Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

4/11/2012
11:14 AM
50%
50%

Be Ready To Clean Up That Mess

Compliant systems do more than prevent problems -- they help solve problems that happen

In our assessment and consulting projects, we often find clients who see compliant systems as those with the best wall of protection, like a great castle surrounded by the seas and cliffs. Granted, great security is wonderful. But it is not the end of the story; security alone will not make your organization compliant.

If you dig into any of the various laws and regulations that require compliance in various industries, you'll find they do not assume secure systems can never be breached. Full, impenetrable security is never the final metric of compliance. Secure systems are very important, but the ability to detect problems and address them is also critical.

In Kelly Jackson Higgins' recent Dark Reading article, "Damage Mitigation As The New Defense," Dave Piscitello, senior security technologist for ICANN, shared the current security reality: "Organizations that are only now coming to the realization that their network perimeters have been compromised are late to the game," he said. "The criminal application of collected/exfiltrated data is now such an enormous problem that it's impossible to avoid."

If your security and compliance efforts are focused primarily on preventing breaches and leaks, then you'll be woefully unprepared to properly respond when things go wrong. Compliant systems include processes and procedures for checking the security and steps for a prompt response.

The day after a data breach goes public or the CEO asks where the data went is not the day you want to be developing a response plan on the fly. Any unplanned, impromptu responses can even contribute to making the problem worse.

Any company or IT leadership that believes their security is complete and total has yet to face reality. They're living on borrowed time. As the old saying goes, "The problem with making systems foolproof is that fools are so darn ingenious." And so are those with ill intent.

Today's reality is that we can never make a system completely secure and still reasonable to use. There are simply too many continually evolving threats to ever be prepared to stop them all. Proper detection and response are not reactions -- they are processes that can be defined and documented.

Can you plan a response for every possible problem? Of course not. Smart plans include a framework of response steps with room to adjust the plan as necessary for specific situations. That's more than just good response planning -- that's good business planning.

Assuming you'll never be attacked, hacked, breached, or betrayed is not only naive, it is arrogant and risky for your organization and career. A strong compliance program understands that the world is always evolving, and therefore so must our processes for both security and for problem response.

Glenn S. Phillips, the president of Forte' Incorporated, works with business leaders who want to leverage technology and understand risks within. He is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish.

Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-34812
PUBLISHED: 2021-06-18
Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2021-34808
PUBLISHED: 2021-06-18
Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors.
CVE-2021-34809
PUBLISHED: 2021-06-18
Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVE-2021-34810
PUBLISHED: 2021-06-18
Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVE-2021-34811
PUBLISHED: 2021-06-18
Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via unspecified vectors.