A post inspired by this article on Tripwire’s State of Security blog by Cindy Valladares – Here’s an excerpt to go with the graphic.
“Maslow’s Hierarchy of Needs framework suggests that individuals are concerned with layers of needs, making us interested in moving up a layer only after the most basic needs are met.
I would like to think that for information security we have a similar way of rationalizing our investments. Unfortunately, I see many security professionals getting in the latest bandwagon of security “sexiness.”
I really like this as @CindyV does what many others don’t. She puts context around the value of the bright and shiny things you will get offered by door to door security consultancy and tool salespeople. As I ranted about in this article (Dynamic Threat Intelligence – Pretty But Potentially Pointless), it’s all about your vulnerabilities and exposure.
Don’t buy a ride on mower for your postage stamp garden. Don’t buy an 80 inch TV for your 8ft x 7ft family room. Don’t buy a yottabyte storage solution for your family photos. Don’t hire mercenaries, build gun emplacements and make your door mat the kill zone if you live in a suburban semi that’s not currently located in an active war zone.
But, don’t be complacent either. Many small and medium businesses can’t afford in-house or consultant security expertise. Yes their footprint on the internet and therefore exposure to opportunistic attacks is less, but many hold significant quantities of personal data, deal with online payments or have connections that are an ideal jumping off point to larger, more secure client companies.
Often, because of poor security awareness and missing or broken controls, they are a softer option for targeted attacks, as proven by compromises of both AT&T and Target via linked suppliers (there’s more on that, including advice on integrating security into your supplier governance activity here).
It’s all about realistic assessment of what your business really needs versus the desire created by an expert sales pitch or media splash about latest threats and vulnerabilities.
Cindy’s article, inspired by Dave Shackleford’s earlier piece, gives you a starting point to explore wants vs needs.
If you have the means to get a clear, honest look at the current state of your security, you will most likely find some swiss cheesy foundations. Stuff far more in need of your attention and budget than the “next big thing”. If you don’t know the status quo, your security tool equivalent of the monster TV might just fall through the rotten floorboards, before the hoped for value-add ever gets realized.
It’s time for all firms to check if they’re leaving out the welcome mat for criminals and/or spending money on seductive new tools that should be saved to shore up shaky security foundations.