Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

8/7/2019
07:45 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Black Hat 2019: Security Culture Is Everyone's Culture

In his Black Hat USA keynote, Square's Dino Dai Zovi discussed lessons learned throughout his cybersecurity career and why culture trumps strategy.

BLACK HAT USA 2019 – Las Vegas – Cybersecurity no longer has to worry about getting attention, said Black Hat founder Jeff Moss in his introduction to the keynote that kicked off the conference's twenty-third year. Business management and political leaders recognize the importance of security; now, the infosec community must learn how to handle the spotlight.

"Not only have we got the attention, we're struggling with what we do with it – how we communicate," said Moss of the industry's present-day challenge. "The quality of communication now determines a lot of our outcomes." And while communications problems can be fixed, Moss said, doing so will require reordering the way we think and convey ideas.

His sentiment was echoed in the keynote by Dino Dai Zovi, head of mobile security at Square, who spoke about lessons learned in his career that emphasize the weight of security culture. At a time when every company is driven by software, the responsibility of security goes far beyond one team. Software teams must own security just as security must also focus on software.

Dai Zovi illustrated this idea with the story of when he started working at Square, a time he referred to as "my unfrozen caveman hacker period."

"I had no idea the depth of things I didn't know," he said.

One of those things was a cultural shift: At Square, unlike other firms, security engineers had to code like everyone else. "Because the security team wrote code like the rest of the company, there was a lot more collaboration," Dai Zovi explained. "That, I think, was really powerful."

It was one of many lessons he learned that changed the way he viewed how security influenced an organization. In his keynote, Dai Zovi outlined three additional principles for attendees to consider.

Work Backward from the Job
Before a security team can start on a project, it must first talk to internal customer teams to better understand why they're doing it in the first place. Security pros must first understand the business' struggles, what is easy for them and what adds friction, and when and why they "hired" security to do something. What are their hiring criteria? What is important to them? Just as significant is their firing criteria. What would cause them to seek an alternative solution?

"You can think about everything security does as offering a product or service to the rest of the company," Dai Zovi said. Asking these questions helps ensure security adds value rather than implements a tool or service that people didn't ask for, don't need, and likely won't use.

Seek and Apply Leverage
Many cybersecurity experts have a deep pride in being subject matter experts, Dai Zovi said, describing his second point. But this typically small group of people can have a broad impact.

"There's not enough of us," he explained, pointing to fuzzing as an example of how automation can help scale security. Making fuzzing easier for developers drives the benefit, he added, because there are more developers than there are security pros.

Dai Zovi also emphasized the importance of feedback loops. Cybercriminals have natural feedback loops; they immediately know whether things work or don't work. Defenders have to explicitly build their feedback loops, but if they do this right, they can measure attackers probing their systems, identify them learning, see them hacking, and see when they succeed.

Culture > Strategy > Tactics
"Culture is way more powerful than strategy, which is way more powerful than tactics," Dai Zovi stressed. Both operations and developers enable the business, and the business requires change. "We must allow change to happen," he added.

Businesses should move toward a model where risks are shared. Instead of security being security's job alone, organizations that can reinforce security is everyone's job can adopt a more risk-sharing culture. This is the environment Dai Zovi described at Square, where developers would write new features and go to the security team for feedback and guidance. Instead of being perceived as the "no" department, security can share their responsibility.

"Instead of saying 'no,' start with 'yes' and say, 'This is how I can help,'" Dai Zovi advised. This mindset can drive collaboration with other departments rather than isolating the security team.

"If we can create security culture change in every team, we can scale way more powerfully than we can if security is only our responsibility," he said.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19040
PUBLISHED: 2019-11-17
KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"<script>' substring.
CVE-2019-19041
PUBLISHED: 2019-11-17
An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade package before processing it. As a result, official upgrade packages can be modified to inject an arbitrary Bash script that will be executed by th...
CVE-2019-19012
PUBLISHED: 2019-11-17
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or ...
CVE-2019-19022
PUBLISHED: 2019-11-17
iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git r...
CVE-2019-19035
PUBLISHED: 2019-11-17
jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSections and process_SOFn in jpgfile.c. The attack vector is: Open a specially crafted JPEG file.