Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

4/10/2008
04:45 PM
Rob Preston
Rob Preston
Commentary
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Down To Business: It's Past Time To Elevate The Infosec Conversation

At the RSA conference, the security discussion was about helping customers innovate and deliver business value.

The RSA Conference, the annual security fest hosted by EMC unit RSA, is to the information security industry what the New Hampshire primary is to the presidential election process: the first major venue for the leading players to set the tone and frame the discussion for the coming year.

Last year, RSA chief Art Coviello championed industry consolidation, arguing that as a handful of major vendors (EMC, Cisco, IBM, Microsoft) built security into their infrastructure platforms, standalone security challengers would fall by the wayside--all within three years. "If I'm proven wrong about the timing," Coviello said last year, "I won't be proven wrong in the need for this." The likes of Symantec and McAfee begged to differ, and the industry continues to debate the strengths and weaknesses of all-in-one security architectures.

RSA, as host vendor, sought to exploit its home turf advantage again last week, when Coviello struck a different tone. Instead of focusing on industry restructuring and technology architectures, he elevated the security discussion to one about helping customers innovate and deliver business value.

More than 80% of the IT, security, and business executives RSA recently surveyed with IDC "admit that their organizations have shied away from business innovation opportunities because of information security concerns," Coviello told the RSA audience. The main challenge: Move the internal conversation about security away from fear mongering and worst-case scenarios toward how security can augment new products and services. Or at least don't get in the way. It's tantamount to the security pro's Hippocratic oath: First, do no harm.

While RSA offers no elixir for making security a "business enabler," it has created a Security for Business Innovation Council to get security pros talking about the issue. RSA quotes member David Kent, VP of security for biotech company Genzyme: "If you are doing your job, you shouldn't even sound like a security person. The business doesn't care how many viruses you stopped. ... 'How are you helping me meet my business objectives?'"

Likewise, InformationWeek contributor Greg Shipley, CTO of security consultancy Neohapsis, urges security pros to integrate risk management into all processes. They also need to get better at understanding and relating to their internal audiences, assessing which data to assign the most protection, and picking their battles and technologies more carefully. "For some organizations," Shipley writes, "this will require a wholesale transformation."(See Risk Management: Do It Now, Do It Right.)

It's still early in this evolution. When asked last year how their companies measure the value of their security investments, the 1,100 U.S. respondents to InformationWeek's Global Information Security Survey offered a stew of mostly operational criteria: 43% said they measured value in terms of reduced worker hours spent on security; 33% measured it in reduced breaches; 33% in reduced network downtime; and 24% in reduced incident response times. With the exception of improving intellectual property protection (27%) and honing risk management strategies (25%), none of the criteria selected relates to business value. In fact, 24% of the respondents didn't measure the value of their security investments at all.

The sooner security pros can converse in the language of risk mitigation and business opportunity, the more they'll be involved in strategic planning and the less they'll be considered a cost center.

Compare Coviello's nuanced approach to the classic fire and brimstone of Homeland Security Secretary Michael Chertoff, who at RSA last week warned that a large-scale cyberattack on the United States could inflict damage comparable to the Sept. 11, 2001, terrorist attacks. Chertoff likened U.S. government efforts to improve cybersecurity to the Manhattan Project, which developed the atomic bomb.

Chertoff has his own unique war to fight; enterprise security pros may want to use Manhattan Project metaphors sparingly.

Rob Preston,
VP and Editor in Chief
[email protected]

To find out more about Rob Preston, please visit his page.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25596
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various state sanitization activities to software. One of Xen's sanitization paths injects a #GP fault, and incorrectly delivers it twice to the guest. T...
CVE-2020-25597
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid. Logic in the handling of event channel operations in Xen assumes that an event channel, once valid, will not become invalid over the life time of a guest. Howeve...
CVE-2020-25598
PUBLISHED: 2020-09-23
An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchronisation primitive. A buggy error path in the XENMEM_acquire_resource exits without releasing an RCU reference, which is conceptually similar...
CVE-2020-25599
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. There are evtchn_reset() race conditions. Uses of EVTCHNOP_reset (potentially by a guest on itself) or XEN_DOMCTL_soft_reset (by itself covered by XSA-77) can lead to the violation of various internal assumptions. This may lead to out of bounds memory a...
CVE-2020-25600
PUBLISHED: 2020-09-23
An issue was discovered in Xen through 4.14.x. Out of bounds event channels are available to 32-bit x86 domains. The so called 2-level event channel model imposes different limits on the number of usable event channels for 32-bit x86 domains vs 64-bit or Arm (either bitness) ones. 32-bit x86 domains...