Jun 20 2015
Leave a comment
Blog Posts

The MSSP Is the New SIEM

In the last year, I’ve come to a realization about incident management. In most cases, buying a SIEM is a waste of money for the enterprise. The software and licensing cost isn’t trivial, some of them utilizing what I like to call the “heroin dealer” or consumption licensing model. The first taste is free or inexpensive, but once you’re hooked, prepare to hand over your checkbook, because the costs often spiral out of control as you add more devices. Additionally, for most small to medium organizations, the complicated configuration often requires a consulting company to assist with the initial implementation and at least one full-time employee to manage and maintain. Even then, you won’t really have 24×7 monitoring and alerting, because most can’t afford a large enough staff to work in shifts, which means you’re dependent upon email or text alerts. That’s not very useful if your employees actually have lives outside of work. Most often, what you’ll see is an imperfectly implemented SIEM that becomes a noise machine delivering little to no value.

The SIEM’s dirty secret is that it’s a money pit. Once you add up the software and licensing cost, the professional services you spend to get it deployed and regularly upgraded, the hardware, the annual support cost, and staffing, you’re looking at a sizable investment. Now you should ask yourself, are you really reducing risk with a SIEM or just hitting some checkbox on a compliance list?

Alternatively, let’s look at the managed security service provider (MSSP). For a yearly cost, this outsourced SOC will ingest and correlate your logs, set up alerts, monitor and/or manage devices 24×7, 365 days a year. An MSSP’s level-1 and level-2 staff significantly reduce the amount of repetitive work and noise your in-house security team must deal with, making it less likely that critical incidents are missed. The downside is that the service is often mediocre, leaving one with the sneaking suspicion that these companies are happy to employ any warm body to answer the phone and put eyeballs on a screen. This means that someone has to manage the relationship, ensuring that service level agreements are met.

While there are challenges with outsourcing, the MSSP is a great lesson in the economy of scale. The MSSP is more efficient in delivering service because it performs the same functions for many customers.  While not cutting-edge or innovative, the service is often good enough to allow a security team to focus on the incidents that matter without having to sift through the noise themselves. The caveat? While useful in the short-term, security teams should still focus on building proactive controls with automation and anomaly detection for improved response. After all, the real goal is to make less garbage, not more sanitation workers.

Tagged , , , ,
Jun 19 2015
Leave a comment
Blog Posts

Tootsie Roll Pop Security

Recently, it occurred to me that the security of most organizations is like a Tootsie Roll Pop. Hard and crunchy on the outside, soft and chewy on this inside. One bite and you easily get to the yummy center.

How many licks does it take to get to the crown jewels of your organization: your data?

Tagged , , , ,
Jun 18 2015
Leave a comment
Blog Posts

The Security Policy’s Bad Reputation

I had a disturbing conversation with a colleague last night. He told me that he didn’t believe in compliance-only, checkbox security, so why should he waste time on policies and standards? I almost blew a gasket, but because he’s pretty junior, I thought it best to educate him. The following is a summary of what I told him.

Security policies and standards are a foundational set of requirements for your engineering, development and operations teams. Without these boundaries, the entire IT organization floats aimlessly, buying solutions and implementing controls without rhyme or reason. Generally, only oblivious technologists design solutions without referencing policies and most engineers are begging for this guidance from their security teams.  Engineers aren’t mind readers, they just want us to tell them what we want: in writing.  Without policies and standards, the result is reactive inefficiency, because the security team becomes a chokepoint for every implementation.

Security policies help keep organizations ahead of the risk curve. It means that risk has been evaluated to some degree and a decision made (by someone) regarding the level an organization is willing to accept. Any security organization that wants to achieve some level of maturity will spend the cycles to develop its policies or suffer the consequences.

Developing policies and standards isn’t an easy process. Often the right stakeholders haven’t participated in the discussion, the documents are badly written, outdated or compiled by consultants with no organizational context. Moreover, policy debates often degenerate into arguments over semantics, but the how of getting this done isn’t as important as simply getting it done.

Ultimately, when security professionals don’t create and maintain policies and standards, they have abdicated their responsibility to the organization that employs them.

Tagged , , , , ,
May 30 2015
3 Comments
Blog Posts

Security and Ugly Babies

Recently a colleague confessed his frustration to me over the resistance he’s been encountering in a new job as a security architect. He’s been attempting to address security gaps with the operations team, but he’s being treated like a Bond villain and the paranoia and opposition are wearing him down.

It’s a familiar story for those of us in this field. We’re brought into an organization to defend against breaches and engineer solutions to reduce risk, but along the way often discover an architecture held together by bubble gum and shoestring. We point it out, because it’s part of our role, our vocation to protect and serve. Our “reward” is that we usually end up an object of disdain and fear. We become an outcast in the playground, dirt kicked in the face by the rest of IT, as we wonder what went wrong.

We forget that in most cases the infrastructure we criticize isn’t just cabling, silicon and metal. It represents the output of hundreds, sometimes thousands of hours from a team of people. Most of whom want to do good work, but are hampered by tight budgets and limited resources. Maybe they aren’t the best and brightest in their field, but that doesn’t necessarily mean that they don’t care.  I don’t think anyone starts their day by saying, “I’m going to do the worst job possible today.”

Then the security team arrives on the scene, the perpetual critic, we don’t actually build anything. All we do is tell the rest of IT that their baby is ugly. That they should get a new one. Why are we surprised that they’re defensive and hostile? No one wants to hear that their hard work and long hours have resulted in shit.

What we fail to realize is this is our baby too and our feedback would be better received if we were less of a critic and more of an ally.

Tagged , , , ,
May 25 2015
1 Comment
Blog Posts

Are You Trying To Improve Security or Just Kingdom Building?

I’m a huge Seth Godin fan. Technically, a marketing guru, but he’s so much more than that. His wisdom easily applies to all facets of business and life. A few days ago, I read a post of his, “But do you want to get better?”

…Better means change and change means risk and risk means fear. So the organization is filled with people who have been punished when they try to make things better, because the boss is afraid.

I wonder if Godin ever worked in Information Security.

Some days it seems as though the practice of Infosec is more about how it sounds and looks to outsiders and very little about actual reduction of risk. Most of the time, real improvement to an information security program doesn’t arise from exciting changes or innovative new tools. It often comes from making better policies, standards and procedures. It could mean that you really don’t need five extra staff members or a Hadoop cluster. Maybe it means you learn to operationalize controls, automate and collaborate better with your peers in apps and infrastructure. Worrying less about kingdom building and more about what helps the organization.

But this kind of change is a gargantuan shift in the way many infosec leaders operate. Often, they’re so busy cultivating FUD to get budget, they can’t or won’t stop to ask themselves, “Do I want to make it better?”

Tagged , , ,
May 02 2015
Leave a comment
Blog Posts

I’m a Doctor, Not a Security Expert!

While I don’t completely agree with the Rob Ragan’s sentiments in a recent article in Dark Reading on the limitations of security awareness training, I think the writer makes some good points, especially regarding the appropriate use of technical controls in combination with training to mitigate risk. I love the quote he includes from Adrienne Porter Felt from the Google Chrome Security Team:

 “…users are neither stupid nor lazy. They are musicians, parents, journalists, firefighters — it isn’t fair to also expect them to become security experts too. And they have other, important things to do besides read our lovingly crafted explanations of SSL. But they still deserve to use the web safely, and it’s on us to figure out that riddle.”
This was prevalent in my mind as I assisted my Luddite physical therapist last night in resetting her AOL password. She couldn’t get into her account for an entire day, all because a “security feature” locked her account for suspicious activity. Basically, she bought a new iPad and entered her complex password incorrectly multiple times. But because she used IMAP to connect to her account from her laptop, she had no way of knowing that the account had been locked and didn’t understand how to use the UI. So I did the unthinkable: I requested an account reset, then logged into the Gmail account she uses for account recovery and gave her the new password I created for her AOL account. She thanked me and told me how much harder my job was than hers, and that she would never do it. And this admiration was all predicated upon my resetting her password. Supposedly, one of the most trivial activities in IT. Any user should be able to do this, right?
Earlier this week, my team received a request to allow a user to install the Fitbit application on her company-owned system. It prompted an esoteric discussion on the security of the Internet of Things and the Quantified Self. I recommended that we approve the request and said, “Why are we even having this discussion? We’re an organization that has an employee wellness program and we’re wasting precious resources discussing whether or not this application increases organizational risk? We have approved applications that are more dangerous, such as Java, Adobe Flash and Internet Explorer.”
Why are we still so disconnected from our users, making user interfaces that are too complex, byzantine security procedures and arcane policies?
I'm a doctor, not a security expert!
Tagged , , , ,
Apr 03 2015
Leave a comment
Blog Posts

BYOD: Pervasive Computing Has Arrived

A good tool is an invisible tool. By invisible, I mean that the tool does not intrude on your consciousness; you focus on the task, not the tool. Eyeglasses are a good tool — you look at the world, not the eyeglasses. The blind man tapping the cane feels the street, not the cane. Of course, tools are not invisible in themselves, but as part of a context of use. With enough practice we can make many apparently difficult things disappear: my fingers know vi editing commands that my conscious mind has long forgotten. But good tools enhance invisibility. – Mark Weiser, August 16, 1993

Often, I’m at odds with others in the security community over some of the positions I espouse.  My support of BYOD is one of them. While I see the risk in allowing users to bring their own devices to work, my experience in the enterprise has convinced me they’re already doing it, whether or not the IT department officially supports it. So we might as well accept the inevitable and start to work out the ground rules with each other.

Besides, isn’t this a good thing for information technology and society? We are seeing the fruition of Mark Weiser’s work in Ubiquitous or Pervasive Computing at Xerox PARC with the Internet of Things and a flourishing mobile device marketplace. I was drawn to IT in order to solve problems, not drown in the minutia of attack scenarios. Unfortunately, many security professionals can’t see beyond the vulnerabilities and spend most of their time pissing on everyone’s parade.

Regardless, I’ll continue to write and teach on the topic, because I think it’s important to collaborate with the business and the other sectors of IT to find solutions. Towards that end, I’ve written a piece for Dark Reading about tackling that difficult beast, BYOD.Spock does BYOD

Tagged , , , , , , ,
Mar 25 2015
1 Comment
Blog Posts

Failing Security Kindergarten

Now with APT detection and automated analysis to instantly identify cyber attacks!*

I’m fascinated by the continuously evolving hype-fest surrounding the latest “innovations” in security products. Not that our current methods couldn’t use some creative approaches, but the problem is that security leadership often gets dazzled by feature road maps that have as much substance as the wisps of smoke from a genie’s bottle. The media isn’t much help, often accepting the industry’s claims with little to no validation. Inevitably, organizations surrender to the glittering new toy, sinking their precious cash into something they thought would magically restore their faith in security. Then the harsh reality hits and they realize that the only impact the tool had was on their budget, failing to improve their security posture by even an angstrom. This is how organizations fail security kindergarten.

Most enterprises would be better served by investing in the ABCs of security: documentation, policy, procedures, and essential controls. I’m mystified by organizations that will invest over 500k in fancy breach detection systems, but won’t spend a dime on centralized log correlation. The sad truth is that the basics aren’t sexy. It’s hard to “sell” critical security controls such as account monitoring, data classification and handling standards when the news is filled with stories of China hacking health insurance companies. Maybe security professionals could make more of an impact by dropping the FUD and educating leadership about the necessity of having a solid foundation. Sprinkles are great, but they don’t mean much without a tasty doughnut underneath. Besides, sprinkles are for winners.donut

*An actual line from a security vendor’s web site.

Tagged , , ,
Mar 02 2015
Leave a comment
Blog Posts

Security Theater of the Absurd

“The tears of the world are a constant quantity. For each one who begins to weep somewhere else another stops. The same is true of the laugh.”  – Waiting for Godot

In Samuel Beckett’s infamous absurdist play, Waiting for Godot, characters engage in pointless dialog and activity while waiting for an eponymous fellow who never arrives.  I’ve always found it a tedious piece of literature, barely staying awake through the second act, which seems to exist solely for the purpose of torturing its audience. But isn’t despair the point of Theater of the Absurd?

Recently, I’ve come to realize that this play represents a perfect analogy for the daily grind of information security work. Lots of preparation for that big breach that may or may not arrive during your tenure. It often feels like the height of absurdity, going through the motions just like the two main characters, Vladimir and Estragon. Often, being in information security feels like a slow simmer of stress, sapping your energy and engagement, overwhelming you with the minutia of operational tasks: malware remediation, vulnerability management, compliance initiatives. It’s an endless exercise of cycling through superstitious behaviors that may or may not result in the reduction of risk, like throwing salt over your shoulder to keep the Devil away.

Theatrical critics have spent decades bickering over the play’s meaning, which only pales in comparison to how much information security professionals argue about how to accomplish their goals. In the end, it doesn’t really seem to matter. Organizations continue to disagree about the implementation of security controls to reduce risk; they’re breached, blaming the current leadership. A fresh team is brought in and the cycle begins again, like some reincarnation of Sisyphus rolling a stone up the hill only to be crushed by the weight of inevitable failure.

“There’s man all over for you, blaming on his boots the faults of his feet.” – Waiting for GodotDirty_boots

Tagged , , ,
Mar 01 2015
1 Comment
Blog Posts

Does IT Security Matter?

A few months ago I came across an article by Nicholas Carr called, “IT Doesn’t Matter.” It was published by the Harvard Business Review in what seems like the Paleolithic era of 2003, but I was shocked by its relevance. At the time, it caused quite a controversy with many mocking Carr’s predictions, but with ever-increasing outsourcing and the commoditization of compute, it seems even more relevant. If you’re working in any sector of IT today, then you’ll find many of his ideas shockingly prescient.

In the article, he manages to call out IT on it’s over-inflated ego, its annoying self-importance and tunnel-vision with regards to the rest of the business. Twelve years later, IT still manages to create an idolatrous following among staff, convincing senior leadership that it’s central to an organization’s strategy, even as it continues to fail the business.

It’s a reasonable assumption, even an intuitive one. But it’s mistaken. What makes a resource truly strategic – what gives it the capacity to be the basis for a sustained competitive advantage – is not ubiquity but scarcity. You only gain an edge over rivals by having or doing something that they can’t have or do. By now, the core functions of IT – data storage, data processing, and data transport – have become available and affordable to all. Their very power and presence have begun to transform them from potentially strategic resources into commodity factors of production. They are becoming costs of doing business that must be paid by all but provide distinction to none.

…as their availability increased and their cost decreased – as they became ubiquitous – they became commodity inputs. From a strategic standpoint, they became invisible; they no longer mattered. That is exactly what is happening to information technology today, and the implications for corporate IT management are profound.

However, the part of the article that really caught my attention was where he points out that IT actually increases organizational risk.

When a resource becomes essential to competition but inconsequential to strategy, the risks it creates become more important than the advantages it provides. Think of electricity. Today, no company builds its business strategy around its electricity usage, but even a brief lapse in supply can be devastating (as some California businesses discovered during the energy crisis of 2000). The operational risks associated with IT are many – technical glitches, obsolescence, service outages, unreliable vendors or partners, security breaches, even terrorism – and some have become magnified as companies have moved from tightly controlled, proprietary systems to open, shared ones. Today, an IT disruption can paralyze a company’s ability to make its products, deliver its services, and connect with its customers, not to mention foul its reputation. Yet few companies have done a thorough job of identifying and tempering their vulnerabilities. Worrying about what might go wrong may not be as glamorous a job as speculating about the future, but it is a more essential job right now.

Sound familiar?  Consider some of the recent breaches such as Target, Home Depot and Sony. This presents an odd contradiction, as IT becomes less relevant to business strategy due to its ubiquity, information security becomes more critical.

But Information Security will only deliver value if it understands context. I consider this as I recall recent conversations I’ve had with other security professionals in which they lament how misunderstood they are and how little the business appreciates what they do. The problem is that many don’t respect the people who generate the revenue allowing them to have jobs. Often they’re so busy focusing on the minutia of finding vulnerabilities and exploiting them, that they can’t pull back to understand that this only delivers value if it helps to reduce overall risk to the organization.

Tagged , , ,
Newer posts →