Pay Now or Pay Later

Part 4: Pay Now or Pay Later

  • By Martin Zinaich
  • Jul 30, 2015

(Did you miss Part 1, 2 or 3? Click here for part 1; here for part 2; and here for part 3 to catch up!)

I have a saying: “In business, agility will trump information security... until such time that the lack of information security decimates agility.” The first part of my saying is just a law of staying in business, but the second part does not have to be true.

So, why is it true so often?

On April 20, 2011, Sony acknowledged on the official PlayStation Blog that it was "aware certain functions of the PlayStation Network" were down.  At the time, Sony announced that it might take one or two days to put things back in order. In reality, Sony had been hacked and their popular PlayStation Network was offline for some 24 days. When the smoke cleared, the personally identifiable information (PII) of over 77 million customers had been compromised, making it one of the largest data breaches to date.

It was a costly event for Sony in many ways.

An important item is often omitted from the Sony breach event. Sony made their public announcement about the breach in April 2011, but they made another big announcement in May of that same year. In May of 2011 Sony announced it was creating a post of Chief Information Security Officer (CISO). We know at the time of the breach it had at least 77 Million customers on the PlayStation Network, we know it was taking credit card information, and we know it was making lots of money. Yet, in spite of all this, it did not have a CISO position.

One can assume Sony has its share of highly-educated and highly-trained MBA’s. Yet, evidently, none thought it strange — with 77 million customers, an online network and credit card information — that they did not have a CISO position. That is not hard to believe because it happened and because Information Security, as I noted earlier, is a business discipline that is usually pushed from the bottom up.

(Since the initial development of this piece, Sony was breached yet again. You may be thinking at this point, “Well, so much for appointing a CISO,” but hold on…the broader point is still being established.)

Lest you think I am just picking on Sony, in March of 2011 it was not a game developer but an Information Security company, RSA, that suffered a breach. In June of 2011, you guessed it: RSA appointed their first Chief Security Officer (CSO). In June of 2012 LinkedIn reported 6.5 million accounts were compromised. In that same month, it was reported that LinkedIn had neither a Chief Information Officer nor a Chief Information Security Officer.

Breaches are now almost a monthly — if not weekly — occurrence. Some are big, some are small, some cost only reputation and some cost millions of dollars. One could write volumes covering all the security breaches we have seen in this industry, and even more volumes on the details. I picked the three incidents above to underscore a point. While government, universities, legislatures, certification industries and magazines all sound the “Cybergeddon” alarm, business education and business leaders still think this is only a technology issue.

The Light is Burned Out

The Information Security professional is asked to be a business enabler, participate in all new projects (if he/she is lucky), understand code weaknesses, monitor everything involving information access and movement, put in place the proper protections be it software or hardware related, find all corporate technology assets and their vulnerabilities, interface with other companies in a secure manner, provide secure anywhere/anytime access to everything, defend against attacks from around the globe, classify data and systems, review all logs, practice incident response, create policies that are friendly to the organization yet provide the best protections to business risk, train others, get certified, stay on top of all new vulnerabilities, stay current with secure coding practices, stay current with penetration testing, stay current with technology changes and sell the Information Security Program. That’s a lot.

One thing is certain: if you cannot do that last item, you are doomed. That is truly a problem with the Information Security profession. With a breach-a-day environment and with a heavy business reliance on technology, why is Information Security still a paradigm that has to be “sold?”

Information Security has to be sold because the light is burned out. For all the expansion in the InfoSec profession, everyone is still looking at the burned out landing gear light (the technology alone). Let’s be honest: there is a good deal of money to be made selling the technical aspects of Information Security, but by focusing on only one small area, we eliminate the responsibility of the flight crew to the overall duty of keeping the airplane flying properly and safely.

The current model for most businesses is that Information Security is pushed up from a corner of the IT Department. Combine that prototypical design with the insecure infrastructure that relies on it for protection and you can very easily see why Information Security has problems!

Featured

  • From Surveillance to Intelligence

    Years ago, it would have been significantly more expensive to run an analytic like that — requiring a custom-built solution with burdensome infrastructure demands — but modern edge devices have made it accessible to everyone. It also saves time, which is a critical factor if a missing child is involved. Video compression technology has played a critical role as well. Over the years, significant advancements have been made in video coding standards — including H.263, MPEG formats, and H.264—alongside compression optimization technologies developed by IP video manufacturers to improve efficiency without sacrificing quality. The open-source AV1 codec developed by the Alliance for Open Media—a consortium including Google, Netflix, Microsoft, Amazon and others — is already the preferred decoder for cloud-based applications, and is quickly becoming the standard for video compression of all types. Read Now

  • Cost: Reactive vs. Proactive Security

    Security breaches often happen despite the availability of tools to prevent them. To combat this problem, the industry is shifting from reactive correction to proactive protection. This article will examine why so many security leaders have realized they must “lead before the breach” – not after. Read Now

  • Achieving Clear Audio

    In today’s ever-changing world of security and risk management, effective communication via an intercom and door entry communication system is a critical communication tool to keep a facility’s staff, visitors and vendors safe. Read Now

  • Beyond Apps: Access Control for Today’s Residents

    The modern resident lives in an app-saturated world. From banking to grocery delivery, fitness tracking to ridesharing, nearly every service demands another download. But when it comes to accessing the place you live, most people do not want to clutter their phone with yet another app, especially if its only purpose is to open a door. Read Now

  • Survey: 48 Percent of Worshippers Feel Less Safe Attending In-Person Services

    Almost half (48%) of those who attend religious services say they feel less safe attending in-person due to rising acts of violence at places of worship. In fact, 39% report these safety concerns have led them to change how often they attend in-person services, according to new research from Verkada conducted online by The Harris Poll among 1,123 U.S. adults who attend a religious service or event at least once a month. Read Now

Most   Popular

New Products

  • Compact IP Video Intercom

    Viking’s X-205 Series of intercoms provide HD IP video and two-way voice communication - all wrapped up in an attractive compact chassis.

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening.