Reconcile This

I had to check the date to make sure that it was't 1995 when I read this: 

The survey of IT pros and C-level executives from 450 Fortune 1000 companies -- commissioned by FishNet Security -- also found that 45 percent say firewalls are their priority security purchase, followed by antivirus (39 percent), and authentication (31 percent) and anti-malware tools (31 percent).

And what threats are these IT Pros and C-level execs concerned about?

Nearly 70 percent say mobile computing is the biggest threat to security today, closely followed by social networks (68 percent), and cloud computing platforms (35 percent). Around 65 percent rank mobile computing the top threat in the next two years, and 62 percent say cloud computing will be the biggest threat, bumping social networks.

Let's see what do mobile computing, social networking, and cloud computing all have in common? Oh yes, they all bypass the firewall's "controls"!

How do you reconcile spending on something (firewalls) that does not address any of your top threats? This dichotomy is infosec's biggest problem. We have plenty of good controls and processes to use, what we don't have is enough talent in infosec to integrate them and put them to use. 

The reason infosec has such a focus on infrastructure and network security has nothing to do with those being the primary threats, its because that is the background of most people in infosec. The infrastructure mindset is hardwired into enterprise infosec culture to the point of blinding themselves to their own recognized threats.

How does this get reconciled? Apparently, its not reconciled by the majority of infosec practitioners, but it does get reconciled; it gets reconciled by threats who feast on this yawning gap between firewall theory and threat reality. At least infosec got one part right:

The respondents were fairly fatalistic about breaches: more than 90 percent of the respondents expect the number of data breaches to increase, and nearly 60 percent expect theft or loss of mobile devices to make up the majority of breaches. Around 54 percent say organized cybercrime would be the source of most breaches, and 52 percent, accidental data exposure.

Well done. I concur, breaches will increase and the reason they'll increase is every dollar you spend on last decade's threats is a dollar you don't spend making the criminals' life harder. I wonder if the infosec managers who spend so many dollars on firewalls get holiday cards from organized crime?

Comments

[Andy Steingruebl]

Ok, but if they are wrong about the countermeasures, why do you think they're right about the threats?

I'll point out again that if you look at number of attempted attacks on a raw internet connection, the majority of them are un-targeted attacks against OS and Middleware, not against applications. They are worms, scanners, etc. I don't know if the honeynet guys have current number about quickly you get owned without basic packet filtering and turning off services, but I bet you don't survive long.

Maybe you think we ought already to have fully invested in technologies to stop those attacks and start focusing our efforts higher up? Not sure....

[Michael Janke]

"How do you reconcile spending on something (firewalls) that does not address any of your top threats?"

Could it be that the reason application attacks are the top threat because most systems *are* firewalled? And that spending money on firewalls is the reason that other threats are *not* the top threat?

Or - could it be that IT managers look at 'security gateways' as firewalls and buy them out of the firewall budget? Add layers 4 through 7 to the firewall and set some more policies?

Speaking of 1995... that would be about where we'd be if we stopped spending money of firewalls. Land attacks, smurf attacks, ping 'o death...

Firewalls are necessary, not sufficient. It's been that way for the last decade, and will be for the next. Enterprises will spend money of firewalls for at least the next decade. If anything, they'll buy more and smarter firewalls - so that they can isolate and protect internal users and applications from each other, micro segment applications and databases, create PCI and HIPAA islands, and [...drumroll...] so that they can protect higher layers in the stack.

[Curphey]

I bet FishNet (whoever they are) also magically sell Firewalls, AV and other such magic ;-)

[LonerVamp]

I would tackle this bit of data by focusing on the 3 top concerns, rather than attacking the top 3 budget items.

I'd note that those top 3 things are alarmingly new, or at least currently growing out of control. Maybe they are:

- so new that we fear them more

- too new to have solid approaches to tackling the issue (at least that are as widely known and accepted as things like firewalls/AV)

- too new to have real budget items, unlike product lines like firewalls and AV. I don't know of any box an exec can demand to buy that says "secures cloud" or "sanitizes social media."

- too new to even know how business wants or can use these items effectively, or how to control them. Especially for things that start making their ways into business from consumerland (mobiles, social media, and various definitions of what cloud is). If the business doesn't even know how to use them yet, I'm not sure security is in any position to guide that usage securely.

- sort of related, but these 3 items are business-pushed (or consumer-pushed) as opposed to firewalls, AV, and AM which are really IT dept solutions. Does this mean we aren't matching business? Not necessarily. It more likely means business desires/processes are more complex than just blocking specific bits or ports or signatures or even behaviors.

Maybe in 10 years mobile device (as we know them today) security will be as old habit as firewalls?