My fellow CISSP and author Walter Jon Williams observed that
Paranoia is not a part of any mindset. It is an illness.
Ah, Walter the literalist!
Yes I agree with what you say but look at it this way
"We're paid to be paranoid" doesn't mean we're ill.
It's a job.
Now if your job is an obsession, one you take home with you and it interferes with your family life, that you can't let go, then its an illness whatever it is.
"We're paid to be paranoid"
Its a job. You don't pay us Information Security Professionals to be pollyannas, to have a relaxed attitude.
Many of us come from a military or law enforcement background, some having served at the sharp edge of confrontations. The sharp edge isn't always the "mud and guns", sometimes its watching a screen or sifting
through intelligence reports or forensics or after action reports or ...
But if you don't have (a) a suspicious mind and (b) 20-20 peripheral vision about threats and contingencies and (c) a complete lack of silo-ization, then you can't be doing a good job in those roles.
Perhaps there are "pen testers" who know everything about breaking in to a network. Ranum and others have written on why such people are not really "security professionals": part of that is their silo mind-set.
We see similar rants about "jumped-up system administrators".
Many of us here are engineers or have an engineering background or education. Engineers, I've found, often operate on the expectation that things *will* go wrong, stuff *will* break, it *won't* perform to manufacturers specs. Not all of that is experience, a good part is education since they are tight how to build indefinitely reliable stuff
out of unreliable parts - given the budget and opportunity. And if Engineers are sceptical about anything, its Budget.
So when it comes down to a quick description of this "suspicious" mindset, one that is not confined to a narrow silo but covers all the domains of the CBK and possibly more (perhaps you too read Risks Digest and GrandPaRob's book reviews, one that would qualify you for various TLA organizations of which we choose to discuss only in unfavourable terms, _what_ word or phrase are you going to use?
I agree, Walt, the definition of 'PPD' in DSM-IV is unpleasant and not one that I would like to be applied to me:
Paranoid Personality Disorder
A pervasive distrust and suspiciousness of others such that their
motives are interpreted as malevolent, beginning by early adult-
hood and present in a variety of contexts, as indicated by four (or
more) of the following:
- Suspects, *without sufficient basis*, that others are exploiting, harming, or deceiving him or her.
- Is preoccupied with *unjustified doubts* about the loyalty or trustworthiness of friends or associates.
- Is reluctant to confide in others because of *unwarranted* fear that the information will be used maliciously against him or her.
- Reads hidden demeaning or threatening meanings into benign remarks or events.
- *persistently bears grudges* (i.e., is unforgiving of insults, injuries, or slights).
- Perceives attacks on his or her character or reputation that are not apparent to others and is quick to react angrily or to counter-attack.
- Has recurrent suspicions, *without justification*, regarding fidelity of spouse or sexual partner
I'd note on reading the above that if that definition were to be applied to a nation state or its security apparatus then many countries of the Western World and quite a few of the ones in the Eastern World can be clinically diagnosed as being 'paranoid'.
That page I reference goes on to define 'Schizoid Personality Disorder'.
The 'solitary' and the 'religious' parts seem contradictory, but one wonders.
The point I think is key to what you say, Walter, we need a better way and yes what we are doing is Risk Analysis. I think that Risk - the probabilistic aspect - is important and differentiates from the think-tank prophets of doom,
even though the latter grab headlines and produce responses from politicians - vis Global Warming and many such in the past.
Good managers understand risk.
Perhaps this is why the ISO-31000 people talk of 'risk' in terms of uncertainty and allow for an upside. They see a risk of winning a lottery.
The "paid to be paranoid" view is important. A lot of the time in my career I've been paid not to be paranoid but to find controls and opportunities. Perhaps this is the ISO-3100 aspect.
That being said, I think the ISO-31000 people have twisted the language a fair bit and become obsessional in their won way. You don't insure against success. Much of our culture is really about controls and safety nets. That doesn't - shouldn't - destroy hope and progress.
In my DatabaseOfDotSigQuotes is this
If a better system is thine, impart it;
if not, make use of mine.
The phrase "Paid to be paranoid" is succinct and catchy -- and no that doesn't mean your objections are wrong, Walt. But not everyone lives & dies by DSM-IV. And yes I agree with the rest of you post about what we should be projecting as an image.
But can you or anyone else come up with something better, something still succinct and still catchy?
I'd be glad to hear it an make use of it.
An article on Linked entitled 'The Truth about Practices" started a discussion thread with some of my colleagues.
The most pertinent comment came from Alan Rocker:
I'm not sure whether to quote "Up the Organisation", ("If you must have a policy manual, reprint the Ten Commandments"), or "Catch-22" (about the nice "tidy bomb pattern" that unfortunately failed to hit the target), in support of the article. Industry-wide metrics can nevertheless be useful, though it's fatal to confuse a speedometer and a motor.
However not everyone in the group agreed with our skepricism and the observations of the autor of the article.
And Anton aren't the controls you advocate so passionately best practices? >
NOT. Make that *N*O*T*!*!*! Even allowing for the lowercase!
So I need to compile a list of ALL assets, information or otherwise,
That leads to tables and chairs and powerbars.
OK so you can't work without those, but that's not what I meant.
Physical assets are only relevant in so far as they part of information processing. You should not start from those, you should start from the information and look at how the business processes make use of it. Don't confuse you DR/BC plan with your core ISMS statements. ISO Standard 22301 addresses that.
This is, ultimately, about the business processes.
I often explain that Information Security focuses on Information Assets.
Some day, on the corporate balance sheet, there will be an entry
which reads, "Information"; for in most cases the information is
more valuable than the hardware which processes it.
-- Adm. Grace Murray Hopper, USN Ret.
Some people see this as a binary absolute - they think that there's no need to asses the risks to the physical assets or that somehow this is automatically considered when assessing the risk to information.
The thing is there are differing types of information and differing types of containers for them.
I get criticised occasionally for long and detailed posts that some readers complain treat them like beginners, but sadly if I don't I get comments such as this in reply
Data Loss is something you prevent; you enforce controls to prevent data
leakage, DLP can be a programme, but , I find very difficult to support
with a policy.
Does one have visions of chasing escaping data over the net with a three-ring binder labelled "Policy"?
Let me try again.
Policy comes first.
Without policy giving direction, purpose and justification, supplying the basis for measurement, quality and applicability (never mind issues such as configuration) then you are working on an ad-hoc basis.
On the ISO2700 forum one user gave a long description of his information gathering process but expressed frustration over what to do with it all all, the assets, the threats and so forth, and trying to make it into a risk assessment.
It was easy for the more experienced of us to see what he was missing.
He was missing something very important -- a RISK MODEL
The model determines what you look for an how it is relevant.
Java 7 Update 10 and earlier contain an unspecified vulnerability
that can allow a remote, unauthenticated attacker to execute arbitrary
code on a vulnerable system.
By convincing a user to visit a specially crafted HTML document,
a remote attacker may be able to execute arbitrary code on a vulnerable
Well, yes .... but.
In many of the InfoSec forums I subscribe to people regularly as the "How long is a piece of string" question:
How extensive a risk assessment is required?
It's a perfectly valid question we all have faced, along with the "where do I begin" class of questions.
The ISO-27001 standard lays down some necessities, such as your asset register, but it doesn't tell you the detail necessary. You can choose to say "desktop PCs" as a class without addressing each one, or even addressing the different model. You can say "data centre" without having to enumerate every single component therein.
How do you know WHAT assets are to be included in the ISO-27K Asset Inventory?
This question and variants of the "What are assets [for ISO27K]?" comes up often and has seen much discussion on the various InfoSec forums I subscribe to.
Perhaps some ITIL influence is need. Or perhaps not since that might be too reductionist.
The important thing to note here is that the POV of the accountants/book-keepers is not the same as the ISO27K one. To them, an asset is something that was purchased and either depreciates in value, according to the rules of the tax authority you operate under, or appreciates in value (perhaps) according to the market, such as land and buildings.
Here in Canada, computer hardware and software depreciates PDQ under this scheme, so that the essential software on which you company depends is deemed worthless by the accountants. Their view is that depreciable assets should be replaced when they reach the end of their accounting-life. Your departmental budget may say different.
Many of the ISO27K Assets are things the accountants don't see: data, processes, relationships, know-how, documentation.
"Once the hacker gained access to Honan's iCloud account, he or she
was able to reset his password, before sending the confirmation email
to the trash. Since Honan's Gmail is linked to his .mac email address,
the hacker was also able to reset his Gmail password by sending a
password recovery email to his .mac address.
Minutes later, the hacker used iCloud to wipe Honan's iPhone, iPad
and Macbook Air remotely. Since the hacker had access to his email
accounts, it was effortless to access Honan's other online accounts
such as Twitter."
Every new technology has people, the pioneers, who buy into the vendors hype ... and pay a price for that.
We should learn from them.
- Hard-Learned Lessons from the Honan Hack (lumension.com)
- 60-minute Security Makeover: Prevent Your Own 'Epic Hack' (pcworld.com)
- Former Gizmodo writer Mat Honan's hacked iCloud password leads to nightmare (nextlevelofnews.com)
- Apple Flooded with iCloud Password Reset Requests Amid Tightened Account Security Controls (macrumors.com)
- How Secure Is the Cloud, Really? (technewsworld.com)
Investigators say Antigua tried to pass himself off as an Air Force veteran, a member of NASA's Space Shuttle crew, even a doctor complete with hospital ID's and his own medical bag. He also had blue police-style flashing lights for his black Escalade
"We are going to go to whatever lengths that we need to travel to find out, is he really a threat or is he somebody living a very involved fantasy life," said Chief James Steffens.
Taking Cosplay too seriously?
From the left hand doesn't know what the right hands is doing department:
Ngair Teow Hin, CEO of SecureAge, noted that smaller companies
tend to be "hard-pressed" to invest or focus on IT-related resources
such as security tools due to the lack of capital. This financial
situation is further worsened by the tightening global and local
economic climates, which has forced SMBs to focus on surviving
above everything else, he added.
Well, lets leave the vested interests of security sales aside for a moment.
I read recently an article about the "IT Doesn't matter" thread that basically said part of that case was that staying at the bleeding edge of IT did not give enough of a competitive advantage. Considering that most small (and many large) companies don't fully utilise their resources, don't fully understand the capabilities of the technology they have, don't follow good practices (never mind good security), this is all a moot point.