Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

10/5/2010
01:40 AM
Adam Ely
Adam Ely
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Who's Driving Your Security Bus?

When did vendors begin setting our security priorities? I asked myself this question recently while at dinner with three friends representing two security vendors. This was a personal event, not business, and as is often the case, I was the only person from the enterprise side of the industry. You can imagine the conversation.

When did vendors begin setting our security priorities? I asked myself this question recently while at dinner with three friends representing two security vendors. This was a personal event, not business, and as is often the case, I was the only person from the enterprise side of the industry. You can imagine the conversation.One friend asked why I would not buy their product. Put aside the the way this company's senior salespeople hounded me after having removed the sales rep I had built a relation with from my account in order to give it to a more senior person. (Not that I'm bitter.)I still had valid reasons, simply put, the threats their product protects me against aren't the biggest threats to my organization and thus not my highest priority.

Between the two vendors represented, I could accomplish several sections of PCI, some relevant controls for SOX, and check off all the major threats covered in the media. On the books, I would look great. At the end of the day, however, that's not what security is about.

I have several dozen real threats to think about every day. Of the threats that bubble up to me from my team, I have to determine which are real, imminent, and pose the biggest risks to the organization. I have to weight budget, manpower, and potential impact, along with various other factors, to determine what I need to prioritize. Never mind all of this. The vendors continue to call and tell me their product was rated #1 by some named publication, ranked in the upper right magic super duper quadrant of some analyst chart, and if I am smart I will really focus my time (and money) on the threat they defend against.

I get it. Salespeople are supposed to sell me. Marketing people are supposed to make me "understand" that the space they defend is the most important. I don't fault these people for doing their jobs. But as I spoke to my dinner companion, I realized why vendors set the priories for so many enterprises.

When I do have the chance to speak to my peers, I realize that some are reciting verbatim pitches I heard from a vendor as to why they are buying X product or subscribing to Y service. They cite magazine articles, analyst fluff, and something they overheard from someone they can't remember at some conference.

I owe it to my organization to make decisions based on better information than this.

Now, many CSOs/CISOs/security managers are doing prioritization right. But for most of us, vendors exert too much influence, and we end up with often-overpriced products that only do some of what we need, and mostly what the vendor thinks we need.

Don't believe me? I have a good friend who had an application security company. This company, and its competitors, lobbied PCI to be included as a control. Ever wonder why PCI specifically discusses Web application scanning and Web application firewalls but doesn't discuss automated solutions in the other 11 sections? Great example of vendors pushing their agenda.

When they spend too much time listening to vendors, enterprise IT teams tend to change focus often and fail to build long-lasting security programs; rather, they do shortsighted, threat-focused responses. Building a proper security program requires planning and focusing on the highest risks to the organization and working down the list from there. Vendors can provide invaluable information that no single organization could obtain solo, but only once the threat is identified as needing attention and when the organization is ready.

By all means, read white papers and attend talks from vendors to understand the threats they see in the wild. I do so and have learned about issues that could affect my organization. But at the end of the day, I decide what is important, not the vendor. Make sure you do the same.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Black Hat Q&A: Hacking a '90s Sports Car
Black Hat Staff, ,  11/7/2019
The Cold Truth about Cyber Insurance
Chris Kennedy, CISO & VP Customer Success, AttackIQ,  11/7/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18954
PUBLISHED: 2019-11-14
Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in template/game-server/app/servers/connector/handler/entryHandler.js because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious at...
CVE-2019-3640
PUBLISHED: 2019-11-14
Unprotected Transport of Credentials in ePO extension in McAfee Data Loss Prevention 11.x prior to 11.4.0 allows remote attackers with access to the network to collect login details to the LDAP server via the ePO extension not using a secure connection when testing LDAP connectivity.
CVE-2019-3661
PUBLISHED: 2019-11-14
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attacker to execute database commands via carefully constructed time based payloads.
CVE-2019-3662
PUBLISHED: 2019-11-14
Path Traversal: '/absolute/pathname/here' vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows remote authenticated attacker to gain unintended access to files on the system via carefully constructed HTTP requests.
CVE-2019-3663
PUBLISHED: 2019-11-14
Unprotected Storage of Credentials vulnerability in McAfee Advanced Threat Defense (ATD) prior to 4.8 allows local attacker to gain access to the root password via accessing sensitive files on the system.