Information security mistakes are costly, damaging, and all too prevalent. Given the repercussions of poor security strategies (see recent incidents from organizations like TJX, AOL and the VA), one is inclined to believe change agents are in place.
However, organizations continue to drive their security efforts based on fallacies and myths, and make seemingly avoidable mistakes when it comes to information security. I'll present six common myths, in no particular order:
• Network Defenses will Protect your Kingdom
• Technology/Tools are the Panacea
• Only "Bad" People are Bad
• Security ROI is the Beacon
• Secure Software is Costly
• The Security Breach du Jour is the Most Pressing
1) Network Defenses Protect Your Kingdom
The problem isn't our networks (which are pretty well protected, by the way). It's the crappy software we write and put on the network.
There is no discipline or rigor to software engineering like there is in other engineering disciplines. I'm a mechanical engineer by trade with certifications that verify my expertise in this craft. There is no correlation in the software world and we, as organizations that build and buy software, aren't demanding a change.
Network defenses, like firewalls and intrusion prevention systems, have a place in a multi-layered information security solution, but they can't protect us from the majority of vulnerabilities – those in the application layer.
2) Technology/Tools are the Panacea
I love tools. I worked for a software testing tools vendor for more than five years. But I also recognize that tools alone don't make people smarter, nor do they improve the process through which solutions are built. They simply make people and processes more efficient in jobs they are trained to do.
Tools don't teach a surgeon how to operate. I didn't become a better mechanical design engineer because I learned how to use AutoCAD; it just made me more efficient in the job I was already trained to do. That's the problem. There is no training in the application development discipline and no rigor in holding teams accountable to maintaining secure infrastructures. Tools have their place in a complete information security workflow but they require people who know how to operate them to be effective.
3) Only "Bad" People are Bad
Causal hackers aren't the real threat. Hackers actually help trip landmines that are waiting to be exploited.
The real threats are organized hackers (think terrorist cells or enemy states) who could cripple our infrastructure, utilities and communication systems. Real threats are insiders who already have access and know where the crown jewels are. Companies focus on hackers but that is the wrong assumption. And they always forget that it's their poorly-written software that allows the hackers to exploit them in the first place. Fix the problem (bad software) and you mitigate the threats.
4) Security ROI is the Beacon
A recent Gartner survey noted that 25% of organizations are looking for a specific return on investment from information security investments. An additional 27% view it as a cost or risk avoidance investment, leaving only 48% of organizations that view security investments as a cost of doing business.
Until organizations let go of the desire to measure security ROI, they will never be satisfied with any investment therein. Your applications and data are liabilities, not assets. They are information security risks and liabilities that need to be mitigated, not exploited for ROI.
If companies thought about their applications as threats or liabilities instead of assets they'd treat them a lot differently, from conception through development and deployment. Think of security investment like an investment in term life insurance – you are mitigating risks associated with a liability, your mortality. We don't die every year, but does that mean term life insurance is a bad investment?