Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operational Security

09:05 AM
Curtis Franklin
Curtis Franklin
Curt Franklin

Gartner Says Real Security Starts With a Mission

Security for the digital organization starts with a mission that has executive support; the process from mission to execution is step-by-step.

ORLANDO, Fla. -- Gartner Symposium/ITXpo -- Security is a practical discipline. Sure, we can talk big ideas and lofty goals, but if the practice that calls itself "security" doesn't keep an organization's assets safe, then it's failing at its job.

Perhaps that's the reason that the session on developing a pragmatic security vision and strategy was standing-room only.

Gartner Fellow and VP Tom Scholtz started by looking at the expansion of security responsibility that comes with a transformation to a digital business. Where traditional security is concerned with "CIA," that is;

  • Confidentiality
  • Integrity
  • Availability

digital business adds "PSR," or;

  • Privacy
  • Safety
  • Reiability

Those three little words change the brief for security and its practitioners in significant ways -- ways that require a plan if there's a hope of success.

What kind of plan do you and your organization need to have? Scholtz didn't go into details on the tactics you should incorporate into your plan -- those will be far too unique for every organization. He did, however, talk about the structure that the plan should be built upon. It's a structure that incorporates a framework that any organization might find useful.

Security charter
What's the point of security? It seems like an obvious question, but the security group needs a mission, or charter, setting out in plain language what security will do for the organization and how it will be accomplished. Then the executive committee must sign off on the charter. With the clear statement and C-level support, the security group has a huge head start on success. Terms of reference
Communications are hard. Make things easier with a list of terms and definitions, and a reference model for the security architecture. This will make meetings more productive and provide a reference to return to when discussions go completely off the rails. Governance and accountability
Whatever it is that we want to do, someone must do it. And someone must make sure that it's done. Oh, yes, and someone must pay for it. All of that should be put down in black and white in the security plan. It's especially important to set out the responsibilities of the business units that aren't part of IT. As another speaker at Gartner Symposium said, "If the business units have no responsibility for the security of their data, then they're going to engage in reckless behavior." Roadmap
How do we get from where we are to where we must be? This is the point at which plans and schedules are set. These will be visited, reviewed and revised on a regular basis, to account for changes in business, threats and technology. Every revision becomes part of the roadmap and the revision history of the plan. Execution
The best plan and roadmap in the world is of little use if it's not put into practice. Deployment, management and operation are where the governance and accountability pieces become real in accordance with the security charter. One of the pieces that Scholtz mentioned -- and that was talked about in other presentations during the week -- is establishing KPIs (key performance indicators) for security. These will provide the basis for metrics against which security's operations can be measured, modified and improved.

Want to learn more about the technology and business opportunities and challenges for the cable industry in the commercial services market? Join Light Reading in New York on November 30 for the 11th annual Future of Cable Business Services event. All cable operators and other service providers get in free.

Business evolution means that security must evolve, as well. Evolution can be complex and even painful, but failing to evolve means that security will become less and less effective, dramatically raising the chances of failure, breach and ultimately, data loss.

Related posts:

— Curtis Franklin is the editor of SecurityNow.com. Follow him on Twitter @kg4gwa.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can ...
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one....
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and ...
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices f...
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `outpu...