Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
9/22/2015
09:15 AM
Gavin Millard
Gavin Millard
Partner Perspectives
100%
0%

Buyer Beware: How To Avoid Getting Sucked Into Shelfware

Three simple questions can help ensure you get the most value out of your information security investments.

We’ve all seen slick pitches by information security vendors eager to grab budget. Some are valid, concentrating on the critical controls required in today’s world to protect our data; others are of slightly less need and merit.

Sales will be sales; compensation drives behavior, and when you’re faced with a sales team earning a significant commission from selling tools that protect you from all the “l337 h4x0rs,” sometimes that behavior is less than in the best interests of the buyer. As much as a vendor will advise you on which technology is best suited for the issues faced, remember they are often primarily trying to sell their solution. When was the last time you went to a BMW dealer to look for a new car and, after discussing your requirements, they suggested an Audi? Or even less probable, they said that you should keep what you have and just give it a clean and a service?

This isn’t a rant about sales teams; I’ve worked with some amazing salespeople who care about the customer and the problems they face. This is more about what you should consider before signing on the dotted line.

Security technologies are rarely simple, more often requiring effort to manage and operationalize effectively to gain the level of protection evangelized in the sales process. A good CISO friend of mine once told me that no matter what the vendor of a product tells him (including me), he always calculates the cost of managing any control at a 5:1 ratio -- calculating the operational costs as five times the amount spent on actual licenses. Far too many companies want to throw money at a silver bullet rather than put the effort into actually fixing the problem, which leads to lots of license sales but low return on investment.

Beware Of Shelfware

It seems odd that companies would spend a huge amount of money on a technology and not implement it fully, but shelfware (or underutilized technology) is a known problem in the industry. When Target got popped at the end of 2013, reading the kill chain analysis gave a sobering and clear view of the problem. The retailer had spent a significant amount of money ($1.6 million) on a market-leading anti-malware solution to defend against the very attacks it experienced, but it ignored the alarms raised by the platform, idly standing by as critical data flowed out into the hands of cybercriminals. Target had invested nearly $2 million on a control many would argue is the right approach to addressing the threat of targeted malware. Yet due to an inability to actually operationalize the control effectively, the retailer paid an even bigger price. Simply buying an expensive security technology is useless if it’s not implemented properly.

With every purchase, more consideration should be given to how the product will add value to the overall business. People, process, and technology are often cited as the critical considerations to think about for a control. But for me, I also like to think about measure, validate, and communicate.

I like to pose three simple questions when talking about implementing any control or suggesting an investment in a technology:

  • How will you measure that the control is effectively deployed and fully functional?
  • How will you test and validate that the control is giving the desired level of protection?
  • How will you demonstrate iterative improvements to the overall security of the organization and communicate the value of the investment made?

So next time you’re across the table from a vendor, try posing these questions. Vendors with a desire to help and a solid approach will undoubtedly provide guidance through examples of other work they’ve done with similar customers, metrics to use to measure the operational efficiency, and advice on how to demonstrate the value of the solution.

Vendors love to state that their solution is “almost plug and play,” or that you can “just drop it in and it works like a charm with proactive protection out of the box.” But after the proof of concept is done, the purchase orders are sent, and the license keys are received, make sure you're getting the most value you can from the investment, because security budgets are tight enough already.

Gavin Millard is a trained, ethical hacker who works with medium and large enterprises to address their cybersecurity challenges. With a deep understanding of how attackers plot a breach, he helps bring these companies to a trusted state of IT infrastructure. He previously ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19767
PUBLISHED: 2019-12-12
The Linux kernel before 5.4.2 mishandles ext4_expand_extra_isize, as demonstrated by use-after-free errors in __ext4_expand_extra_isize and ext4_xattr_set_entry, related to fs/ext4/inode.c and fs/ext4/super.c, aka CID-4ea99936a163.
CVE-2019-19768
PUBLISHED: 2019-12-12
In the Linux kernel 5.4.0-rc2, there is a use-after-free (read) in the __blk_add_trace function in kernel/trace/blktrace.c (which is used to fill out a blk_io_trace structure and place it in a per-cpu sub-buffer).
CVE-2019-19769
PUBLISHED: 2019-12-12
In the Linux kernel 5.3.10, there is a use-after-free (read) in the perf_trace_lock_acquire function (related to include/trace/events/lock.h).
CVE-2019-19770
PUBLISHED: 2019-12-12
In the Linux kernel 4.19.83, there is a use-after-free (read) in the debugfs_remove function in fs/debugfs/inode.c (which is used to remove a file or directory in debugfs that was previously created with a call to another debugfs function such as debugfs_create_file).
CVE-2019-19771
PUBLISHED: 2019-12-12
The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In particular, the Trojan horse finds and exfiltrates cryptocurrency wallets.