Part 4: Pay Now or Pay Later

• By Martin Zinaich
• Jul 30, 2015

(Did you miss Part 1, 2 or 3? Click here for part 1; here for part 2; and here for part 3 to catch up!)

I have a saying: “In business, agility will trump information security... until such time that the lack of information security decimates agility.” The first part of my saying is just a law of staying in business, but the second part does not have to be true.

So, why is it true so often?

On April 20, 2011, Sony acknowledged on the official PlayStation Blog that it was "aware certain functions of the PlayStation Network" were down.  At the time, Sony announced that it might take one or two days to put things back in order. In reality, Sony had been hacked and their popular PlayStation Network was offline for some 24 days. When the smoke cleared, the personally identifiable information (PII) of over 77 million customers had been compromised, making it one of the largest data breaches to date.

It was a costly event for Sony in many ways.

An important item is often omitted from the Sony breach event. Sony made their public announcement about the breach in April 2011, but they made another big announcement in May of that same year. In May of 2011 Sony announced it was creating a post of Chief Information Security Officer (CISO). We know at the time of the breach it had at least 77 Million customers on the PlayStation Network, we know it was taking credit card information, and we know it was making lots of money. Yet, in spite of all this, it did not have a CISO position.

One can assume Sony has its share of highly-educated and highly-trained MBA’s. Yet, evidently, none thought it strange — with 77 million customers, an online network and credit card information — that they did not have a CISO position. That is not hard to believe because it happened and because Information Security, as I noted earlier, is a business discipline that is usually pushed from the bottom up.

(Since the initial development of this piece, Sony was breached yet again. You may be thinking at this point, “Well, so much for appointing a CISO,” but hold on…the broader point is still being established.)

Lest you think I am just picking on Sony, in March of 2011 it was not a game developer but an Information Security company, RSA, that suffered a breach. In June of 2011, you guessed it: RSA appointed their first Chief Security Officer (CSO). In June of 2012 LinkedIn reported 6.5 million accounts were compromised. In that same month, it was reported that LinkedIn had neither a Chief Information Officer nor a Chief Information Security Officer.

Breaches are now almost a monthly — if not weekly — occurrence. Some are big, some are small, some cost only reputation and some cost millions of dollars. One could write volumes covering all the security breaches we have seen in this industry, and even more volumes on the details. I picked the three incidents above to underscore a point. While government, universities, legislatures, certification industries and magazines all sound the “Cybergeddon” alarm, business education and business leaders still think this is only a technology issue.

The Light is Burned Out

The Information Security professional is asked to be a business enabler, participate in all new projects (if he/she is lucky), understand code weaknesses, monitor everything involving information access and movement, put in place the proper protections be it software or hardware related, find all corporate technology assets and their vulnerabilities, interface with other companies in a secure manner, provide secure anywhere/anytime access to everything, defend against attacks from around the globe, classify data and systems, review all logs, practice incident response, create policies that are friendly to the organization yet provide the best protections to business risk, train others, get certified, stay on top of all new vulnerabilities, stay current with secure coding practices, stay current with penetration testing, stay current with technology changes and sell the Information Security Program. That’s a lot.

One thing is certain: if you cannot do that last item, you are doomed. That is truly a problem with the Information Security profession. With a breach-a-day environment and with a heavy business reliance on technology, why is Information Security still a paradigm that has to be “sold?”

Information Security has to be sold because the light is burned out. For all the expansion in the InfoSec profession, everyone is still looking at the burned out landing gear light (the technology alone). Let’s be honest: there is a good deal of money to be made selling the technical aspects of Information Security, but by focusing on only one small area, we eliminate the responsibility of the flight crew to the overall duty of keeping the airplane flying properly and safely.

The current model for most businesses is that Information Security is pushed up from a corner of the IT Department. Combine that prototypical design with the insecure infrastructure that relies on it for protection and you can very easily see why Information Security has problems!