Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

3/18/2015
05:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail

New Security Mindset: Focus On The Interior

Chief privacy officer Jason Straight shares his insights on why organizations are struggling to stop the breach wave -- and manage the aftermath.

Jason Straight, senior vice president and chief privacy officer at UnitedLex

Jason Straight, senior vice president and chief privacy officer at UnitedLex

Comment  | 
Print  | 
Comments
Threaded  |  Newest First  |  Oldest First
xmarksthespot
50%
50%
xmarksthespot,
User Rank: Strategist
3/19/2015 | 2:50:30 AM
Excellent interview of a person who has a clear understanding of information security. Thanks!
Jason Straight has a clear understanding of core security principles. "I'm not saying forget the perimeter. It's got to be a balance, with a focus on the interior, too":  This is a well-crafted statement by Straight.  Defense-in-depth is a core security principle.

It appears he includes 2 factor authentication as part of internal security, but in my mind it also can be authentication via a site on the web, like some banks are now supporting, which is external.  It seems to me like the one other area internally is encryption of data at rest and data in transit (all internal network traffic). 

The human layer is definitely the most vulnerable, but I don't agree that is an intractable problem. ... Human beings are the most sophisticated detection devices you've got". - Another golden nugget from Mr. Straight. 

He has a good point where the security industry is pushing for people to purchase more and more endpoint solutions out there, and the focus should be internal controls.

Thank you, Jason Straight
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
3/19/2015 | 11:20:22 AM
Re: Excellent interview of a person who has a clear understanding of information security. Thanks!
Thank you for sharing your thoughts, @xmarksthespot. I think Straight's perspective as both a lawyer and a cyber security expert make his insights even more interesting and helpful.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
3/19/2015 | 3:03:51 PM
Re: Excellent interview of a person who has a clear understanding of information security. Thanks!

"You need to make sure Legal has a formal and well-defined role in IR before there's an incident"

I completely agree with this, at the end of the day, an incident would have a legal liability, you may want to cover that aspect of it from the beginning.

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
3/19/2015 | 3:01:23 PM
Re: Excellent interview of a person who has a clear understanding of information security. Thanks!

I would not categorize humans as most sophisticated detection devices, they are sophisticated for sure and because of that could to really detect anything unless it is absolutely made visible to them. If we can take humans out of security equation we will be in better shape.

RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
3/19/2015 | 11:43:12 AM
Perimeter Emphasis
This was a great interview. I didin't realize how much emphasis was put on perimeter defenses and how underutilized internal defenses were until Jason alluded to this. Looking at it now, that fact couldn't have been more prevalent. I agree with his statements in the first step to moving towards increasing the security posture internally is to change the mind set of the human element with frequent human training sessions backed by the executives. Otherwise, we will continue to build these walls to the sky.
Dr.T
50%
50%
Dr.T,
User Rank: Ninja
3/19/2015 | 3:06:13 PM
Re: Perimeter Emphasis

I agree. External and internal; security measures. Unless it is layered it does not really matter what you do in any side of your network perimeter.

Dr.T
50%
50%
Dr.T,
User Rank: Ninja
3/19/2015 | 2:56:20 PM
An industry was created
I do not have an evidence to prove what I am saying here, there is a real industry is created on the security, security insurance, security devices and applications  companies are living their golden days. You can not create an industry by just hacking, there must be big investors and supports of this industry that we may not be aware of.
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
5/7/2015 | 5:15:37 PM
An Outline for a Quick and Dirty InfoSec Governance Team
This was a great interview and one of the most packed I've read in recent weeks with take-away material for research and reflection.  The notes on how focus on the wrong things for organizations when it comes to InfoSec rings true.  While not entirely focused on the "interior" I have a simplistic model below that does put focus on three key areas that ultimately translate to improving the integrity of "interior" data and processes.  

Not to oversimplify Information Security and the complex roles that need to be filled for organization-wide coverage, but these three points are great shortcuts to establishing an InfoSec governance team, especially for small orgs that may not have the resources for a formal loss prevention lifecycle.  Because the environment elements often overlap with these states, you then can have the same person (for very small teams) take more than one function.  

Org Function 1:

* Governs architecture/standards/implementation/lifecycle:  Network data that is in transit, flowing across internal networks and to the outside world (i.e., data on the wire and in the air). 

Org Function 2:

* Governs architecture/standards/implementation/lifecycle:  Data that is at rest on servers, databases, file shares, Intranet sites, workstations, laptops, mobile devices, portable storage, backup tapes, removable media, cloud storage. 

Org Function 3:

*  Governs usage standards/auditing/lifecycle:  Data that is in use in temporary memory on a local machine, an open report or running query on a workstation, an email that has been drafted but not sent, a file being copied to a USB drive, and data being copied and pasted from one local document to another. 

Feeding into all three of these areas would be incident response root cause analysis reports for continuous improvement for each lifecycle and their interfaces. 

A tight, compact approach to InfoSec and one that could improve upon some of the shortcomings this article mentions.

(Nod to Ernst & Young's 2011 data security report for some of the above verbiage.)
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
5/8/2015 | 7:42:28 AM
Re: An Outline for a Quick and Dirty InfoSec Governance Team
@Christian, thanks for sharing this. A nice addition to Straight's insights. 
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Breaches Are Inevitable, So Embrace the Chaos
Ariel Zeitlin, Chief Technology Officer & Co-Founder, Guardicore,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19010
PUBLISHED: 2019-11-16
Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.
CVE-2019-16761
PUBLISHED: 2019-11-15
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the [email protected] npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. All versions >1.0...
CVE-2019-16762
PUBLISHED: 2019-11-15
A specially crafted Bitcoin script can cause a discrepancy between the specified SLP consensus rules and the validation result of the slpjs npm package. An attacker could create a specially crafted Bitcoin script in order to cause a hard-fork from the SLP consensus. Affected users can upgrade to any...
CVE-2019-13581
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A heap-based buffer overflow allows remote attackers to cause a denial of service or execute arbitrary ...
CVE-2019-13582
PUBLISHED: 2019-11-15
An issue was discovered in Marvell 88W8688 Wi-Fi firmware before version p52, as used on Tesla Model S/X vehicles manufactured before March 2018, via the Parrot Faurecia Automotive FC6050W module. A stack overflow could lead to denial of service or arbitrary code execution.