Dr StrangeLove (How I Learned to Stop Worrying and Love Managed Services),

By -




Convergence of data, economies, supply chains & critical infrastructure and it all needs to be secure...welcome to the Internet.
As a practitioner in the software development and security industries for over 15 years, I've got to say it has never felt like a job. For people to like their jobs it's a blessing, particularly as my skillset is in demand. 

 Demand is based on need and  given the proliferation of internet technologies for literally anything (finance, military, energy, mobile, IoT) is does not see to be getting any less busy.

As with anything if there is a demand for something there comes a tipping point. Be it energy, clean water, food security or even Internet security. 

 As a result there are some knock-on effects and many are the result of a capacity to deliver.

 Given so many different industry verticals are all converging into a single approach to delivery (the Internet) the responsibility of securing such a global machine is only getting more demanding.

Early Warning Signs 
  • A shortfall of experienced cyber security experts is expected to reach 1,000,000 by 2019
  • PWC recently did a survey in which  only 26% of companies said they have adequate staff.
  • Consultant driven security assessments (penetration tests) do not map to contemporary software or system development methodologies.
  • Consultant driven testing is not scalable for any agile organisation is prohibitively expensive if full coverage is required on a regular basis.
  • Risk & Vulnerability intelligence is not consolidated by default.

As with climate change, the approach to solving the Internet Security challenges of the future won't be addressed until people are told "There are no more [resources]".

 Concerns and how to improve security posture:

In 2015 a Questionnaire via the WEF World Economic Forum - hyperconnected world
posed the following questions:

"What actions that your institution could take would have the most impact in reducing the risk associated with cyberattacks?"

  • 38% said "Develop deep integration of security into the technology environment to drive scalability" is a "game changer".
  • 57% said "Prioritize information assets and related risks in a way that helps engage business leaders" would have significant impact.
  • 55% said  "Deploy active defences to be proactive in uncovering attacks early" would have significant impact. 

From the responses above amongst others the idea that consultant driven vulnerability management, penetration testing / security assessment and point-in-time approaches to securing a business don't work, are not scaleable.

 The above can be considered a business case for engaging with managed services in order to provide the scale, frequency, visibility and accuracy required in the every changing landscape that is the Internet.

 The adoption of managed services shall continue to increase as organisations understand:

  • the need for an "adequate level" of security to mirror development / devops
  • it is a necessary operating cost of any business.
  • approaching security in an ad-hoc manner shall not solve anything.
  • metrics are required in order to engage the business of the value of security.
  • security needs to be Integrated at many levels in a business and its associated systems.




Comments

Post a Comment

Popular posts from this blog

By -
Image
The HSE Data Breach and the State of Irish Cyber Security Many years ago, shortly after I founded the Irish chapter of OWASP ( http://www.owasp.org ) (in 2007??) we were delivering free application and software development classes to anyone who wanted them. It was a local low key affair but every class we delivered was "sold out". We have 60-80 folks mostly developers willing to spend 4-5 hours on learning the fundamentals of secure application development and testing. I suppose we felt cyber security was an important issue because that's what we did. At the time many folks in business felt cyber security was an overhead or a "tax" and did not give it much time. A few years later (late 2010) when the the foundation of the NCSC (National Cyber Security Centre) was announced, a few of us (local OWASP Ireland leaders) wrote a number of emails to the Irish government offering free cyber security training. As we were working for a non profit (501.3c) charity (OWA...
Read more

Edgescan and Huawei - Cybersecurity - Irish Times Article and Panel Discussion

By -
Image
I recently was interviewed by the Irish times on why is everything getting hacked and how can we change the game.... https://www.irishtimes.com/special-reports/cybersecurity-focus/criminals-have-an-inbuilt-advantage-in-the-great-cyber-arms-race-1.4651078  A recording of the Panel with Andy Purdy, CSO of Huawei North America. https://www.youtube.com/watch?v=cQJ1uSQ4IEk&t=33s Both are decent and worth a listen.
Read more

How Simple can it be.....XSS Prevention....

By -
Cross Site Scripting is sill a very common web vulnerability. Generally it is used to attack clients/users. It can be used for malware upload, botnet hooking, keylogging, a payload delivery system for clickjacking and CSRF attacks and much much more, all for 6 easy payments of $9.99...sorry got carried away there :) But is is easily preventable. You dont even have to know what XSS (type 0, type 1, type 2, DOM, Stored, Reflected) is to prevent it. One pretty simple way to prevent XSS is to use the OWASP ESAPI (Enterprise Security API). A very easy tool to use/invoke. It's also managed and attended to by Chris Schmidt ....A great guy... Regardless of what it does....if there was a mandate to use it on all redisplayed external input a site could become virtually XSS free!! (all for 6 easy payments of......). It's easy to deploy.... 1. Include in JSP (Java version) 2. Invoke in JSP 3. Job done!!! We include it by <%@ page import="org.owasp.esapi.ESAPI...
Read more