Pay Now or Pay Later

Part 4: Pay Now or Pay Later

(Did you miss Part 1, 2 or 3? Click here for part 1; here for part 2; and here for part 3 to catch up!)

I have a saying: “In business, agility will trump information security... until such time that the lack of information security decimates agility.” The first part of my saying is just a law of staying in business, but the second part does not have to be true.

So, why is it true so often?

On April 20, 2011, Sony acknowledged on the official PlayStation Blog that it was "aware certain functions of the PlayStation Network" were down.  At the time, Sony announced that it might take one or two days to put things back in order. In reality, Sony had been hacked and their popular PlayStation Network was offline for some 24 days. When the smoke cleared, the personally identifiable information (PII) of over 77 million customers had been compromised, making it one of the largest data breaches to date.

It was a costly event for Sony in many ways.

An important item is often omitted from the Sony breach event. Sony made their public announcement about the breach in April 2011, but they made another big announcement in May of that same year. In May of 2011 Sony announced it was creating a post of Chief Information Security Officer (CISO). We know at the time of the breach it had at least 77 Million customers on the PlayStation Network, we know it was taking credit card information, and we know it was making lots of money. Yet, in spite of all this, it did not have a CISO position.

One can assume Sony has its share of highly-educated and highly-trained MBA’s. Yet, evidently, none thought it strange — with 77 million customers, an online network and credit card information — that they did not have a CISO position. That is not hard to believe because it happened and because Information Security, as I noted earlier, is a business discipline that is usually pushed from the bottom up.

(Since the initial development of this piece, Sony was breached yet again. You may be thinking at this point, “Well, so much for appointing a CISO,” but hold on…the broader point is still being established.)

Lest you think I am just picking on Sony, in March of 2011 it was not a game developer but an Information Security company, RSA, that suffered a breach. In June of 2011, you guessed it: RSA appointed their first Chief Security Officer (CSO). In June of 2012 LinkedIn reported 6.5 million accounts were compromised. In that same month, it was reported that LinkedIn had neither a Chief Information Officer nor a Chief Information Security Officer.

Breaches are now almost a monthly — if not weekly — occurrence. Some are big, some are small, some cost only reputation and some cost millions of dollars. One could write volumes covering all the security breaches we have seen in this industry, and even more volumes on the details. I picked the three incidents above to underscore a point. While government, universities, legislatures, certification industries and magazines all sound the “Cybergeddon” alarm, business education and business leaders still think this is only a technology issue.

The Light is Burned Out

The Information Security professional is asked to be a business enabler, participate in all new projects (if he/she is lucky), understand code weaknesses, monitor everything involving information access and movement, put in place the proper protections be it software or hardware related, find all corporate technology assets and their vulnerabilities, interface with other companies in a secure manner, provide secure anywhere/anytime access to everything, defend against attacks from around the globe, classify data and systems, review all logs, practice incident response, create policies that are friendly to the organization yet provide the best protections to business risk, train others, get certified, stay on top of all new vulnerabilities, stay current with secure coding practices, stay current with penetration testing, stay current with technology changes and sell the Information Security Program. That’s a lot.

One thing is certain: if you cannot do that last item, you are doomed. That is truly a problem with the Information Security profession. With a breach-a-day environment and with a heavy business reliance on technology, why is Information Security still a paradigm that has to be “sold?”

Information Security has to be sold because the light is burned out. For all the expansion in the InfoSec profession, everyone is still looking at the burned out landing gear light (the technology alone). Let’s be honest: there is a good deal of money to be made selling the technical aspects of Information Security, but by focusing on only one small area, we eliminate the responsibility of the flight crew to the overall duty of keeping the airplane flying properly and safely.

The current model for most businesses is that Information Security is pushed up from a corner of the IT Department. Combine that prototypical design with the insecure infrastructure that relies on it for protection and you can very easily see why Information Security has problems!

Featured

  • Survey: CISOs Increasing Budgets for Crisis Simulations in 2025

    Today, Cyber Performance Center, Hack The Box, released new data showcasing the perspectives of Chief Information Security Officers (CISOs) towards cyber preparedness in 2025. In the aftermath of 2024’s high-profile cybersecurity incidents, including NHS, CrowdStrike, TfL, 23andMe, and Cencora, CISOs are reassessing their organization’s readiness to manage a potential “chaos” of a full-scale cyber crisis. Read Now

  • Human Risk Management: A Silver Bullet for Effective Security Awareness Training

    You would think in a world where cybersecurity breaches are frequently in the news, that it wouldn’t require much to convince CEOs and C-suite leaders of the value and importance of security awareness training (SAT). Unfortunately, that’s not always the case. Read Now

  • Windsor Port Authority Strengthens U.S.-Canada Border Waterway Safety, Security

    Windsor Port Authority, one of just 17 national ports created by the 1999 Canada Marine Act, has enhanced waterway safety and security across its jurisdiction on the U.S.-Canada border with state-of-the-art cameras from Axis Communications. These cameras, combined with radar solutions from Accipiter Radar Technologies Inc., provide the port with the visibility needed to prevent collisions, better detect illegal activity, and save lives along the river. Read Now

  • Survey: 84 Percent of Healthcare Organizations Spotted Cyberattack in Last 12 Months

    Netwrix, a vendor specializing in cybersecurity solutions focused on data and identity threats, surveyed 1,309 IT and security professionals globally and recently released findings for the healthcare sector based on the data collected. It reveals that 84% of organizations in the healthcare sector spotted a cyberattack on their infrastructure within the last 12 months. Phishing was the most common type of incident experienced on premises, similar to other industries. Read Now

Featured Cybersecurity

Webinars

New Products

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis. 3

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction. 3

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file. 3