Let’s make a correlation between medicine and security. Many people rely on Western medicine for health and wellness. We purchase pharmaceuticals from the major producers, and go to doctors when we want more medicine. Many of us, though, seek out alternatives to Western drugs.

At El Ateneo bookstore in Buenos Aires this week I found hundreds of books on traditional and non-traditional healing and wellness. These books reminded me that there are time-honored techniques for curing ills that reach far beyond western medicine–with centuries of practice. Ayurvedic healing, yoga, nutrition, and countless other methods are being used in our own families–and by many of you, dear readers.

So why not look beyond traditional Western “medicine” for security solutions. That was the message I heard, more or less, when I spoke again to the clever startup, Secret Double Octopus. Forget about keys for authentication. Forget about encryption for securing communications.

There are time-honored alternatives that actually are more scalable, especially in light of the mobile banking and Internet of Things transactions, for which traditional keys and public key infrastructure are poorly equipped.

Companies have been hacked again and again, yet critical business communications are still being secured the same way as they’ve been for years. And now with new Mobile Apps, the Cloud, and the Internet of Things businesses are even more at risk.

The alternative is secret sharing, and in theory it is much more reliable (and less breakable) than the traditional medicine of keys and encryption. I’m enticed by the idea of living more simply, and of communing with the world around me in a more natural way, less encumbered by technology. I even closed my Facebook account! So I love the idea of simplifying a security infrastructure so that it has few moving parts.

Speaking of simplifying, and to draw a different analogy, when I stopped into a Tesla showroom to ogle at the beautiful cars there (I plan to buy one soon), the representative made it a point to explain that there are vastly fewer moving pieces in a Tesla automobile than in a traditional combustion-fuel vehicle. “Fewer pieces to break, and fewer things to go wrong.”

I feel I get the same results from my “holistic living” choices, like eating right, practicing yoga, and so forth. I spend less money on medicine and have a more resilient, less vulnerable body.

Translate that to security and it is very attractive–reducing the attack surface and simultaneously reducing the complexity of the security infrastructure. Better security at lower cost. Now that’s a choice for healthy living!

The post Alternative Medicine for Security appeared first on Security Current.

Security is the pursuit of perfect protection through ongoing tightening of defenses and preemptive activities to cover vulnerabilities.  Risk management, on the other hand, is a discipline that enables organizations to operate and measurably improve their security and compliance environments according to legal standards.

Most companies are not accustomed to thinking of information as a regulated asset.  Ingredients and food products, energy, toxic chemicals, infrastructure, and money are among the many assets that have been regulated for decades, or even centuries.  Yet, executives and entrepreneurs are obligated to see information as a regulated asset.

They have to adjust to the idea that there will be procedures similar to governing other regulated assets – having an internal auditor, quality process engineers, peer review, attorneys, independent reviews, etc. – with regard to information.  There must be controls and certification in a way that makes sense for their own specific businesses.

According to current legal standards, the best means of being in compliance is to have a clearly defined level of reasonable risk, and clear procedures that the company implements on a consistent basis.

In the unlikely event of a breach, this level of risk management should enable the business to demonstrate empirically that it was not negligent.  There must be a quantifiable way to state a company’s acceptable level of risk in terms of impact and likelihood.  Impact is defined according to the company’s mission, objectives, and obligations.  The standard must be applied consistently across all of the company’s information assets that could pose a conceivable risk.

If a company can clearly articulate and calculate its level of acceptable or reasonable risk, and thereby operate in a manner that demonstrates compliance, it may be protected enough to forgo more complicated and expensive security measures, thus freeing up resources that can be invested in the creation of value for the business.

Thus risk management is necessary not only to fulfill regulatory requirements and contractual obligations, but the very essence of the company’s business goals.  Having a clear risk assessment and risk management process ultimately will make running a business easier.

The post Security Versus Compliance: What’s the Difference? appeared first on Security Current.

Net neutrality is an idea referring to a complete lack of discrimination in the traffic on the Internet. In other words, net neutrality would mean that all packets of data are treated the same, with the same priority.

When I watch Netflix, and my show stops while Netflix is buffering, I know some Internet Service Provider is throttling down and restricting Netflix. In those moments I cry for net neutrality.

However, net neutrality doesn’t seem efficient. The Internet is full of noise and not everything needs to move at the same speed and priority. Spam, for one.

I have two cars. My old car is a beater. I did not pay much money for that car and it costs me very little to operate. It rattles and has a top speed of about 55 miles per hour. Therefore, I usually drive it on the roads where the slow cars and trucks go – the road with lots of stops. When I drive that car, I’m not in a hurry.

My other car is a racer. An Audi TT with a big engine and a desire to fly down the road. It cost a lot to purchase and maintenance costs are fairly high, too.  But when I want to get somewhere fast, I just in the TT and zoom.

Why should the Internet have the same choices? Fast roads for fast trips. Slower roads for slower trips. We get to our destination either way.

Throttling traffic for Quality of Service also feels right to me.

Therefore, I support Internet Service Providers handling traffic differently. However, I think there should be two prices. One for slower, QoS-enabled, freight; and a higher price for traffic that flys unencumbered.  For the record, I’m willing to pay an extra buck or to for Netflix to stay in the fast lane.

Steve Hunt, CPP CISSP, is a strategist focusing on cybersecurity, safe cities, safe business, and critical infrastructure protection. He entered the ISSA Hall of Fame. Steve’s career covers the breadth of the industry: cybersecurity, physical & homeland security. He also ran the risk management think tank at Forrester Research.  As a recognized expert on best practices, security trends, and technologies, Steve helps executives at the world’s largest organizations create value in light of physical and cyber threats. Security Magazine named him one of the 25 most influential people in physical security. CSO Magazine gave him the “Industry Visionary” Compass Award.  

The post Why I’m Against Net Neutrality appeared first on Security Current.

Edward Snowden did an important thing: He made an important conversation on security and ethics popular and international.

On one hand, he told us something we always knew: Spies spy. That is they stealthily gathering secrets. This is usually associated with times of war or matters of national security. I’d venture to say spying may be the third oldest profession.

Spying on specific national interests is assumed, expected, and probably universal, which is why the feigned indignation of global leaders is somewhat laughable.

However, spying on a populous is extreme. Spying is deemed by many as normal when its targets are decision makers, influencers and information handlers. Regular citizens, though, don’t qualify for surveillance unless they are associated in some way with a security threat. I would contend:

• Surveillance of a high crime street corner is appropriate
• Surveillance of a shoplifting-prone market is appropriate
• Surveillance of military leaders engaged in assault on national interests is expected
• Combining private communications, collecting information that may someday be factored as a risk – destroys the fabric of trust between a people and its government.

Therefore, surveillance in itself, in my view, is morally neutral, neither good nor bad. Sometimes it’s downright necessary for security or loss prevention. It’s a simple formula: Analyze Meta data, identify risks, manage risks.

This surveillance and spying conversation, however, sends shivers down the backs of security managers and executives.

Recent informal research I conducted found that security executives are the ‘Least Aware’ of physical threats to information. Every security executive I’ve interviewed had an understanding of physical threats to information (unauthorized visitors, dumpster diving, etc.) but almost none had studied or measured the risks associated with physical threats to information, nor did they have in place thorough procedures to protect against it.

…and Least Prepared for Social engineering and physical penetration.  The security enterprise executives I spoke with confessed that their confidential company information was as risk of social engineering attacks (phony phone conversations, pre-texting, impersonation, spear-phishing, etc.).  Physical penetrations were even more frightening to some executives who were certain that their confidential company information could be collected and conveyed out of the building (in the form of printed documents, photos, memory sticks, etc.) by:

• an unauthorized visitor tailgating into the building
• an attacker bypassing security controls at doors and fences
• rogue employees or contractors (a la Snowden)
• an internal attacker of any type

We are all in this discussion now, public and private organizations, data and physical infrastructures. Now tell me your opinion. Do you think the “Snowden affair” is relevant to your organization?  Is it a physical security issue? A cybersecurity issue? Both? Something different?

Steve Hunt, CPP CISSP, is a strategist focusing on cybersecurity, safe cities, safe business, and critical infrastructure protection. He entered the ISSA Hall of Fame. Steve’s career covers the breadth of the industry: cybersecurity, physical & homeland security. He also ran the risk management think tank at Forrester Research.  As a recognized expert on best practices, security trends, and technologies, Steve helps executives at the world’s largest organizations create value in light of physical and cyber threats. Security Magazine named him one of the 25 most influential people in physical security. CSO Magazine gave him the “Industry Visionary” Compass Award.  

The post The Snowden Conversation We Are All Having in One Way or Another… appeared first on Security Current.