Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

10/5/2010
01:40 AM
Adam Ely
Adam Ely
Commentary
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Who's Driving Your Security Bus?

When did vendors begin setting our security priorities? I asked myself this question recently while at dinner with three friends representing two security vendors. This was a personal event, not business, and as is often the case, I was the only person from the enterprise side of the industry. You can imagine the conversation.

When did vendors begin setting our security priorities? I asked myself this question recently while at dinner with three friends representing two security vendors. This was a personal event, not business, and as is often the case, I was the only person from the enterprise side of the industry. You can imagine the conversation.One friend asked why I would not buy their product. Put aside the the way this company's senior salespeople hounded me after having removed the sales rep I had built a relation with from my account in order to give it to a more senior person. (Not that I'm bitter.)I still had valid reasons, simply put, the threats their product protects me against aren't the biggest threats to my organization and thus not my highest priority.

Between the two vendors represented, I could accomplish several sections of PCI, some relevant controls for SOX, and check off all the major threats covered in the media. On the books, I would look great. At the end of the day, however, that's not what security is about.

I have several dozen real threats to think about every day. Of the threats that bubble up to me from my team, I have to determine which are real, imminent, and pose the biggest risks to the organization. I have to weight budget, manpower, and potential impact, along with various other factors, to determine what I need to prioritize. Never mind all of this. The vendors continue to call and tell me their product was rated #1 by some named publication, ranked in the upper right magic super duper quadrant of some analyst chart, and if I am smart I will really focus my time (and money) on the threat they defend against.

I get it. Salespeople are supposed to sell me. Marketing people are supposed to make me "understand" that the space they defend is the most important. I don't fault these people for doing their jobs. But as I spoke to my dinner companion, I realized why vendors set the priories for so many enterprises.

When I do have the chance to speak to my peers, I realize that some are reciting verbatim pitches I heard from a vendor as to why they are buying X product or subscribing to Y service. They cite magazine articles, analyst fluff, and something they overheard from someone they can't remember at some conference.

I owe it to my organization to make decisions based on better information than this.

Now, many CSOs/CISOs/security managers are doing prioritization right. But for most of us, vendors exert too much influence, and we end up with often-overpriced products that only do some of what we need, and mostly what the vendor thinks we need.

Don't believe me? I have a good friend who had an application security company. This company, and its competitors, lobbied PCI to be included as a control. Ever wonder why PCI specifically discusses Web application scanning and Web application firewalls but doesn't discuss automated solutions in the other 11 sections? Great example of vendors pushing their agenda.

When they spend too much time listening to vendors, enterprise IT teams tend to change focus often and fail to build long-lasting security programs; rather, they do shortsighted, threat-focused responses. Building a proper security program requires planning and focusing on the highest risks to the organization and working down the list from there. Vendors can provide invaluable information that no single organization could obtain solo, but only once the threat is identified as needing attention and when the organization is ready.

By all means, read white papers and attend talks from vendors to understand the threats they see in the wild. I do so and have learned about issues that could affect my organization. But at the end of the day, I decide what is important, not the vendor. Make sure you do the same.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 10/27/2020
6 Ways Passwords Fail Basic Security Tests
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/28/2020
'Act of War' Clause Could Nix Cyber Insurance Payouts
Robert Lemos, Contributing Writer,  10/29/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How to Measure and Reduce Cybersecurity Risk in Your Organization
In this Tech Digest, we examine the difficult practice of measuring cyber-risk that has long been an elusive target for enterprises. Download it today!
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27652
PUBLISHED: 2020-10-29
Algorithm downgrade vulnerability in QuickConnect in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
CVE-2020-27653
PUBLISHED: 2020-10-29
Algorithm downgrade vulnerability in QuickConnect in Synology Router Manager (SRM) before 1.2.4-8081 allows man-in-the-middle attackers to spoof servers and obtain sensitive information via unspecified vectors.
CVE-2020-27654
PUBLISHED: 2020-10-29
Improper access control vulnerability in lbd in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to execute arbitrary commands via port (1) 7786/tcp or (2) 7787/tcp.
CVE-2020-27655
PUBLISHED: 2020-10-29
Improper access control vulnerability in Synology Router Manager (SRM) before 1.2.4-8081 allows remote attackers to access restricted resources via inbound QuickConnect traffic.
CVE-2020-27656
PUBLISHED: 2020-10-29
Cleartext transmission of sensitive information vulnerability in DDNS in Synology DiskStation Manager (DSM) before 6.2.3-25426-2 allows man-in-the-middle attackers to eavesdrop authentication information of DNSExit via unspecified vectors.