The temptation to spend money to make something annoying just go away is almost irresistible. I’m not just talking about security now, this is a human condition. From get-rich-quick schemes, to diet pills, to online ‘dating’, we want instant gratification and / or results. Sadly we also expect the underlying cause of our issues to be miraculously fixed as part of the fee.
What do you mean “Get your fat arse off the couch and go for a walk!”, I paid you to make me thin!? There are no shortcuts to fitness, and there are no shortcuts in security.
None.
But with phrases like; ‘panacea’, ‘silver bullet’ and my personal favourite; ‘guaranteed hack-proof’, the cybersecurity industry is becoming one of the worst offenders. Money is clearly more important than good service to many security vendors, and to those expounding on their virtues.
And we’re letting them get away with it! Whether it’s because we’re lazy, don’t know the right questions to ask, or just don’t care, it’s immaterial. Vendors will keep making uselessproducts and we’ll keep buying them if things don’t change. Vendors have soldF.U.D.for years and we’re bringing only a few of them totask (FireEye for example).
The more complicated vendors can make security appear, the easier it is to sell their technology. At least that’s how it seems. There’s really no escaping that security must be simple to be effective; forget big data, use baselines; forget microsegmentation, just segment properly , forget user and entity behavioural analytics, fix your access control. In fact, ignore every acronym in the Gartner ‘ Top 10 Technologies for Information Security in 2016 ‘ and focus on the basics, I’ll almost guarantee they aren’t addressed appropriately.
From policies and procedures, to change control, to vulnerability management, to incident response, worry about the base processes. They are not only more effective than any new technology, they are a damned sight moresustainable, more scalable, and cheaper !
One of the universal truths in security is that you cannot fix a broken process with technology, you can only make a good process even better. Better in terms of accuracy, speed, effectiveness, efficiency, long-term cost, you name it, the underlying process had to have worked beforehand.
Take incident response (IR) for example. If you have top-notch plans, a well trained team, and robust vulnerability management, a technology that gives you earlier event warnings is of distinct value. As would technologies that; reduces false-positives; automatically quarantine infected machines; supplies greater forensic information up-front, and so on.
However, if your IR plans are crap, your team has no idea what to do, and your systems have not kept up withthe threat landscape, no technology in the world will stop an event from becoming a business crippling disaster.
Be honest, how many of you have:
Firewalls but poor segmentation? Routers but no mapping of your business processes? Anti-Virus and no OS hardening? HSMs and no idea where all your data is? Centralised logging with no idea what ‘normal’ looks like? …and the list goes on.How can you expect a new technology to help when you’ve haven’toptimised what you already have?
There are of course exceptions to every rule, and in this case the exception is to buy an Asset Management System . Everything else you do in security has your assets at the core. Do this well and everything else becomes much easier.
[If you liked this article, please share! Want more like it, subscribe!] [For a little more information on technology purchases, this may help; Security Core Concept 2: Security Control Choice & Implementation ]