In this post we deal with habit 1: Be Proactive
Please first read The Seven Habits of Highly Effective Security Plans [Part 1]
Please first read the Seven Habits of Highly Effective Security Plans [Part 2]
This is based on Stephen Covey's book The Seven Habits of Highly Effective People and in this post we look at how being proactive can help raise the general security of an organisation. This is applicable from a micro 1 person business to a multi-national company.
Being proactive really translates into taking ownership. There is a general feeling that Information Security is someone else's problem - usually IT. The thing is that even IT shelve the responsibility onto technology such as Firewalls, Antivirus and IDS boxes.
It has taken legislation in the United States and Europe (not so much in South Africa yet) to put Information Security risk back where it should be - the Business and by "Business" I mean non-IT people. Is this fair? Sure, it is their data and they must protect it from getting lost. Security is there to help and IT is there to make sure that the technology is there but at the end of the day if a spreadsheet with financial information goes missing - it is the department that owns the spreadsheet that is going to suffer.
Of course, all the three camps can be proactive. InfoSec can, should, must promote awareness of Security. They need Business and IT to understand what the dangers are and what is expected from a regulatory point of view. Posters, education, emails, etc etc can all be done.
IT can help by telling InfoSec of incidents that they may find, by making systems secure from the start, from being enthusiastic about patching and hardening servers and helping out with standards that are secure.
Business can be aware that it is information they use everyday that IT and InfoSec are protecting and the protection is for them so they can do their work more effectively which is what business is all about. They should strive to understand the tools that they use and how to use them securely. Strong passwords, clean desk policy, locking workstations, locking offices, thinking twice before opening strange files are all things that can be done for free and together are far more effective than anti virus, firewalls and NAC.
It is difficult to get the inertia going and people are reluctant to change but it is important to at least start working on a culture where information is seen as an important asset is protected as such.
I think this is lot more productive than playing each part of the business off against each other.
Showing posts with label IT. Show all posts
Showing posts with label IT. Show all posts
Friday, September 21, 2007
Thursday, August 16, 2007
The Wall Street Journal Followup
Since my posting on the 7th, the Wall Street Journal has posted a follow-up article here
It is by the same author who obviously was not aware of my post because she gets most of it wrong again. She chose to ignore Andy's input too. I found out about this follow-up from his Blog,thank you Andy.
My original post basically pointed out the main problem in her article which is that the Information Security policies that she is showing how to bypass are not made up by IT but by the security department. More to the point, they are signed off by upper management and by breaking them you can get into serious trouble with the Boss. Failing that the Boss himself may get into serious trouble with the law.
The author writes in this article about how "IT workers said they get blamed both by employees who feel too restricted and by company executives who, when things go wrong, fume that policies must not have been restrictive enough."
At the end of the day its not the It Guys who should be enforcing security, they have enough on their plates. It is business people themselves who should be enforcing the rules.
The IT department is usually the least respected department, it hires young people who don't know the art of dealing with people, especially those in upper management. More importantly - they are enablers. They fix things and make things work and that is how they are rated. They are also clueless (or they should be anyhow) about what information is important anyhow.
What about the fools in the Information Security department I hear you ask. They are there to make sure that Information Security is done, yes. But, at the end of the day neither them nor the IT guys will be in big trouble if Information is lost or leaked. Or wrong decisions are made using altered documents. It will be Business that pays. So, why have these lazy Information Security guys around in the first place? Really, its to inform the business people and to help them with implementing security.
If your staff are knowingly breaking rules that you have put in place... well... no Firewall, IDS or Antivirus or amazing CISSP is going to save your data.
I think that the WSJ has missed an opportunity to push the idea that Information Security is important and that the rules are there for a reason and that breaking them will not only upset the guys in IT but can make an employee lose the respect of his/her employers and possibly even his/her job.
It is by the same author who obviously was not aware of my post because she gets most of it wrong again. She chose to ignore Andy's input too. I found out about this follow-up from his Blog,thank you Andy.
My original post basically pointed out the main problem in her article which is that the Information Security policies that she is showing how to bypass are not made up by IT but by the security department. More to the point, they are signed off by upper management and by breaking them you can get into serious trouble with the Boss. Failing that the Boss himself may get into serious trouble with the law.
The author writes in this article about how "IT workers said they get blamed both by employees who feel too restricted and by company executives who, when things go wrong, fume that policies must not have been restrictive enough."
At the end of the day its not the It Guys who should be enforcing security, they have enough on their plates. It is business people themselves who should be enforcing the rules.
The IT department is usually the least respected department, it hires young people who don't know the art of dealing with people, especially those in upper management. More importantly - they are enablers. They fix things and make things work and that is how they are rated. They are also clueless (or they should be anyhow) about what information is important anyhow.
What about the fools in the Information Security department I hear you ask. They are there to make sure that Information Security is done, yes. But, at the end of the day neither them nor the IT guys will be in big trouble if Information is lost or leaked. Or wrong decisions are made using altered documents. It will be Business that pays. So, why have these lazy Information Security guys around in the first place? Really, its to inform the business people and to help them with implementing security.
If your staff are knowingly breaking rules that you have put in place... well... no Firewall, IDS or Antivirus or amazing CISSP is going to save your data.
I think that the WSJ has missed an opportunity to push the idea that Information Security is important and that the rules are there for a reason and that breaking them will not only upset the guys in IT but can make an employee lose the respect of his/her employers and possibly even his/her job.
Tuesday, August 7, 2007
The Wall Street Journal only got one (major) thing wrong.
The Wall Street Journal, published by Dow Jones & Company published an article that had a few of my peers quite upset.
Particularly upset was my brother-from-another-mother Andy the IT Guy. I call him that because although we are thousands of miles apart we have similar jobs and usually see eye to eye on matters. His post on the issue is here. In the post he links to other bloggers who rip the article to shreds.
I leave it up to the dedicated reader to follow all the links and get acquainted with the article and see why it has upset Andy and several others. Go do that now...I'll wait...
...
If you are reading this I hope you clicked the above links and read up on the issue...here comes my 2c.
The article got it exactly right except for 1 major issue and it is in the title!
It is not the IT department that is trying to stop you doing all of those things, it is the security department.
In fact, in most companies if you are quick (and you have to be quick) you'll see that IT guys are the guys who break the rules the most. Find the geek with the long black coat and chances are he is the guy running the phantom MP3 server that everyone knows about but doesn't exist.
Now that that is cleared up, you may ask: so what? Information Security department...IT department..who cares? But it does make a difference. IT has a mandate from Management to keep the servers humming and the information flowing - thats their job in a nutshell.
Information Security has a mandate from Management to make sure that the company does not leak information and does not break the law. The Information Security guys are also not the ones who make the rules, they may make suggestions but the guys who sign off the policies and rules are Management (read: your boss, his boss, etc etc up to the CEO). The rules you are breaking are the rules set down not by IT but by your boss.
Some of the rules (such as rules 1,2,3) are actually made to stop the top level guys from going to jail or at least to stop the company from being at the receiving end of some expensive legal problems. You can be sure that they would not take kindly at having these rules broken.
Obviously I am all for freedom of the press but just know who sets the rules and who signs off on them - its not IT.
Thursday, March 15, 2007
Instant Virtual Machines
We all agree that INFORMATION is the important stuff.
Computers are there to basically make the information look good. Networks are there to move it all about to where (in theory) it is most useful.
Computers are not just all about presentation, they also mold data into useful information and other neat things. But its the Information that is king. That is why the general term for people that work with computers is "Information Technology".
So, why is everything we do there to protect computers? And networks.
If a computer is compromised - kill it. Stick another in its place. Instantly.
The technology is available to do this. But I haven't seen people use it.
Is it being used?
The way to do this is to keep the data on a separate drive to the applications (like Unix has always advised - welcome to the 70s, again) and if there is any doubt - kill the machine. And pop a fresh install in its place.
My 2c.
Computers are there to basically make the information look good. Networks are there to move it all about to where (in theory) it is most useful.
Computers are not just all about presentation, they also mold data into useful information and other neat things. But its the Information that is king. That is why the general term for people that work with computers is "Information Technology".
So, why is everything we do there to protect computers? And networks.
If a computer is compromised - kill it. Stick another in its place. Instantly.
The technology is available to do this. But I haven't seen people use it.
Is it being used?
The way to do this is to keep the data on a separate drive to the applications (like Unix has always advised - welcome to the 70s, again) and if there is any doubt - kill the machine. And pop a fresh install in its place.
My 2c.
Tuesday, March 13, 2007
Temet Nosce and the quest to put auditors where they belong
"γνῶθι σεαυτόν" "Know Thyself". As Neo found out when he went to visit the Oracle.
In an industry where "proactive" is the biggest buzzword it seems to me that we in the Information Security field are not doing so well.
From observations in the industry I have noticed a trend to allow Auditors to dictate what needs to be done (and in turn - point out what is not being done). In some companies what the auditors say should be done is all that gets done.
This is very different to how the Accounting profession works. The books get drawn up, approved by management and then only do the Auditors come through and approve them. Note the difference - here the Accountants decide what and how things should be done and the auditors just see if they are done. And management is involved.
It may be that management sees us as IT "guys". They may not think of us very highly and they may believe that the Auditors are great and all knowing. In my experience the auditors have come across as being very knowledgeable (even though I have had some good laughs at some audit findings). They usually arrive with ties and jackets and shiny shoes. And checklists and boring looking software. And they are backed by international auditing firms that have Ways Of Doing Things.
Us guys are lumped with IT. We are told what the auditors found wrong and told to fix it - that is how IT works. This is what needs to change.
Even many people involved in Information Security over emphasize the importance of Auditors. Here in South Africa and (it seems - abroad). I've noticed a number of American bloggers trying to push Information Security as a goal and compliance as a result. This fits into the same concept.
We need to be proactive and tell Auditors: this is what we do, this why. And slowly change perceptions and become guides to our organisations.
But first, we have to understand who we are and know what we do.
Temet Nosce.
In an industry where "proactive" is the biggest buzzword it seems to me that we in the Information Security field are not doing so well.
From observations in the industry I have noticed a trend to allow Auditors to dictate what needs to be done (and in turn - point out what is not being done). In some companies what the auditors say should be done is all that gets done.
This is very different to how the Accounting profession works. The books get drawn up, approved by management and then only do the Auditors come through and approve them. Note the difference - here the Accountants decide what and how things should be done and the auditors just see if they are done. And management is involved.
It may be that management sees us as IT "guys". They may not think of us very highly and they may believe that the Auditors are great and all knowing. In my experience the auditors have come across as being very knowledgeable (even though I have had some good laughs at some audit findings). They usually arrive with ties and jackets and shiny shoes. And checklists and boring looking software. And they are backed by international auditing firms that have Ways Of Doing Things.
Us guys are lumped with IT. We are told what the auditors found wrong and told to fix it - that is how IT works. This is what needs to change.
Even many people involved in Information Security over emphasize the importance of Auditors. Here in South Africa and (it seems - abroad). I've noticed a number of American bloggers trying to push Information Security as a goal and compliance as a result. This fits into the same concept.
We need to be proactive and tell Auditors: this is what we do, this why. And slowly change perceptions and become guides to our organisations.
But first, we have to understand who we are and know what we do.
Temet Nosce.
Wednesday, March 7, 2007
Fools to the left of me....
I've been working hard at work. And I've neglected this blog. It started off with a bang and now it is fizzling. So, here is a tidbit I came up with a while ago.
This may be obvious to some and hopefully it will be obvious once you have read the post but it when I came up with this idea it took a lot of thinking and a lot of convincing to all around me that this is how it works.
Please note that this does not necissarily represent the company I work for, the company I am contracted to or any other company living or dead blah blah blah. Its hopefully applicable to ALL businesses.
Lets begin.. businesses sell stuff. They either sell services or products but with nothing to sell they are not really all that useful, ask Enron.
Traditionally there have been two camps of people in businesses - users of information and the guys who make sure that the information gets to where it needs to be. You could call them "Business Decision Makers" and "IT".
Business Decision Makers could be anyone in the company from the CEO to the receptionist, etc
In terms of the CEO think "how many widgets did we sell this week?" For the receptionist it is "What is Jack from Accounts number so I can put this call through".
I call these people "Those that do not know" because they have no idea how the magic happens - they just need it to happen. And if it doesn't - there are problems. Note that IT could fall into this category as they use information but their main job is to make sure that the information gets to where it should be - and they should know how to get it where it is.
Next is IT. Their contract with Business is an SLA or a KPI. The main part the contract in both the IT department's mind and Business's mind is the "Availability" part. Downtime will be "8 seconds every 7 months" or such. Security is tucked in the contract but it is way down at the bottom and usually doesn't have an SLA. Or a realistic SLA anyhow. "IT will keep all patches up to date".
Traditionally security has been seen as an IT function. But try do something that may make the organisation more secure but at the same time will require down-time or could result in unscheduled downtime. You will be hit on the head with the contract and be shown the SLAs. I call the guys in IT from the CIO down all the way to the guy who fixes PCs "Those that do not care". Its not really that they don't care about security as such, they just have bigger fish to fry - their SLAs. Talking about the guy fixing PCs, if he has to choose between setting the CEO's password to something hard to guess or "Password1" which do you think he'll choose? He'll want to get the old man off his back and working again - Availability.
So, we have the two camps "TTDNK" and "TTDNC". Where does Information Security sit? Well, we sit in the middle. And its not a comfortable place to sit. Essentially what we sell (Confidentiality, Integrity and, the big one, Availability) is something that Business does want. They just don't know that their data may be at risk of having one of these taken away. We have to show them that. We also have to show them that by ignoring the C and I, they are at risk and they are the ones that will be left responsible. We also need to work with IT and show them that they can make the C and I work without too much extra on their plates. And with both sides we need to review SLAs that don't allow for things like patching.
Extending this to everyday activities - if a patch comes out for a piece of software. Business should be doing business stuff - not thinking about patches. They should be blissfully unaware of the risk of not patching. IT will be concerned with Availability and will want not to install the patch. Information Security has to sit in the middle and show each camp why the patch must be applied, each in their own language and get it done.
This may be obvious to some and hopefully it will be obvious once you have read the post but it when I came up with this idea it took a lot of thinking and a lot of convincing to all around me that this is how it works.
Please note that this does not necissarily represent the company I work for, the company I am contracted to or any other company living or dead blah blah blah. Its hopefully applicable to ALL businesses.
Lets begin.. businesses sell stuff. They either sell services or products but with nothing to sell they are not really all that useful, ask Enron.
Traditionally there have been two camps of people in businesses - users of information and the guys who make sure that the information gets to where it needs to be. You could call them "Business Decision Makers" and "IT".
Business Decision Makers could be anyone in the company from the CEO to the receptionist, etc
In terms of the CEO think "how many widgets did we sell this week?" For the receptionist it is "What is Jack from Accounts number so I can put this call through".
I call these people "Those that do not know" because they have no idea how the magic happens - they just need it to happen. And if it doesn't - there are problems. Note that IT could fall into this category as they use information but their main job is to make sure that the information gets to where it should be - and they should know how to get it where it is.
Next is IT. Their contract with Business is an SLA or a KPI. The main part the contract in both the IT department's mind and Business's mind is the "Availability" part. Downtime will be "8 seconds every 7 months" or such. Security is tucked in the contract but it is way down at the bottom and usually doesn't have an SLA. Or a realistic SLA anyhow. "IT will keep all patches up to date".
Traditionally security has been seen as an IT function. But try do something that may make the organisation more secure but at the same time will require down-time or could result in unscheduled downtime. You will be hit on the head with the contract and be shown the SLAs. I call the guys in IT from the CIO down all the way to the guy who fixes PCs "Those that do not care". Its not really that they don't care about security as such, they just have bigger fish to fry - their SLAs. Talking about the guy fixing PCs, if he has to choose between setting the CEO's password to something hard to guess or "Password1" which do you think he'll choose? He'll want to get the old man off his back and working again - Availability.
So, we have the two camps "TTDNK" and "TTDNC". Where does Information Security sit? Well, we sit in the middle. And its not a comfortable place to sit. Essentially what we sell (Confidentiality, Integrity and, the big one, Availability) is something that Business does want. They just don't know that their data may be at risk of having one of these taken away. We have to show them that. We also have to show them that by ignoring the C and I, they are at risk and they are the ones that will be left responsible. We also need to work with IT and show them that they can make the C and I work without too much extra on their plates. And with both sides we need to review SLAs that don't allow for things like patching.
Extending this to everyday activities - if a patch comes out for a piece of software. Business should be doing business stuff - not thinking about patches. They should be blissfully unaware of the risk of not patching. IT will be concerned with Availability and will want not to install the patch. Information Security has to sit in the middle and show each camp why the patch must be applied, each in their own language and get it done.
Tuesday, February 13, 2007
Eventually we may make it back to the early nineties (Part 2 of the 70s post)
In 1995 IBM bought Lotus for $3.5 billion. Cash.
Read that again.
Sure, Lotus 1-2-3 was still around and still (if I recall correctly) the market leader. Office95 total killed that. But it was not Lotus's most famous software package that IBM wanted. They wanted Lotus Notes. And they paid $3.5 billion (cash money) for the pleasure.
IBM Lotus Notes is still around today and very well respected. And used by some very big companies. But I really don't think it had the impact it should have. I think the reason is that Microsoft Exchange adapted more quickly to what companies wanted.
But, didn't need.
The thing is that IT has (unfortunately) positioned itself both as a strategic tool and a grudge expense. (It is also an operational tool..hmm..maybe we'll come back to this point... but I want to focus on strategic).
What the above means is that companies have salivated at the idea of using technology to beat their competitors. And it is very quick for something to go from stategic (read: competitive advantage) to operational (read:everyone is doing it). So companies push projects out quickly. If you are a leader you want to be that way as soon as possible..if you are catching up - the same. You also want to do it as cheaply as possible, obviously.
So the poor IT department has to roll out projects as quickly as possible, as cheaply as possible. And probably with very little planning or training.
So, with the choice between a proper system for managing staff using workflow, perfectly designed job descriptions and properly though out business processes that all just works or a quickly cobbled mail system with a nice directory system and calendar - what would be the choice of most IT decision makers. Yep, the cheaper and quicker.
Now, don't get me wrong - I don't know enough about Lotus Notes to promote it as a perfect system, nor do I know enough about Exchange to put it down. Thats not my point here. And, in fact, I bet that a good system where Exchange is used as part of a well organised workflow solution would probably be better than a badly created Notes implementation.
My point is - we have now, through the mistakes of the past come to a point where it can happen that a business is not sure what information it has, (perhaps even) what machines it has and what people it has. There are ways to track all of these but the computer systems were never designed for that.
In the heady, do anything days gone by companies from small to big did things like this:
If processes had been in place long ago this would not be an issue. Now, you have 10000 user accounts, no paperwork. Who of those is still employed and has all the access (and only the access) they need. If you start a clean-up now - you will piss everyone off, from the top, all the way down. Woops...due to IT's need to impress ages ago and business's need for speed you are the bad guy.
But it will happen. With (more) money, time and tears.
Slowly companies will realise what problems they have and how insecure they are. Or someone out there will show them. And they will put the procedures in place, the technology will follow and the organisation will be turned into a perfect workflow oriented organisation.
And there will be some ROI as people's jobs are down quicker, smoother and with less paperwork. Private information of 3rd parties will be in secure databases. Databases will be backed up and the information will not leak out through discontinued servers and stolen laptops.
And it will all be good.
And then we will have caught up to the vision that IBM had in the early nineties when they paid paid $3.5 billion cash for Lotus - a company that know who it is and what it is doing with IT systems that know the same.
Read that again.
Sure, Lotus 1-2-3 was still around and still (if I recall correctly) the market leader. Office95 total killed that. But it was not Lotus's most famous software package that IBM wanted. They wanted Lotus Notes. And they paid $3.5 billion (cash money) for the pleasure.
IBM Lotus Notes is still around today and very well respected. And used by some very big companies. But I really don't think it had the impact it should have. I think the reason is that Microsoft Exchange adapted more quickly to what companies wanted.
But, didn't need.
The thing is that IT has (unfortunately) positioned itself both as a strategic tool and a grudge expense. (It is also an operational tool..hmm..maybe we'll come back to this point... but I want to focus on strategic).
What the above means is that companies have salivated at the idea of using technology to beat their competitors. And it is very quick for something to go from stategic (read: competitive advantage) to operational (read:everyone is doing it). So companies push projects out quickly. If you are a leader you want to be that way as soon as possible..if you are catching up - the same. You also want to do it as cheaply as possible, obviously.
So the poor IT department has to roll out projects as quickly as possible, as cheaply as possible. And probably with very little planning or training.
So, with the choice between a proper system for managing staff using workflow, perfectly designed job descriptions and properly though out business processes that all just works or a quickly cobbled mail system with a nice directory system and calendar - what would be the choice of most IT decision makers. Yep, the cheaper and quicker.
Now, don't get me wrong - I don't know enough about Lotus Notes to promote it as a perfect system, nor do I know enough about Exchange to put it down. Thats not my point here. And, in fact, I bet that a good system where Exchange is used as part of a well organised workflow solution would probably be better than a badly created Notes implementation.
My point is - we have now, through the mistakes of the past come to a point where it can happen that a business is not sure what information it has, (perhaps even) what machines it has and what people it has. There are ways to track all of these but the computer systems were never designed for that.
In the heady, do anything days gone by companies from small to big did things like this:
- A server comes to end of life and is removed from the network. But, a project that is way over budget needs a not-so-powerful server so the old server is used. Maybe the server was an HR server (inside and fairly safe) and is now a webserver (open to the world). Because its a mission to re-install the OS, the box is left as is and just has a webserver added to it. Your HR information is now at risk and because there was no formal installation or project - the new server is a ghost server, only noticed if/when it goes down.
- The mail server administrator moves into a new job but his mail server access is not taken away. He now has access to all the mails on the server.
- Even worse - he leaves the company and his account is not removed.
- The CEO's personal assistant who has access to all his files downloads a valentines day card that is actually a trojan. It is able to install itself because she has Administrative rights to her PC.
If processes had been in place long ago this would not be an issue. Now, you have 10000 user accounts, no paperwork. Who of those is still employed and has all the access (and only the access) they need. If you start a clean-up now - you will piss everyone off, from the top, all the way down. Woops...due to IT's need to impress ages ago and business's need for speed you are the bad guy.
But it will happen. With (more) money, time and tears.
Slowly companies will realise what problems they have and how insecure they are. Or someone out there will show them. And they will put the procedures in place, the technology will follow and the organisation will be turned into a perfect workflow oriented organisation.
And there will be some ROI as people's jobs are down quicker, smoother and with less paperwork. Private information of 3rd parties will be in secure databases. Databases will be backed up and the information will not leak out through discontinued servers and stolen laptops.
And it will all be good.
And then we will have caught up to the vision that IBM had in the early nineties when they paid paid $3.5 billion cash for Lotus - a company that know who it is and what it is doing with IT systems that know the same.
Subscribe to:
Posts (Atom)