Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
The State of IT Security: Its Broken
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
Susan Fogarty
50%
50%
Susan Fogarty,
User Rank: Apprentice
12/23/2013 | 12:55:21 PM
Re: Tailored approach
John, Thanks for your response. I believe the distrust of automation is something IT folks are going to need to reach beyond in order to progress. In order to keep up with the pace of modern day threats and even simple business processing speed, we can't rely on manual human reaction time anymore.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/20/2013 | 7:29:11 AM
Re: Tailored approach -- change is hard!
I'm glad to hear that what you're advocating doesn't require a ginoromous jump in skills for security practitioners, John. But I agree that change is hard and it will be challenging for many people and organizations to move off the status quo to a variable risk model  that is radically different.

For readers, I'm curious:  What do you think would be the hardest aspect of shifting from a static to a dynamic security risk assessmsent strategy?
JohnPirc
50%
50%
JohnPirc,
User Rank: Author
12/19/2013 | 10:52:41 PM
Re: What about the data?
Thank you Stratustician.  I couldn't agree with you more on data identification and classification.  Having an understanding of where data resides and the value of that data is more than half the battle.  This goes hand and hand with knowing your attack surface. I didn't want to boil the ocean in this paper but you bring up very good points that should not be overlooked!
JohnPirc
50%
50%
JohnPirc,
User Rank: Author
12/19/2013 | 10:47:06 PM
Re: Tailored approach
Thank you Thomas. I would have to disagree with you.  I'm not advocating "perfect security" but a reasonable pragmatic approach to the problem.  If we rely on "hope" and remain vigilant with current security practices than we will never keep pace with the threat.
JohnPirc
50%
50%
JohnPirc,
User Rank: Author
12/19/2013 | 10:34:15 PM
Re: Tailored approach
Thank you Susan. The analysis needs to be performed in real or near-real time.  I agree with your point that most security pros tend to distrust automated systems. I use to think the same way about automated systems and that was something that I learned from the industry as a best practice.  The question I would ask is: "how is that working for you today?".  I don't mean that to sound harsh but we have to do something different and approach the problem from a different angle. 
JohnPirc
50%
50%
JohnPirc,
User Rank: Author
12/19/2013 | 10:06:02 PM
Re: Tailored approach
Thank you Daniel and I couldn't agree with you more.
JohnPirc
50%
50%
JohnPirc,
User Rank: Author
12/19/2013 | 10:04:06 PM
Re: Tailored approach
Thank you Marilyn. Sorry for the delayed response...I've been traveling. I think you will always have knowledge gaps within any industry.  I think practitioners have the skills to adopt my approach.  The biggest hurdle is doing something that seems radically different from current defensive approaches. I will admit that what I wrote just scratches the surface and I plan on adding even more context after the Holiday break with a white paper.   
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
12/17/2013 | 3:34:04 PM
Re: What about the data?
That's a great point Stratustician, about classifying data in order to know how to protect it. In fact, I have a columnist who will be writing about that topic very soon. (So stay tuned!)

In the meantime, maybe you can share some of your experiences dealing with data classification & security -- good and bad!

 
anon5605928117
50%
50%
anon5605928117,
User Rank: Apprentice
12/17/2013 | 9:34:33 AM
Re: Tailored approach
While it may not be fixable, certainly the conceit that individuals can memorize a hundred different long random passwords (provided they remember their incompatible userIDs) is as irrational as Mr. Spock's surprise when people act like people.    We need to understand people first.
Stratustician
50%
50%
Stratustician,
User Rank: Moderator
12/16/2013 | 8:01:20 PM
What about the data?
I'm surprised that no one brought up one of the key fundamentals of security that would help (hopefully) reduce a lot of the complexity of securing data: asset identification.  I personally find that a lot of the confusion and security points of failure relate to not understanding what data exists, where it is, and how it is used.  It seems like a basic idea that if we have a good idea about what we have, we can build better security policies around it instead of trying to protect everything by throwing everything and anything at the problem and hoping nothing gets through.
Page 1 / 2   >   >>


Attackers Leave Stolen Credentials Searchable on Google
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
How to Better Secure Your Microsoft 365 Environment
Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: I can't find the back door.
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-21272
PUBLISHED: 2021-01-25
ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the ...
CVE-2021-23901
PUBLISHED: 2021-01-25
An XML external entity (XXE) injection vulnerability was discovered in the Nutch DmozParser and is known to affect Nutch versions < 1.18. XML external entity injection (also known as XXE) is a web security vulnerability that allows an attacker to interfere with an application's processing of XML ...
CVE-2020-17532
PUBLISHED: 2021-01-25
When handler-router component is enabled in servicecomb-java-chassis, authenticated user may inject some data and cause arbitrary code execution. The problem happens in versions between 2.0.0 ~ 2.1.3 and fixed in Apache ServiceComb-Java-Chassis 2.1.5
CVE-2020-12512
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated reflected POST Cross-Site Scripting
CVE-2020-12513
PUBLISHED: 2021-01-22
Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.