPirc,
 User Rank: Author
12/19/2013 | 10:04:06 PM
Re: Tailored approach
Thank you Marilyn. Sorry for the delayed response...I've been traveling. I think you will always have knowledge gaps within any industry.  I think practitioners have the skills to adopt my approach.  The biggest hurdle is doing something that seems radically different from current defensive approaches. I will admit that what I wrote just scratches the surface and I plan on adding even more context after the Holiday break with a white paper.   
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
 User Rank: Strategist
12/17/2013 | 3:34:04 PM
Re: What about the data?
That's a great point Stratustician, about classifying data in order to know how to protect it. In fact, I have a columnist who will be writing about that topic very soon. (So stay tuned!)

In the meantime, maybe you can share some of your experiences dealing with data classification & security -- good and bad!

 
anon5605928117
50%
50%
anon5605928117,
 User Rank: Apprentice
12/17/2013 | 9:34:33 AM
Re: Tailored approach
While it may not be fixable, certainly the conceit that individuals can memorize a hundred different long random passwords (provided they remember their incompatible userIDs) is as irrational as Mr. Spock's surprise when people act like people.    We need to understand people first.
Stratustician
50%
50%
Stratustician,
 User Rank: Moderator
12/16/2013 | 8:01:20 PM
What about the data?
I'm surprised that no one brought up one of the key fundamentals of security that would help (hopefully) reduce a lot of the complexity of securing data: asset identification.  I personally find that a lot of the confusion and security points of failure relate to not understanding what data exists, where it is, and how it is used.  It seems like a basic idea that if we have a good idea about what we have, we can build better security policies around it instead of trying to protect everything by throwing everything and anything at the problem and hoping nothing gets through.
Page 1 / 2   >   >>


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Enterprise Cybersecurity Plans in a Post-Pandemic World
Download the Enterprise Cybersecurity Plans in a Post-Pandemic World report to understand how security leaders are maintaining pace with pandemic-related challenges, and where there is room for improvement.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-40690
PUBLISHED: 2021-09-19
All versions of Apache Santuario - XML Security for Java prior to 2.2.3 and 2.1.7 are vulnerable to an issue where the "secureValidation" property is not passed correctly when creating a KeyInfo from a KeyInfoReference element. This allows an attacker to abuse an XPath Transform to extract...
CVE-2021-41073
PUBLISHED: 2021-09-19
loop_rw_iter in fs/io_uring.c in the Linux kernel through 5.14.6 allows local users to gain privileges by using IORING_OP_PROVIDE_BUFFERS to trigger a free of a kernel buffer, as demonstrated by using /proc/<pid>/maps for exploitation.
CVE-2021-23441
PUBLISHED: 2021-09-19
All versions of package com.jsoniter:jsoniter are vulnerable to Deserialization of Untrusted Data via malicious JSON strings. This may lead to a Denial of Service, and in certain cases, code execution.
CVE-2021-41393
PUBLISHED: 2021-09-18
Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows forgery of SSH host certificates in some situations.
CVE-2021-41394
PUBLISHED: 2021-09-18
Teleport before 4.4.11, 5.x before 5.2.4, 6.x before 6.2.12, and 7.x before 7.1.1 allows alteration of build artifacts in some situations.