Pay Now or Pay Later

Part 4: Pay Now or Pay Later

(Did you miss Part 1, 2 or 3? Click here for part 1; here for part 2; and here for part 3 to catch up!)

I have a saying: “In business, agility will trump information security... until such time that the lack of information security decimates agility.” The first part of my saying is just a law of staying in business, but the second part does not have to be true.

So, why is it true so often?

On April 20, 2011, Sony acknowledged on the official PlayStation Blog that it was "aware certain functions of the PlayStation Network" were down.  At the time, Sony announced that it might take one or two days to put things back in order. In reality, Sony had been hacked and their popular PlayStation Network was offline for some 24 days. When the smoke cleared, the personally identifiable information (PII) of over 77 million customers had been compromised, making it one of the largest data breaches to date.

It was a costly event for Sony in many ways.

An important item is often omitted from the Sony breach event. Sony made their public announcement about the breach in April 2011, but they made another big announcement in May of that same year. In May of 2011 Sony announced it was creating a post of Chief Information Security Officer (CISO). We know at the time of the breach it had at least 77 Million customers on the PlayStation Network, we know it was taking credit card information, and we know it was making lots of money. Yet, in spite of all this, it did not have a CISO position.

One can assume Sony has its share of highly-educated and highly-trained MBA’s. Yet, evidently, none thought it strange — with 77 million customers, an online network and credit card information — that they did not have a CISO position. That is not hard to believe because it happened and because Information Security, as I noted earlier, is a business discipline that is usually pushed from the bottom up.

(Since the initial development of this piece, Sony was breached yet again. You may be thinking at this point, “Well, so much for appointing a CISO,” but hold on…the broader point is still being established.)

Lest you think I am just picking on Sony, in March of 2011 it was not a game developer but an Information Security company, RSA, that suffered a breach. In June of 2011, you guessed it: RSA appointed their first Chief Security Officer (CSO). In June of 2012 LinkedIn reported 6.5 million accounts were compromised. In that same month, it was reported that LinkedIn had neither a Chief Information Officer nor a Chief Information Security Officer.

Breaches are now almost a monthly — if not weekly — occurrence. Some are big, some are small, some cost only reputation and some cost millions of dollars. One could write volumes covering all the security breaches we have seen in this industry, and even more volumes on the details. I picked the three incidents above to underscore a point. While government, universities, legislatures, certification industries and magazines all sound the “Cybergeddon” alarm, business education and business leaders still think this is only a technology issue.

The Light is Burned Out

The Information Security professional is asked to be a business enabler, participate in all new projects (if he/she is lucky), understand code weaknesses, monitor everything involving information access and movement, put in place the proper protections be it software or hardware related, find all corporate technology assets and their vulnerabilities, interface with other companies in a secure manner, provide secure anywhere/anytime access to everything, defend against attacks from around the globe, classify data and systems, review all logs, practice incident response, create policies that are friendly to the organization yet provide the best protections to business risk, train others, get certified, stay on top of all new vulnerabilities, stay current with secure coding practices, stay current with penetration testing, stay current with technology changes and sell the Information Security Program. That’s a lot.

One thing is certain: if you cannot do that last item, you are doomed. That is truly a problem with the Information Security profession. With a breach-a-day environment and with a heavy business reliance on technology, why is Information Security still a paradigm that has to be “sold?”

Information Security has to be sold because the light is burned out. For all the expansion in the InfoSec profession, everyone is still looking at the burned out landing gear light (the technology alone). Let’s be honest: there is a good deal of money to be made selling the technical aspects of Information Security, but by focusing on only one small area, we eliminate the responsibility of the flight crew to the overall duty of keeping the airplane flying properly and safely.

The current model for most businesses is that Information Security is pushed up from a corner of the IT Department. Combine that prototypical design with the insecure infrastructure that relies on it for protection and you can very easily see why Information Security has problems!


  • Live From ISC West: Day 2 Recap

    If it’s even possible, Day 2 of ISC West in Las Vegas, Nevada, was even busier than the first. Remember to keep tabs on our Live From ISC West page for news and updates from the show floor at the Venetian, because there’s more news coming out than anyone could be expected to keep track of. Our Live From sponsors—NAPCO Security, Alibi Security, Vistacom, RGB Spectrum, and DoorKing—kept the momentum from Day 1 going with packed booths, happy hours, giveaways, product demonstrations, and more. Read Now

    • Industry Events
    • ISC West
  • Visiting Sin City

    I’m a recovering alcoholic, ten years sober this June. I almost wrote “recovered alcoholic,” because it’s a problem I’ve long since put to bed in every practical sense. But anyone who’s dealt with addiction knows that that part of your brain never goes away. You just learn to tell the difference between that insidious voice in your head and your actual internal monologue, and you get better at telling the other guy to shut up. Read Now

  • On My Way Out the Door

    To answer that one question I always get, at every booth visit, I have seen amazing product technology, solutions and above all else, the people that make it all work. Read Now

    • Industry Events
    • ISC West
  • Return to Form

    My first security trade show was in 2021. At the time, I was awed by the sheer magnitude of the event and the spectacle of products on display. But this was the first major trade show coming out of the pandemic, and the only commentary I heard was how low the attendance was. Two representatives from one booth even spent the last morning playing catch in the aisle with their giveaway stress balls. Read Now

    • Industry Events
    • ISC West
Most   Popular

Featured Cybersecurity

New Products

  • D-Tools System Integrator (SI) Software

    D-Tools System Integrator (SI) Software

    D-Tools Inc. has announced the availability of System Integrator version 16, which adds powerful new project and service management capabilities to its award-winning, end-to-end business management solution. 3

  • Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation.

    Connect ONE®

    Connect ONE’s powerful cloud-hosted management platform provides the means to tailor lockdowns and emergency mass notifications throughout a facility – while simultaneously alerting occupants to hazards or next steps, like evacuation. 3

  • BriefCam v6.0

    BriefCam v6.0

    BriefCam has released BriefCam v6.0, which introduces the new deployment option of a multi-site architecture. This enables businesses with multiple, distributed locations to view aggregate data from all remote sites to uncover trends across locations, optimize operations and boost real-time alerting and response – all while continuing to reap the benefits of BriefCam's powerful analytics platform for making video searchable, actionable and quantifiable. 3