Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

6/29/2012
09:41 AM
50%
50%

Not Much To Learn From The Second Kick Of The Mule

Repeating compliance and security failures shows a lack of progress

I grew up in the South, in the small town of Bear Creek, Alabama. A town of less than a thousand people, a tiny public high school, a post office, a small lake, and not much else. Not even a traffic light. Much of the population is not particularly well-educated. However, please note that despite the stereotypes of Southerners, poorly educated does not mean ignorant. In many ways, having little formal education can make you even more dependent on your wits and observations to survive.

Some of the “old country sayin’s” I heard growing up are very valuable and remarkably accurate. For instance, later in life in an engineering statistics class, I would learn that the saying, “If it ain’t broke, don’t fix it” had a solid engineering and statistical basis. In most instances, a new part or machine is many times more likely to fail than one that has been moderately used or perhaps even well-used. Only when extremely old or absolutely worn-out do the odds favor replacement.

Another lesson I learned was, “There is not much to learn from the second kick of the mule.” No matter how many times as a kid you are told to not stand behind a horse or mule, eventually you would forget and ultimately you’d get a sharp kick in the thigh or abdomen. If the kick is on target, it is a pain you don’t forget and one that drives home what you’d been repeatedly told but hadn’t given enough focus and weight.

It is because of this type of lesson that I am often puzzled by companies that keep having the same compliance and security problems. These organizations get kicked by an avoidable problem, stand up, brush it off, and then often wander back around behind the same mules again as if this time it will be different.

These companies tend to focus on rapid recovery and move on, with often little or no time spent learning from the experience. Perhaps they will address the exact source of an exact problem. However, they often fail to work to understand the similar issues just waiting to strike them, costing valuable time, money, and reputation.

Now I understand that in today’s tight and fast-paced business world you have to keep moving forward. This does not mean you have no time to learn from painful lessons. It means the first lessons are a valuable opportunity to avoid expensive repeats of the same painful problems. But you must pay attention to the lesson, knowing that the value is not in learning what hurt, but in learning what action led to the pain.

The way to avoid the pain of a kick is not by finding a new, innovative way to deal with the pain or absorb the blow. It can be as simple as learning where not to stand. The same applies to compliance and security. Make sure to learn your lessons the first time and you’ll avoid the costs of time, money, and pain from valueless repeat lessons.

Glenn S. Phillips, the president of Forte' Incorporated, works with business leaders who want to leverage technology and understand the often hidden risks within. He is the author of the book Nerd-to-English and you can find him on twitter at @NerdToEnglish.

Glenn works with business leaders who want to leverage technology and understand the often hidden risks awaiting them. The Founder and Sr. Consultant of Forte' Incorporated, Glenn and his team work with business leaders to support growth, increase profits, and address ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MROBINSON000
50%
50%
MROBINSON000,
User Rank: Apprentice
7/12/2012 | 8:22:42 AM
re: Not Much To Learn From The Second Kick Of The Mule
We totally agree that we should learn the lessons the first
time in order to avoid mistakes. We think that when it comes to a breach or an
exploit, the main focus should be on prevention and determining how it occurred
so it doesnGt take place again. It helps very much to adopt a proactive
attitude. You can read more on this topic here: http://blog.securityinnovation...
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
6 Small-Business Password Managers
Curtis Franklin Jr., Senior Editor at Dark Reading,  11/8/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18986
PUBLISHED: 2019-11-15
Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users.
CVE-2019-18981
PUBLISHED: 2019-11-15
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
CVE-2019-18982
PUBLISHED: 2019-11-15
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.
CVE-2019-18985
PUBLISHED: 2019-11-15
Pimcore before 6.2.2 lacks brute force protection for the 2FA token.
CVE-2019-18928
PUBLISHED: 2019-11-15
Cyrus IMAP 2.5.x before 2.5.14 and 3.x before 3.0.12 allows privilege escalation because an HTTP request may be interpreted in the authentication context of an unrelated previous request that arrived over the same connection.