A SANS and Qualys View of Security Risks, 2007

November 28th, 2007 Drazen Drazic Posted in Bad Stuff, Dumb Security, Research, Risk Management, Vulnerability Management, Web Application Security, cyber crime, governance |

The work produced by SANS and Qualys stands out as some of the best data produced on the state of security risks in most cases we allow ourselves to be exposed to. More on the data shortly. Just to clarify the statement, “we allow ourselves to be exposed to”; it is what it is. Organisations persist with doing the following:

1. Not thinking strategically and giving IT security and risk management practices little more than lip service. Covered here in The 7 Reasons Why Business are Insecure. (It’s nice to see this article has received good attention elsewhere like in Anton Chuvakin’s blog).

2. Implementing systems and applications without proper security consideration, review and testing. (How long have security professionals been preaching for security to be part of every phase of the SDLC and PLC yet little has changed?)

3. Run no ongoing and proactive vulnerability assessment and management programs like QualysGuard for example…(yes, open disclosure, I like QualysGuard as you know).

4. etc etc etc….insert your own thoughts here. If you’re reading this, I probably am preaching to the converted.

Now it would be naive to say we “allow” everything. We don’t - you just can’t predict and understand every potential threat. That’s why we have risk management! Anyone remember what that term meant or what it is supposed to do? Related story; Risk Management - Great in Meetings, not so much in practice.

It’s interesting then to have a look at the SANS Top 20 Internet Security Risks of 2007 overview and detailed report. What percentage of the threats do you think could be controlled by an organisation who is serious about IT security?