Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

10/5/2010
01:40 AM
Adam Ely
Adam Ely
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Who's Driving Your Security Bus?

When did vendors begin setting our security priorities? I asked myself this question recently while at dinner with three friends representing two security vendors. This was a personal event, not business, and as is often the case, I was the only person from the enterprise side of the industry. You can imagine the conversation.

When did vendors begin setting our security priorities? I asked myself this question recently while at dinner with three friends representing two security vendors. This was a personal event, not business, and as is often the case, I was the only person from the enterprise side of the industry. You can imagine the conversation.One friend asked why I would not buy their product. Put aside the the way this company's senior salespeople hounded me after having removed the sales rep I had built a relation with from my account in order to give it to a more senior person. (Not that I'm bitter.)I still had valid reasons, simply put, the threats their product protects me against aren't the biggest threats to my organization and thus not my highest priority.

Between the two vendors represented, I could accomplish several sections of PCI, some relevant controls for SOX, and check off all the major threats covered in the media. On the books, I would look great. At the end of the day, however, that's not what security is about.

I have several dozen real threats to think about every day. Of the threats that bubble up to me from my team, I have to determine which are real, imminent, and pose the biggest risks to the organization. I have to weight budget, manpower, and potential impact, along with various other factors, to determine what I need to prioritize. Never mind all of this. The vendors continue to call and tell me their product was rated #1 by some named publication, ranked in the upper right magic super duper quadrant of some analyst chart, and if I am smart I will really focus my time (and money) on the threat they defend against.

I get it. Salespeople are supposed to sell me. Marketing people are supposed to make me "understand" that the space they defend is the most important. I don't fault these people for doing their jobs. But as I spoke to my dinner companion, I realized why vendors set the priories for so many enterprises.

When I do have the chance to speak to my peers, I realize that some are reciting verbatim pitches I heard from a vendor as to why they are buying X product or subscribing to Y service. They cite magazine articles, analyst fluff, and something they overheard from someone they can't remember at some conference.

I owe it to my organization to make decisions based on better information than this.

Now, many CSOs/CISOs/security managers are doing prioritization right. But for most of us, vendors exert too much influence, and we end up with often-overpriced products that only do some of what we need, and mostly what the vendor thinks we need.

Don't believe me? I have a good friend who had an application security company. This company, and its competitors, lobbied PCI to be included as a control. Ever wonder why PCI specifically discusses Web application scanning and Web application firewalls but doesn't discuss automated solutions in the other 11 sections? Great example of vendors pushing their agenda.

When they spend too much time listening to vendors, enterprise IT teams tend to change focus often and fail to build long-lasting security programs; rather, they do shortsighted, threat-focused responses. Building a proper security program requires planning and focusing on the highest risks to the organization and working down the list from there. Vendors can provide invaluable information that no single organization could obtain solo, but only once the threat is identified as needing attention and when the organization is ready.

By all means, read white papers and attend talks from vendors to understand the threats they see in the wild. I do so and have learned about issues that could affect my organization. But at the end of the day, I decide what is important, not the vendor. Make sure you do the same.

Comment  | 
Print  | 
More Insights
White Papers
More White Papers
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/27/2020
The Problem with Artificial Intelligence in Security
Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
Register for Dark Reading Newsletters
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8603
PUBLISHED: 2020-05-27
A cross-site scripting vulnerability (XSS) in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or ...
CVE-2020-8604
PUBLISHED: 2020-05-27
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on affected installations.
CVE-2020-8605
PUBLISHED: 2020-05-27
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this vulnerability.
CVE-2020-8606
PUBLISHED: 2020-05-27
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance.
CVE-2020-11075
PUBLISHED: 2020-05-27
In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an image analysis process. The image analysis operation can only be executed by an authenticated user via a...