Last Friday (March 6th, 2009) I posed the question above. What I got in return was nothing short of amazing, and to tell you the truth, it amazed me how the tally rounded out. I categorized the answers and counted them up (MANAGERS, listen up!):
(12 votes) – Security Fundamentals: This category involves the application of A/V, IDS/IPS, basic safe surfing techniques, least privilege use, and an understanding of phishing. It astounds me that this is at the top of the list. I grouped all of these answers together because they truly are the BASICS of Information Security. Why after all these years have managers of security professionals not gotten this drilled into them to the point of bleeding? What are we doing wrong?
(8 votes) – Targeting: “We aren’t a target”, “There isn’t anything on saying we are getting attacked”. This is another that surprised me to be at the top of the list. How can managers not think that 1. that they are a target, and 2. think that because there aren’t any alarms going off, they aren’t getting attacked?
(6 votes) – Passwords: Complexity, not using stickies, rotation, etc. I left this out of Security Fundamentals, because it’s not an easy beast to over come. It’s something that definitely needs to be addressed and a plan set down for the application, enforcement and technology behind it.
(6 votes) – Compliance and Policy: Everyone in this category made it abundantly clear that compliance to a standard does NOT mean that you are secure, but not at least making the compliance bar is worse. Internal policies need to be created to provide a stricter regimen then the compliance checklist demonstrates.
(5 votes) – Accountability: From basic user to CEO and Security Analyst. Accountability has many faces but it usually shows none of them in the security world. Users of the world learn quick when one of coworkers get restricted access because they clicked test phishing after they had just gone through phishing training.
(5 votes) – Defense In Depth: This is an old concept as well, but in recent years have been twisted to include DiD at host and network infrastructure level. The phrase Defense In Dept will continue to grow as the depths at which we can put protections on info systems grows. You need to realize that you ARE a target and you NEED to move with this evolution, not ignore it. Doing so doesn’t make it “go away”
(3 votes) – Users are stupid: I can’t believe that this even made it as an item. Managers, you seriously don’t understand that your weakest link on your network is the users?
(2 votes) – Data Layer Protection: Encryption. Even if the client data is stored on a super “secure” data node, that doesn’t mean somewhere between point A and point B isnt’ compromised. If it’s sensitive or secret, it needs to be treated as such at EVERY juncture where that data is transferred or can be accessed from.
(2 votes) – Risk Management: Managers, this is supposedly your specialty. Get back to it, they want you to be open to understand technically why this or that isn’t a threat.
(1 vote) – Company buy-in: I am truly surprised this didn’t make the top of the list. I personally think that company buy-in to security should precede the rest of the categories.
This is simply a top 10 list of things we as Security Professionals want you to know. It would not be hard to create training in your organization around these 10 categories. If you are a manager or one of us, get it started, make the slides and start getting these topics nailed down.
I have included the raw tweets from the poll so that you as managers can understand what your people want you to learn:
lorddrachenblut
passwords dont go on post it notes
taiyed
The importance of protecting client data with encryption.
oneeyedcarmen
Compliance != Security
clamasters – http://www.curtis-lamasters.com/
definitely not my quote but “If you can’t measure it, you can’t improve it” Put that into security terms and make sure he understands
techsnax – http://techsnax.blogspot.com/
that security means more than just passwords!
strcpy – http://strcpy.net/
that IDS is completely a flawed concept. Either that or firewalls are not an end-all solution for security.
tcrweb – http://tcrweb.wordpress.com/
That users are the weakest link, convenience and security don’t always mesh well _natron_ – http://blog.invisibledenizen.org/ /s/boss/client, layered security
armorguy – http://www.linkedin.com/in/martinjfisher
I’d be ecstatic if my boss understood defense in depth. “If we have A/V why do we need other endpoint products?”…
andywillingham – http://andyitguy.blogspot.com/
Management has to quit exempting themselves from security policies or others won’t buy into them
iamnowonmai
Classifying data in containers.
multimode – http://www.chromedpork.net/
Risk Management – Identifing the $ risk and priorization of tasks based on that risk.
l3d
defense in depth… But i don’t have this issue, thank god.
ilovegarick
I’d have all my co-workers understand not to open email attachments from unknown senders and not to forward them on either.
multimode -http://www.chromedpork.net/
And accuracy in the presentation of those risks to peer and upper management.
mortman
but !compliant == !secure
ramblinpeck
Ill replace boss with clients, but actually understanding AND using a real least privilege model would be great step for everyone
DFrain – http://www.brinkmasterj.com/
@ Compliance as well!
sintixerr – http://sintixerr.wordpress.com/
That security is only tangentially related to technology
multimode – http://www.chromedpork.net/
Becuase an unsuccesful phishing email is often put way higher on the list then patching critical infrastructure.
tnicholson – http://nicholsonsecurity.com/
That people (good/bad) are the weakest link regardless of policies or security related technology. Educate users about security!
cyberhiker – http://howisthatassuranceevidence.blogspot.com/
The parts of infosec that make you secure are not the parts that are sexy or come from a vendor.
post_break – http://iamthekiller.net/
The notion that forced password changes tend to be more of a security risk rather than a security method. (unless someone got fired)
cloudchaos – http://www.cloudchaos.com/
the need for a good password/phrases that are changed regularly. |
Techdulla – http://techdulla.wordpress.com/
That threats (specifically web threats) do not discriminate based on the size of your organization.
michaeldickey
Hard question, and worthy of a blog post. I’d say “You will have a security incident. Plan for it and plan to find it.”
RonW123
“If you have responsibility for security, but have no authority, your role is to take the blame when something goes wrong” Spafford
tottenkoph
The importance of email and Internet use policies, they’re usually overlooked by password policies. :/
jaysonstreet – http://f0rb1dd3n.com/
Just because there is no perceptible change does not mean you are not being attacked. The better your security the less they notice.
ChrisJohnRiley – http://www.c22.cc/
Security testing is all well and good, but not following through to fix the issues makes the process a pointless exercise.
MarcoFigueroa – http://www.mafcorp.net/
I would make my boss understand that spending less than 1% of the total gross of the company income on Security is unacceptable.
MarcoFigueroa – http://www.mafcorp.net/
This seems to be the norm, the ratio of percentage spent on security is always a huge difference in most companies.
dgeorghiou
Security is only as good as the system’s weakest link.
MarcoFigueroa – http://www.mafcorp.net/
@tnicholson We have a security awareness program. It makes them aware but they still get compromised. There excuse is I didn’t know!
ddahlen – http://www.poorboys.tv/
That even non-windows machines are vulnerable and targets for attack.
timmedin
Getting rid of the “we will never be a target” mentality
slick0 – http://www.basenetradio.net/
The importance of having an antivirus/antispyware solution in the office. I wish I were joking.
bug_bear
Antivirus is not a valid primary defense
lorddrachenblut
@slick0 and firewalls per machine
richardebaker
that one computer hooked to 2 networks is in fact a gigantic hole in the air gap security on a control net.
lbhuston – http://stateofsecurity.com/
One concept: That threats can be identified by transactions with non-real services, accounts and things.
CrucialCarl – http://www.dontpanictech.com/
(cool topic) my concept: Ignorance is not a valid defense and will not make you any less accountable.
danphilpott – http://fismapedia.org/
One security concept: Never believe what a sales person says, always get independent analysis.
lorddrachenblut
passwords dont go on post it notes
BrianWGray
the importance of PUBLISHED policies.
hmjgriffon
stop wrting your password on a sticky note on your monitor, and stop making it 123456
jodyfranklin – http://www.elder-n00b.org/
if you’re still compiling the list how about long passwd != strong passwd
JosephDawson – http://bitstop.ca/
get your client to understand one security concept fully… You can’t add security after…
curtw
within the context of the organization, I’d say the importance of executive representation and project approve/deny power.
Replies sent to CORE Security
ben_p – http://www.thegeekzone.com/
@CoreSecurity I would love for him to understand that security needs a budget. We have a lot of good ideas but no dedicated resources
ben_p – http://www.thegeekzone.com/
@CoreSecurity Actually, they get that but it’s the people above them (with the checkbook) that need that realization.
sonofshirt
@CoreSecurity That Red Teaming and auditing are not synonymous.
jason_nixon – http://jasonnixon.net/
@CoreSecurity Patch management is proactive requirement.
spinzon – http://www.scottpinzon.com/
@CoreSecurity One security concept: that the threat is real. Too much security is done to a compliance checklist. Take it seriously, boss!
steveshead
@CoreSecurity – that it only takes one ‘mistake’ to bring it all down!