Beast or Buddha Quietly waiting for the new beast to emerge. 2010-08-19T04:09:41Z WordPress http://beastorbuddha.com/feed/atom/ Drazen Drazic <![CDATA[Security Manager/Management – End of Year State of Security Report]]> http://beastorbuddha.com/?p=2507 2010-08-19T04:09:41Z 2010-08-19T04:09:41Z As a CISO/CSO/Security Manager, you were hired by your organisation to perform a role. How many people go back to the advertisement they responded to and check-off what you are actually doing now, versus what the original role description stated the role would/should be?

I know talking with many people out there that this is one of their biggest issues in their role today – either the role not being as it was promoted/advertised and/or you not having the support to perform the role your were hired to do.

It’s made cynics of so many people in our industry and in a weird way, has also kept people, albeit unhappy in organisations longer, given the fact that there’s a belief that wherever security people go, it will be much of the same…..so at least, “better the devil you know”. This blog is full of posts, (since day 1 about the trials and tribulations of Information Security people) trying to do their job and battling every step of the way for even small gains. I won’t link to these posts….to many but have a search here if you want further references.

I’m not going to go over all the old issues again here. What I am going to put forward is another idea, that at a minimum, may provide Information Security professionals with a sense of worth, accomplishment and within their organisation, a position whereby an organisation can choose to accept professional opinion, views and recommendations – or not, but at least the Information Security professional can rest secure in a position of having at least gone on record from an overarching management, governance and strategic perspective. (The following need not only relate to the most senior Information Security person in the organisation – but anyone who holds to a belief that things should be better than they are now). Read on……

If you are in a position where your role is that battle, I recommend an annual, end of year; “State of Information Security Report – Organisation X, 2010″.

This is not a targeted Audit report or something prepared by an external consultancy. This is purely and simply, your opinion, thoughts and recommendations on where your organisation sits, in your opinion, and based upon your expertise and experience, from a security perspective. It is a concise and to the point current state analysis documented by you, (who in theory, should have the best overarching view and understanding of Information Security in your organisation). It is something you present to the highest levels within the organisation to people that you believe are the stakeholders and influencers in regards to IT and Information Security.

Now before the cynic in you tosses the idea out the window with the belief that no one, or few people will care, at a minimum, consider the weight off your shoulders in having something in writing that covers ALL your concerns. Something that should issues arise in the future, you can remind people of. Yes, you’ve covered your butt and most importantly, you will at that time have demonstrated that you were on top of this, knew about it, raised it and have always been the right person for this role – albeit, no one listened. So many times I have seen security people have to justify and explain why a breach, incident etc took place and why the organisation was not prepared, when the realities were totally different. At this time, the horse has bolted and the Information Security person is the scapegoat as the blame game within an organisation has started. Get where I am coming from?

On a more optimistic note, you may also be surprised that such an end of year “State of Information Security Report” may actually be well received by senior management and other stakeholders whose roles and focus is elsewhere throughout the year and they’re too busy to be as directly involved with you day-in and day-out as you would like. It may well be that something like this, in such a format is exactly what will work to get that awareness and support you’ve always wanted.

In our role as an external consultant, I’ve lost track of the number of times I’ve spoken to a CEO or the Board of an organisation to talk about our findings and the issues and risks they are facing. I can honestly say, it is very rare that we’ve not had real and sincere interest in hearing about these issues and risks…..with the parties then very keen to understand what it is they can do to rectify things. In most cases, I wonder why it is that it has taken us to highlight this for them to become aware of this, or take true notice, when they’ve got a very smart and capable CSO right there in their office.

Sure, you can, should and probably are reporting your concerns as you go and so you should, but nothing works better than a definitive and all-encompassing statement presented in a big-picture format – a one hit, here’s where we stand in my opinion. They [senior management] can choose to;

- ignore it, in which case as mentioned, at least you are on record (and possibly now definitely know it’s really not the place for you)
- question it, in which case you have their attention
- verify it, in which case you again have their attention and have some actions to go with (including possibly requests for more information)
- accept your findings and possibly ask for action plans and roadmaps for improvement

Either way, any of this is better than just sitting back and fighting multiple battles on multiple fronts as your ONLY way of existence as a security professional. ie; “just putting out fires”.

Being an Information Security Professional takes a certain breed of person…not generally people who give up on things they believe in easy. But let’s not just accept that battling and “putting out fires” is our life and we just have to learn to deal with it. Lets try better ways to make change. This alone is not it, but it’s one thing, one suggestion that should help….if you’re not already doing it. (And I know many of you are but if you’re not, give it a shot!).

I welcome your comments as usual.

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.

]]>
12
Drazen Drazic <![CDATA[Council burns and demonstrates the importance of Disaster Recovery Planning….]]> http://beastorbuddha.com/?p=2502 2010-08-16T08:20:31Z 2010-08-16T08:20:31Z Liverpool City Council has burned down. Reported here in the SMH.

Listening to the Mayor being interviewed on radio this afternoon; you get the sense that the data loss and impact will be huge. I don’t think she [the Mayor] seems to get what a problem they have. They believe they have backup tapes “from last Thursday”, but don’t seem to have computers to restore them to. They believe they’ll have *a* computer in a temporary office, “but no email”.

Listening to this, I just thought, what a f**king disaster! What genius decided that a DRP was not worth having? (Unless of course this has all been reported incorrectly). If not, this will be a great case study.

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.

]]>
5
Drazen Drazic <![CDATA[Random Links and Rants……..]]> http://beastorbuddha.com/?p=2488 2010-08-11T06:43:14Z 2010-08-11T06:43:14Z - Wayne from Securus Global did us proud at the DefCon Social Engineering CTF Tournament in Las Vegas recently. It picked up a bit of press coverage. Just a couple of examples from ITNews and InfoWorld. Really demonstrates how someone can target an attack and relatively simply (with the right training, know-how and expertise), own a company. Unfortunately, we don’t see many organisations doing this type of assurance and testing – nor have an interest in it. Keen on your thoughts.

- Louis from Securus Global was involved with the French team that blitzed it at the DefCon Hacking CTF. Both Wayne and Louis, along with other Securus Global team members will be doing a few presentations in Melbourne and hopefully Sydney soon on various topics including penetration testing, web application security, social engineering and others. Stay tuned to our website as we kick off again our series of Breakfast Briefs and Technical Sessions in Q4, 2010.

- This is pretty cool. The character in a new novel with a hacker as one of the leads is based upon Dean Carter. Reported here at ZDNet. Who’s going to play Dean in the movie will be interesting.

- Checkout the Australian Information Security Bloggers Directory and see what the local guys are up to.

- Local scene roundup here.

- In numerous links above, you’ll see Securus Global has a new website. It’s a WIP (again). Websites and website development is a pain. Too much information, too little information….can you win? We’re better at testing and breaking them than we are at making our own I reckon but that’s an old story. Would love to hear from people on their thoughts on which security organisation has a good website. Just curious…. :)

- With the election just around the corner, we can safely say that neither major party seems to have a clue about technology; the Internet, eCommerce and everything else related. Few if any issues and questions I have posted here will/are being addressed. I do ask again though, where has the money that Stephen Conroy promised, and has used in his marketing for the Internet Filter, ie; the millions for additional policing for child protection on the Net gone? Almost 3 years of hearing about it. No answers.

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.

]]>
0
Drazen Drazic <![CDATA[Religion and Politics and Internet Filter]]> http://beastorbuddha.com/?p=2484 2010-08-06T07:44:07Z 2010-08-06T07:44:07Z Let it “anger” the “Christian Lobby”: Coalition filter stance angers Christian lobby.

Would love to get some bible quotes to establish any precedence for their position. Anyone? :-) (Assuming you abide by, and accept that as “law”).

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.

]]>
5
Drazen Drazic <![CDATA[Cloud Security Certification]]> http://beastorbuddha.com/?p=2481 2010-07-30T00:27:22Z 2010-07-30T00:27:22Z The Cloud Security Alliance has announced a new cloud security certification here.

No attempted wit, humour nor sarcasm could do this justice so I will sign off now.

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.

]]>
4
Drazen Drazic <![CDATA[Local Scene Roundup…….]]> http://beastorbuddha.com/?p=2473 2010-07-26T08:44:06Z 2010-07-26T08:44:06Z Great to see the local scene just kicking on. So much going on now and no shortage of things to attend.

——————————————————————————————–
Ruxcon 2010: 20-21 November, 2010 (Melbourne). Details and CFP information:
http://www.ruxcon.org.au

Monthly Ruxcon meetings (Ruxmon) in Melbourne. Details:
http://www.ruxcon.org.au/2010-rmmm.shtml

Kiwicon 2010: 27-28 November, 2010 (Wellington, NZ). Details and CFP information:
https://www.kiwicon.org/

Owasp seems to be pretty active with monthly meetings (or almost now), regular events in Sydney, Melbourne, Perth. Contact your local city chapter for more information, or if there is up to date information on the Owasp website, could someone let me know? (I am on the mailing list).

AISA (Australian Information Security Association) membership is now over 1000. Sydney, Melbourne, Brisbane, Canberra and Perth hold monthly meetings plus social events and the Annual Seminar Day will be the biggest ever in 2010. With membership still only still $50, it’s worth having a look. Details on AISA and upcoming events for all cities:
http://www.aisa.org.au/

Australian Information Security Bloggers Directory and Twitter accounts here.

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.

]]>
4
Drazen Drazic <![CDATA[….but I ain't as good as I once was….]]> http://beastorbuddha.com/?p=2469 2010-07-24T14:32:54Z 2010-07-24T14:32:54Z Yeah….I ain’t…but I love this…but I never was….!

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.

]]>
1
Drazen Drazic <![CDATA[White House Releases National Strategy for Trusted Identities in Cyberspace]]> http://beastorbuddha.com/?p=2465 2010-07-20T01:35:12Z 2010-07-20T01:35:12Z Release from ANSI. (I’ve included this as an FYI for Australian Information Security people). This link below has the content of the email sent out recently.

Related post regarding recent Australian Government activity here. Coordination? Focus? Lessons?

———————————————————————————————
White House Releases National Strategy for Trusted Identities in Cyberspace
http://www.ansi.org/news_publications/news_story.aspx?menuid=7&articleid=2576

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.

]]>
0
Drazen Drazic <![CDATA[Additional funds for policing, cyber-safety and protection of children….]]> http://beastorbuddha.com/?p=2462 2010-07-12T03:09:15Z 2010-07-12T03:09:15Z From memory, the co-sell with the Internet Filter by Stephen Conroy was a promise of additional funds for policing – cyber-protection of children. Have I missed something? Has any of this kicked off or is it just an ongoing promise as part of the ongoing Internet Filter promotion?

Previous posts: http://beastorbuddha.com/category/internet-filtering/

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.

]]>
1
Drazen Drazic <![CDATA[The Tigers help Trend Micro – No Benji sidestep though….. :)]]> http://beastorbuddha.com/?p=2458 2010-07-08T12:46:49Z 2010-07-08T12:46:49Z

And the proudest moment: Grand Final Premiers 2005. (Had to add that. Never thought it would happen!)

Could almost buy Trend Micro now. Who says marketing doesn’t sell?! :)

———————————————————————————————-
Securus Global: IT Security, Penetration Testing, Security Assessments, PCI Compliance, Product Assurance, QualysGuard, Security Strategy, Vulnerability Assessment.

]]>
4