Compliance or Information Security

Some in the information security field argue that compliance requirements like PCI and SOX are ultimately harmful to true information security, since it places so much of the focus on just meeting the requirements, rather than on really being secure.

While this may be true for a limited number of organizations, I am convinced that that most companies that only take a "checkoff" approach to these regulations would not have strong overall information security efforts even if the compliance requirements did not exist. In fact, I suspect that many of them would be doing much less in the area of information security.

I did have someone state that PCI worked against true security at one point, though I can't remember the precise argument now. I wasn't convinced then nor am I now. Some of the specific requirements may be squirrely, but the overall direction is great.

I do believe an organization with a strong information security practice would not have problems meeting related regulations. They may have to do a few more things, but strong information security will already be dealing with the related concerns.

I am not sure such an organization exists though, so this may just be a pipe dream!

Defense Has Value

It is quite common to here "defense is dead" when thinking of information security today. This trite phrase has some truth, but is also off target in some ways.

The idea of defending a single point and being "secure" is definitely dead, though it was really never alive in the first place.

The idea of improving defenses to the point that your network or enterprise is harder than others to attack is a worthwhile effort and remains quite alive.

Work on improving your defenses. Don't stop because a vendor promises a tool that is a "completely new approach". Solomon really was right, even when applied to information security. "There is nothing new under the sun." :)

Brad

Are the Threats Really Different?

I am currently watching a webinar about the current Internet threats. One thing that immediately jumps out to me is that it doesn't really seem all that different, just more of the same. We aren't watching actions on the systems with sensitive data sufficiently.

Everyone still wants a silver bullet, a single chokepoint where we can put defenses and relax. While this would be a great thing to have, it doesn't exist and we need to clue in and realize that.

This truth has been around for a long time, we are just now realizing it. It is quite common to hear "perimeter defense doesn't work anymore," but I am not sure it ever really did. It just blocked some low-level threats, which "worked" without really solving the problem. The low-hanging fruit is always going to be the simplest and easiest. What we consider "low-hanging" varies over time. Thus we will always be strengthening things, but it ultimately comes back to the same thing: Protecting systems with access to sensitive data. The methods will get better over time, Avoid mere vendor hype, realize this is a fact of our lives in the information security field.

Getting People to Think Securely

One of the most enjoyable parts of my previous work for a large airline was working on the security awareness efforts. While it was not as large as I would like, I did get to write up a monthly mini-article/hint/tip and I enjoyed finding ways to use real-life things to help readers be more secure in the things they did.

This did take more time than I think many realized and writing effective communications is often more like creating art than performing an engineering task. Finding the proper "muse" to express a meaningful point in the allowed space is a major challenge.

I would encourage all organizations that do not have any awareness efforts to at least start copying or creating some basic awareness articles. SANS has some great tips as do other sources.

Even small tips helping employees be safe in their own computer use can flow over to the workplace and make everyone more secure!

Brad

Viewing Information as an Asset

One of the most important principles underlying effective information security is to get those involved to see information as a valuable item. Even those of us who know this have to actively work to keep ourselves properly focused on this basic fact.

It is easy to get caught up with the methods and practices and forget the reason for what we are doing. The methods and practices are very good and necessary, but we need to make sure they are properly scaled (effort/cost/etc.) to the information they are aimed at protecting!

Learning Security and the iPad

I just purchased an iPad. You can see some quick comments in my companion blog here, but I wanted to comment in this blog about the interesting potential the iPad has for me as a learning tool, including in the field of information security. Its form factor makes it much easier to take with you or view in places a traditional computer or even laptop would not be as comfortable. I hope to be producing some tools, videos and other neat stuff in this area in the future. :)

Brad

The Value of Certifications

I see two basic camps in the security realm when it comes to certifications.

The first would include those with an alphabet soup behind their name. CISSP, CISM, CISA, GSEC, GIAC, GSE, CEH, CCNA, CCIE, etc. I suspect I could keep typing for days and not list them all. Organizations that promote these will definitely push that they add value and validate that the holder knows something of value to an organization and is worth more. This may or may not be true, but certifying organizations do make a substantial income on people maintaining their certifications, so they definitely have a vested interest in believing that certifications are valuable and promoting them.

I would note that I am not convinced that certifications are always a cash machine, but they do fund the employment of many people, so the amounts are significant. Those people are probably needed for solid certification programs. This means that large sums are involved in the process, whether or not those involved make a lot of money personally.

The other end of the spectrum argues that certifications are completely worthless and work experience is all that matters. They often look in disdain on those with certifications. They tend to view certifications as creating "paper tigers," people who can pass a test, but who don't really know much practically. I suspect having a certification is a bad thing if one of these people is in charge of the hiring process.

What spurred me thinking on this again was an OWASP podcast with Mark Curphy. (Yeah, I am a little behind - the show was from last July.) He expressed the second view and seemed to disdain certifications in general.

I am more in the middle of both camps and see merit in both positions. I have personally acquired many certifications because I felt like it, not because I wanted some letters to add to my name. Even though experience is still more valuable, I would rate my M.S. in C.S. from Illinois as more valuable than them all (along with a B.S. in C.S. from their Engineering College) as far more valuable, since it laid a firm groundwork for all the many things I have dug into.

That said, my certifications, especially the SANS ones I hold (GSEC, GCFW, GCIH, GCIA, GPCI) helped me really master the material in this area. My background is more in programming/development than system administration, so having to have studied the material for those courses has helped me absorb a lot more than I would have with just reading a book. Of course I need to put things to practice, but that is true of anything.

My main point would be to not worship certifications, but don't disparage them out of hand either. Don't get any if you don't see the need, but don't automatically assume someone with several is really incompetent either!