The security triangle: simplicity and user intuitiveness can equal reduced security

Details

Category: Cyber Security (Personal)

A few days ago a friend who has recently moved into the information security department at the corporate where he works emailed saying he is playing around with “next-generation” endpoint antimalware detection, removal and blocking endpoint software. He named a few names, most well known and all claim to use “machine learning” to do their job. Go to Info Security Europe in Olympia and every year there is a “craze”. This year was machine learning with about every stall claiming to offer a tool to find and block advanced malware. Everyone seems to be jumping on the same bandwagon and you have to wonder how many “next generation” or “machine learning” products actually work. I have personally tried some “cutting edge” products and in beta phase even a basic macro virus was let through. With another claiming to block hidden downloads which did not work.

Remember the security triangle you studied for a certification? Security, usability and cost. As security increases cost goes up and user friendlessness goes down. The products a friend mentioned work on looking for patterns not just simple killing or blocking everything not on the list (whitelisting). Take a house for instance, you have by default a front door operated by a key. Add an alarm, it costs you money and makes it a bit harder to get in your house. Increased security with small downsides. Add a second lock and forgot the key, and you cannot get in. Add an outer fence with a swipe card, the layers add great security but cost you dearly and slow you down. Keep everything in your house which is valuable in a under floor safe and each time you want to get a item it takes 2-3 minutes which means you leave the house slower. Get the idea?

Read more …

Me quoted in the SC Magazine: The information security implications of M&A deals

Details

Category: Blog

https://www.scmagazineuk.com/the-information-security-implications-of-ma-deals/article/576067/

Cloud security: large scale public/private cloud is generally more secure but you can be the weakest link just like with on premise

Details

Category: Cyber Security (Personal)

Many senior cyber security managers argue that large scale mass market public/private offerings like Microsoft Azure, Amazon Web Services, Rackspace Cloud etc. are very secure and often are more secure than running in-house servers. Why? Because they have larger departments designing the architecture, implementing isolation and monitoring. A FTSE 100 firm may have a handful of monitoring staff where the names listed above have tens of operations staff.

This over-generalization does not apply to small to medium scale cloud offerings generally. Some I have seen are poor, read “We offer ultra secure online backup...... no you do not”. Many companies' use high security data centres and sell themselves as ultra-secure but only have high physical security. Who is really going to break into a data centre these days? People used to break into data centres (and still do) to steal hardware to sell on the black market.

Read more …