folks in your industry that are being
exposed to the same threats. While
they may be competitors on the business side, you all have a vested interest
in lowering the industrywide threat
level. The bad guys talk all the time.
If you don’t have industry-specific
contacts, you will be at an even larger
disadvantage. It’s probably the least
expensive thing you can do to increase
your security posture.
BEnnETT: Businesses need to understand an attacker’s motivation to
steal know-how, systems, and other
assets. While the typical goal is to replicate and/or destroy the business, the
protection of a business’ reputation
and the rigorous understanding of a
business’ vulnerabilities are not given
the board-level visibility they require.
New, young businesses actually understand this better than many medium-size, older businesses.
Attacks may not be just about
money and may not be rationally motivated. A motivation for someone to
destroy your business may not be “You
lose, I win,” but “You lose, I stay the
same.” Given the current state of the
recession, that cannot be discounted.
CLaRK: When things go wrong, you
need to be in a position to understand
what happened. That includes not just
the technological side but the motivation side as well.
The IT security function needs to
have a seat at the management table
and directly align with the business’
goals. I asked a CISO (chief information security officer) for a large multinational corporation about his objectives. He said, “My first objective
is associated with contributing to the
financial success of my business.”
That really focused his mind about the
profitability and success of the organization and made him a critical player
in the achievement of that goal.
EPSTEin: Too many organizations
spend their information-security resources on protecting their firewalls
and other fairly low-level things such
as the protocol stack. The activity
these days is all happening in the application layer. While a lot of the small
and medium-size organizations are
just now getting around to protecting the bottom layer, the bottom isn’t
where the problems are anymore.
If you look at the nature of net-
The best advice
is to recognize
what makes you
unique in the
market and think
honestly about how
to protect those
assets. This might
some money on a
could actually help
you think through
work attacks, Microsoft, Cisco, etc.
have done a reasonably good job. Just
because they have pushed attackers
higher in the service stack, however,
doesn’t mean the game is over for us
defenders. We have to move our defenses higher as well. We can’t just
monitor firewall logs anymore. We
now have to monitor application logs,
and a lot of applications don’t have
logs. While boards have been hearing
the mantra of antivirus, firewall, etc.,
they now need to understand that the
threat has moved up the stack, and the
defenses have to move there as well.
I think the cloud is, on the whole,
a positive thing. As computer scientists, we need to come up with a way
to give users advice on how to select
a cloud provider. We need the equivalent of Consumer Reports for cloud
providers supporting specific industries, especially for small and medium-size businesses.
CREEGER: My take-away is that security is really tied up intimately with the
semantics of your business. For a long
time, most people have treated security with a one-size-fits solution, usually
putting fences around certain critical
components without thinking about
the real semantics of operations. My
impressions from our conversation is
not only do IT people need a real seat
at the senior management table so
they can make substantive contributions to its profitability, but they also
need to understand the company’s
long-term strategy and operations intimately in order to avoid calamity.
Lessons from the Letter
Intellectual Property and Software Piracy:
an interview with Aladdin vice president
CTO Roundtable: Malware Defense
Mache Creeger ( firstname.lastname@example.org) is a technology
industry veteran based in Silicon Valley. along with
being a columnist for ACM Queue, he is the principal
of emergent technology associates, marketing and
business development consultants to technology