Staying cheerful despite Barriers to Information Security

Sometimes it's hard to be positive when you work in information security. I have noticed a number of my colleagues get very despondent that they are unable to change the status quo at their respective organisations.

I'm an eternal optimist, and I think it's the job of information security professionals to be constantly active in attempting to improve the state of information security. You've got to keep a ducking and a diving with the grace of Muhammad Ali, taking the opportunity for a tactical win when the rare opportunity exposes itself.

Some maxims that are useful to keep in mind:

1. Success is defined as having the information security program aligned with the business's desired residual risk level. Some notes to consider below:

• management must make the informed decision to run "cheap, lean and risky" not be blindsided by security incidents
• security done well can be a competitive advantage to a business by reducing the costs of doing business when compared to their competitors (i.e. reduction in losses and security cap-ex and op-ex with no increase in risk)
  

2. Funnel the kick-back from a security incident into a productive pre-planned effort. " Oh sir, we've responded well to the incident, however this could have been prevented by the use of a DLP program which we had on the budget request last year".

3. Most intrusions (according to the 2009 Verizon Data Breach Investigations Report) are due to year old vulnerabilities so don't focus on obscure stuff and forget the basics like secure configuration/deploying security patches/ squishing SQL injection vulnerabilities.

Some common challenges encountered and tactics to consider:

• when "bottom up" vulnerability management efforts stall due to business application owners not approving costs/outages for secure configuration/patching/remediation of application security issues try "top down" approaches such as developing a security charter in conjunction with executives and then from that developing a security policy set (aka ISMS) that requires "vulnerability management"
• when information asset classification efforts are failing due to lack of business process documentation and inventory and asset management processes, try some inventory activities yourselves (i.e. some port scans) and share the results with the operations team to kick-start efforts.

If some more problems and tactics come to mind I'll re-edit this post later on.