Everyone wants information security to be easy. Wouldn't it be nice if it were simple enough to fit snugly inside a fortune cookie? Well, although I don't try to promote such foolish nonsense, I do on occasion pass on readily digestible nuggets to reinforce security principles and get people thinking how security applies to their environment.

Common Sense

I think the key to fortune cookie advice is ‘common sense' in the context of security. It must be simple, succinct, and make sense to everyone, while conveying important security aspects.

Here is my Fortune Cookie advice for November:

When it comes to employees and how securely they use their system, "trust, but verify".

We give them tools, harden their software, teach them good security practices, and reward them for safe behaviors. But end users may still cause great harm to their computers and more severely, the organizations data, systems, and operations. Trust must exist, but every security pro worth his salt, is paranoid with good reason.

It is not practical to wall out our own users. Some level of trust must exist. I believe the right balance for most organizations which maintain mature foundational controls, is to “trust, but verify”.

Made famous by former US President, Ronald Reagan, this quote was applied to situations where another party possesses the capability to do harm but agrees to refrain, for the greater good. Trust they will act appropriately, but maintain diligence to validate.

In the information security world, we too can strike the balance of security and functionality by allowing end users access to do their work effectively, while maintaining verification controls to insure they are not causing themselves or others unacceptable harm. This is no substitute to good training, security awareness, security tools, etc. as part of preventing undesirable events. But detection capabilities are a key element to a good defense in depth security program, which can allow more of a tradeoff between risk and productivity.

So am I contributing to the problem of over simplifying security? Or am I reaching out to those who might not take an inordinate amount of time necessary to understand the complexities and nuances of our industry? You decide and feel free to share your knowledge-nuggets.

Information Security Defense In Depth Whitepaper is Now Available

Fortune Cookie Security Advice - September 2008

Fortune Cookie Security Advice - August 2008

Fortune Cookie Security Advice - June 2008

Fortune Cookie Security Advice - May 2008

Deconstructing Cyber Security Attacks - Threat Model

Defense in Depth Information Security Strategy

Everyone wants information security to be easy. Wouldn't it be nice if it were simple enough to fit snugly inside a fortune cookie? Well, although I don't try to promote such foolish nonsense, I do on occasion pass on readily digestible nuggets to reinforce security principles and get people thinking how security applies to their environment.

Common Sense

I think the key to fortune cookie advice is ‘common sense' in the context of security. It must be simple, succinct, and make sense to everyone, while conveying important security aspects.

Here is my Fortune Cookie advice for September:

In information security, like in sports, knowing your adversary is far more important than knowing the condition of the field.

Information security is an adversarial pursuit. It all begins with threat agents, those people who will negatively affect your organization. Some are malicious, others are not. The key is they are living, breathing opponents whose motivations drive actions which cause loss. They learn, adapt, and change as they seek their objectives.

Know your threats. This is an important first step. Knowing all your vulnerabilities is fine, but secondary in importance.

For those who are malicious, understand what they target and the likely methods they will employ. Only then can the vulnerabilities be narrowed to show the most probable exposures. This prediction gives the security professional a focus on what to protect, how best to monitor, and preparations necessary to respond when needed.

So am I contributing to the problem of over simplifying security? Or am I reaching out to those who might not take an inordinate amount of time necessary to understand the complexities and nuances of our industry? You decide and feel free to share your knowledge-nuggets.

Fortune Cookie Security Advice - August 2008

Fortune Cookie Security Advice - June 2008

Fortune Cookie Security Advice - May 2008

Deconstructing Cyber Security Attacks - Threat Model

Defense in Depth Information Security Strategy

Recently, security expert Bruce Schneier expounded security ROI figures were meaningless! Is it true? Well, yes and no.

The brutal truth.

Well respected information security expert Bruce Schneier recently provided a stark opinion regarding the value of ROI's.

Follow this link to see the story:

http://www.zdnetasia.com/news/security/0,39044215,62037905,00.htm

In brief, Bruce stated security because numbers can be manipulated to justify anything.

He explained that the amount spent on a product can change significantly by simply playing with the equation.
"If the chance of you being attacked is one in a million and I change it to one in two million... I have halved the amount of money you should spend.
"I can make an ROI model say whatever I want. I could justify or not justify anything based on these very, very rare and very, very damaging events," he said.

Tell me it is not true!

I believe Bruce is both right and is delivering a message which is a little incomplete. His general message is accurate and shocking enough to garner the right level of attention. Most of the information security ROI's I have read were speculative, could not be validated, were impossible to reproduce, and had great latitude to provide results which benefit the desires of the author. Nowadays audiences are being provided ‘information' under the auspices of ‘fact', when in reality they are more of an opinion. Such valuation assessments are based on qualitative data versus quantitative metrics.

I blogged about the The Problem of Measuring Information Security back in August 2007

Awareness must be raised. I applaud Bruce in helping to make this happen. His message, as brutal as it sounds, is bringing to light a shadowy area in our industry. I think the follow-up message for audiences is to scrutinize and apply common sense to any ROI they come across. Understand the methodology and if it makes sense in their context. Lifting the curtain can quickly reveal a puppet master pulling the strings to artificially show value.

Like Bruce, I too have a jaded perspective. I have seen some WILD ROI's. Much of what I have read from security vendors is pure folly. However, just because most are fiction, it does not mean all methodologies are without merit.

Intel published a Whitepaper - Measuring the Return on IT Security Investments which is applicable to some situations. This method, far from being a silver-bullet, is a good start and has proven its truthfulness.

For any method, the accuracy should be scrutinized. Can it be validated, repeated? Was the method exclusively developed solely for self serving purposes from someone trying to sell something shiny? Does it make sense? These are the questions I ask myself.

On the bright side, many bright sharp people are working very hard to make the industry better and develop more rigid processes to insure both accuracy and confidence.

In the end, there is much work to be done in the information security valuation space. In the meanwhile, savvy consumers should be aware of the challenges and dive deeper into prospective ROI's and determine if they are ‘meaningless'.

I was recently asked to pull together a quick list of key information security learning's for Mergers & Acquisitions (M&A). This year I assumed responsibility for information security of Intel's M&A programs. M&A work is typically frantic, unpredictable, and ambiguous, involving the brightest engineering and integration management talent. It demands great flexibility and willingness to rapidly adapt creatively to emerging problems. This work is basically a recipe dreaded by us entrenched security types, who like the controllability of consistent, predicable, and structured activities. It can press the boundaries of good security practices and test the mettle of the strongest security organizations.

Top 5 Key Learning's for M&A Information Security

1. Security does not happen by default. As the complexities of divestitures emerge, smart people aggressively move to solve problems and security is likely not a consideration. Information Security must be involved both at the early planning stages and stay engaged until the last tactical maneuver is completed

2. Profiling the data is key. Knowing what data is involved, it's sensitivity, who has logical/physical access, and where it is physically located is necessary. It will be needed to insure regulatory, legal, and IP confidentiality protection

3. Technical and Behavioral considerations must be incorporated to prevail. Neither must be ignored, and in most cases the combination must be applied to every issue where information security is at risk. A security savvy M&A team is the first step to highly effective results

4. Logical and physical security aspects cannot be separated. Information security professionals can easily overlook the physical security factors which can jeopardize the confidentiality, integrity, and availability of the business just as logical based threats

5. Great attention must be paid to data retention, transfer, and destruction. ‘Deal data' can be a vague and changingconcept which may be interpreted differently over time, especially in larger deals. Understanding the scope, expectations, and commitments is a necessity

After reviewing the list, I had an interesting observation. It occurred to me there was a glaring omission. The unwavering support of information security by management is absolutely crucial. To be honest, I left it out as I am spoiled. The Intel culture and chain of management is very supportive of information security. So for those of you less fortunate, add it to the list.

Feeling a little M&A&D...or, blogging on IT aspects of Intel's mergers, acquisitions and divestitures programs

Measuring the value of information security programs is difficult and a problem for the entire industry. Come join us for a 3 part series discussing the challenges, how Intel is taking a practical approach, and where the future may take information security metrics.

Last week, Matthew Rosenquist & I discussed an actual Intel case study with Enrique Herrera. In this last of the three part series, we will discuss some practical approaches to determine the value of information security initiatives, including some future-looking ideas, and how security metrics might be implemented on a national scale.

The show is 30 minutes, starting tomorrow (June 4) at 10:30 PDT. To listen in, go to the OpenPort home page, and a little ways down on the left side you'll find the BlogTalk Radio link. Take that link and follow the instructions. You don't need an account to listen or participate in the discussion. If you can't make it live, you can also find the recorded sessions there too, after the show.

See you there!

Return On Security Investment - BlogTalk Radio

Wednesday, June 4, 2008

10:30 AM PDT / 1:30 EDT

http://communities.intel.com/index.jspa

Everyone wants information security to be easy. Wouldn't it be nice if it were simple enough to fit snugly inside a fortune cookie? Well, although I don't try to promote such foolish nonsense, I do on occasion pass on readily digestible nuggets to reinforce security principles and get people thinking how security applies to their environment.

Common Sense.

I think the key to fortune cookie advice is ‘common sense' in the context of security. It must be simple, succinct, and make sense to everyone, while conveying important security aspects.

Here is my Fortune Cookie advice for May:

Two types of victims exist...
Those with something of value, and those who are easy targets.
Therefore: Don't be an easy target, and protect your valuables.

Now if I can just figure out how to stuff these little cookies...

So am I contributing to the problem of over simplifying security? Or am I reaching out to those who might not take an inordinate amount of time necessary to understand the complexities and nuances of our industry? You decide and feel free to share your knowledge-nuggets.

Crazy as it may sound, digital appliances and accessories can infect your computers with viruses and worms. It is happening more and more. Although not near a tipping point, an evil cloud is rising.

Unlikely Threats

It is concerning enough we have to worry about USB drives, WiFi hotspots, mobile phones, PDA's, printers, email attachments, file downloads, search engines, and surfing just about any website. But now we must keep a suspicious eye on our new net-enabled refrigerator, digital picture frames, music playing sunglasses, and even the toaster.

Recent articles shows how consumer devices integrated with network enabled computers are sources for malware infections. It is not shocking software CD/DVD's, or USB Drives might have nasty code lurking. Suspicion is the norm anytime we are connecting or installing something directly to our trusty computer. In those situations, we take proper precautions. But what about media players, GPS devices, and most recently wireless digital picture frames? These devices may not directly connect via traditional cable. Does the average consumer realize when they flip the power button they may be turning on a wireless device infected with malware seeking to infect anything within range?

The toaster is out to get you!

It is not just the geek toys anymore. Not to long ago, an enterprising individual took it upon himself to hack a regular toaster, just to prove it could be a source of malware. A toaster! Very impressive, but what is next?

As computers are integrated into everything and are being upgraded with more power and connectivity, the threat landscape grows. Our cars, major appliances, personal electronics, accessories, and even clothing are potentially at risk. We are dragging these items into the digital world and in doing so, overlaying cyber risks on them.

Although not widespread, more and more stories are emerging and the list of products grows longer. At some point we will be forced to re-evaluate the standard threat categories to include some non-traditional vectors. Personally, I am waiting for shoe manufacturers to implant computers in their products so we can have "walk-by attacks". Can't wait.

Some news reference links:

http://www.securityfocus.com/news/11499

http://www.pcworld.com/article/id,141295-pg,1/article.html

http://www.theregister.co.uk/2008/01/14/sans_threat_list/

Intel IT developed a model for measuring Return on Security Investment (ROSI) in our manufacturing environments that produces a much higher level of accuracy than other methods currently available. Our model has enabled us to make business-driven decisions about security programs, resulting in savings in excess of USD 18 million per year in avoided losses.

Whitepaper now Available! Measuring the Return on IT Security Investments

Quantifying value for security programs is difficult at best. Intel successfully developed and employed a method to measure the value of security programs across our worldwide factories. Although not the silver bullet to measure all security programs, it does show in some circumstances, value can be quantified to the level needed to make sound business decisions.

This is one of many different methods which Intel leverages to determine value of security programs. The difference is being able to tie in hard numbers for prevented losses and the ability to predict future impacts with reasonable accuracy. Other available methods rely on more qualitative descriptions of value and lack a dollar and sense measure. Although no single methodology fits all situations, Intel has found a niche for this insightful metric which is an empowering view of security value.

Other related blogs:

Practical Aspects of Measuring Security

Getting a Return on IT Security Investment

Managing the Effort to Measure Security

The Problem of Measuring Information Security

The Four Dirty Questions of Measuring Information Security