1 Raindrop

Information Security Focus

One of the hardest challenges for information security is choosing where to focus. The game where you say "if you have $100 to spend, where would you spend them?" is a good game because it forces choices and prioritization. Just like a lot of Fortune 500, information security often backs into decisions, i.e. choosing not to choose is a choice, and then a lot of the budget gets eaten up by yesterday's legacy technologies. Instead, its better to look forward and choose processes, technology and architecture based on what threats, vulnerabilities and assets your program is dealing with today.

The mix that I have seen increasingly focuses on software and data. This is the most important for the business as well as the goal of many attackers. Problem is that most companies have hundreds if not thousands of applications and databases. So again we get the choice question - which one(s) to focus on? In terms of application security people we know that they comprise less than 5% of the developer population and so most development activity goes on without them, so where should they spend their time?

Web services are an interesting place for security people to focus on for the following reasons:

• Quantity - While there are hundreds or thousands of applications in a typical company, there are probably fewer than one hundred services (at least for now). By focusing on Web services, the security team has a smaller population to deal with.
• Assets - while there are relatively less services, the whole reason you write a service is for reuse and interoperability. Typically, you want to reuse data and functionality on a mainframe, SAP, Siebel or somesuch system.  But if the company is going to pay developers to write service front ends, wrappers or aggregators, then there is a high likelihood that its a valuable asset worth protecting. So the security team is now dealing with a smaller quantity of higher value assets. 
• Standards - software security is pretty hard. It helps to have reusable skillsets not just threat modeling but technical skillsets, since Web services rely on standards this gives the security team a place leverage expertise across multiple projects 
• Scale - If your software security team is less than 5% of the development staff, it needs to scale its impact, and web services are built for scale across the enterprise and beyond. 
• Trend - we continue to see more and more web services, the cloud is only the latest (and not last) iteration. If we want to avoid the hamster wheel of pain - protecting today's innovations with yesterday's security - then the time to act is now.

Web services are just one example, I think an interesting one, but just one all the same. Its worth some time to think about the technologies, processes, and organization that characterize your infosec team and see how they play against the above factors. Is there a chance to understand the space or is it boil the ocean? Does it map to your business assets? Do you have a way to leverage expertise across projects?For the new technologies - are people trained? How does the team/process/tech scale? Does it position your team well going forward?

These are all questions that should be asked periodically to determine focus areas. Otherwise by not choosing you are choosing to outsource your decision making process to the past and not dealing with present business, asset, technology and process realities. If you have a $100 to spend would how much would you spend on securing threats from 1995 versus from 2009? In 1995 how much of your business/process/tech was web enabled? How much is now?

Hey Kids, How About a Little More Innovation?

Tim O'Reilly's piece in the LA Times has a lot of people talking:

He is urging young entrepreneurs and engineers to stop making some of  the sillier software that lets Facebook users throw virtual sheep at  their friends or download virtual beer on iPhones, and instead start  making a real difference in the world.

He says it's not just the right thing to do, but also the smart thing  to do -- especially as the credit crunch spreads to Silicon Valley,  venture financing becomes scarce and start-ups have to retrench.

When this grizzled, 54-year-old tech-industry veteran talks, Silicon  Valley tends to listen, if only to argue with him.

This is actually about the 6th time I have heard this this year. I have to say I pretty much agree on the face of it. But I wonder if its not so much a generational question as its that computers are just not as challenging as they used to be. Writing PERL shopping carts and online editors were a challenge in 1995, not so much any more. Maybe the issue is that "kids" of today who want to work on enabling technologies and do real innovation have migrated off to biotechs and nanotechs. 

We still have a lot of problems to solve in computers, so don't get me wrong we can use help from the next generation. But you get the sense the industry is maturing and not this wide open greenfield like biotech and nanotech or early dotcom days. There are a lot of cool things going on, but a lot of it seems like incremental upgrades. Important yes, but earth shattering, not so much. Take for example, Infinera, very cool stuff but its your classic, "we don't make X, we just make X work better." product.  I am not complaining - as an engineer, I like reliability. As a security person, I need better security tools. As a digital citizen, I want things to work better. But you know all of us making better brakes, better airbags, and better seat belts, is not going to be as exciting as the building the first car. What was the last computer technology that was mind blowingly innovative to you?