An Ignoble Experiment

BOSTON--Spurred on by the Target breach and other high profile breaches, the Securities and Exchange Commission is likely to issue mandatory rules on cybersecurity disclosures for public companies in their SEC filings--rules based on the voluntary staff guidance the regulator issued in 2011, explained Jason Weinstein, a partner at the law firm of Steptoe & Johnson specializing in cybersecurity, at the SANS Security Leadership Summit being held here this week.

In October 2011, the SEC issued staff guidance advising companies to disclose information about cybersecurity risks and cyber incidents in their SEC filings.

In the guidance, the SEC explained that "federal securities laws, in part, are designed to elicit disclosure of timely, comprehensive, and accurate information about risks and events that a reasonable investor would consider important to an investment decision. Although no existing disclosure requirement explicitly refers to cybersecurity risks and cyber incidents, a number of disclosure requirements may impose an obligation on registrants to disclose such risks and incidents."

This guidance was advisory in nature, not compulsory. However, recent public breaches are pushing the SEC in the direction of making the guidance recommendations mandatory," explained Weinstein.

"The rules will be based on the guidance; they will be basically the guidance converted into more prescriptive language," he said.

In a letter to the SEC sent last year, Sen. John D. Rockefeller (D.-W.Va.), chairman of the Senate Commerce Committee, urged the then new SEC Chairman, Mary Jo White, to make the guidance mandatory. "Investors deserve to know whether companies are effectively addressing their cybersecurity risks--just as investors should know whether companies are managing their financial and operational risks. This information is indispensable to efficient markets, and as a country, we need the private sector to make significant investments in cybersecurity."

Not everyone agrees. John Mutch, chairman of security firm BeyondTrust, argued in a Forbes column: "Having been CEO of a public company and now as CEO of a global enterprise software company which provides cyber security and compliance solutions to many public companies, I can attest to the growing complexities and pressures of supply (threats and risk to operations) and demand (regulatory requirements) that must be managed on a daily basis. This is going to be an even steeper climb if the SEC requires companies to disclose on their cyber risk."

For more:
- check out the SEC's staff guidance
- see the Rockefeller letter
- read Mutch's Forbes column

Read more about: Steptoe & Johnson, SEC
back to top

This week's sponsor is HP.
	Reputation Whitepaper A study by Verizon finds 86% of security breaches come from the outside. Spotting cyber attacks in your network means identifying the signatures of known threats. Reputation data takes that one step farther by identifying communications coming from or going to known bad actors based on their reputations. Read this white paper now for more details.

2. Security 'game changers' for forcing IT security pros to 'do things differently,' says SANS chief

By Fred Donovan

Comment |

BOSTON--There are five top security "game changers" that are going to "break the way we are doing security" and force IT security pros to "do things differently," explained John Pescatore, director of the SANS Institute, during a presentation at the SANS Security Leadership Summit being held here this week.

The five top security game changers are 1) consumerization of IT, 2) increased use of virtualization and cloud, 3) the Internet of Things, 4) supply chain integrity concerns, and 5) increased threat targeting and better evasion techniques.

With the consumerization of IT, the IT staff has less control over increasingly heterogeneous user devices.

"The strategies we had for controlling security on the user devices were dependent on IT dictating [equipment] and our security strategies were based on IT control of devices. IT is not going to have that level of control ever again. Heterogeneity is what every IT organization is going to have to deal with," stressed Pescatore.

To reduce costs, firms are increasingly turning to virtualization and cloud services. "With virtualization, IT can spin up badly configured servers much faster ... Doing the wrong thing faster rarely increases productivity and security," Pescatore notes.

"Once you start using public cloud services, you run into the same phenomenon that you run into with employee-owned devices--business can use those services without going through IT… IT security strategies of putting firewalls around data centers won't work anymore," he adds.

The Internet of Things is creating massive new data sources and increased machine automation. This reduces costs and improves productivity, but it also creates billions of new vulnerable endpoints and connections.

"The ways we were used to doing security with the old-style devices don't work with the Internet of Things," he said. "A lot of these Internet of Things sensors are used in environments where even a denial of service attack could lead to loss of life," he added.

On supply chain integrity, Pescatore observed: "we have to look at third party equipment and software to deter if they are dangerous." He cited the allegations that Chinese telecom gear manufacturer Huawei was putting backdoors into network equipment being sold on the commercial market.

"By looking at our supply chain and doing what we can to eliminate vulnerable or dangerous software getting into our environment, we can cut down the aperture and shorten the incident response time," he said.

Finally, attackers are increasing the targeting of specific people, organizations and data while improving their evasion techniques. Pescatore cited the Verizon Data Breach Investigations Report, which found that most breaches were low difficult intrusions and many of them were discovered by third parties, such as customers who suffered identity theft as a result of the breach.

Pescatore concluded that IT security pros need not only identify and address these game changers, but also communicate these effectively to senior management so they can get the resources to solve these issues.

3. IT downtime from attack or infrastructure failure can cost firms more than $1M per hour

By Fred Donovan

Comment |

IT downtime caused by an attacker or non-malicious infrastructure failure can cost firms more than $1 million per hour, as well as increase data security risks, according to a survey of 283 IT professionals and end users by security firm Globalscape.

A full 60 percent of respondents estimated that an hour of downtime can cost their firm between $250,000 and $500,000, and one in six said it can cost $1 million or more.

"Downtime, while understood to be tremendously costly and frustrating, has become commonplace and even expected in the enterprise. Oftentimes, downtime can be avoided, and companies should expect more from their vendors," observes James Bindseil, president and CEO of Globalscape.

More than half of executive-level employees polled said that they grappled with system downtime at least once a month.

"When core systems are unavailable, productivity suffers. And while lost files or the inability to send email may not have an 'assigned' value, per se--organizations lose money every minute a core system is unavailable," the report warns.

To prevent unexpected data loss, employees turn to risky document handling practices. According to a separate survey of 500 corporate employees Globalscape conducted with the Ponemon Institute, 63 percent of employee said they use remote storage devices, like USBs, to transfer confidential work files, 45 percent use consumer sites like Dropbox and Box to share sensitive files, and 30 percent of employees use cloud storage services.

"When employees use consumer-grade alternatives, frustration and productivity issues quickly evolve into serious security and compliance vulnerabilities, repeatedly putting organizations and their customers at risk," the report explains.

For more:
- check out the Globalscape release
- read the full report (reg. req.)

Read more about: public Cloud Storage
back to top

4. When you go to the board, speak in their language, not yours

By Fred Donovan

Comment |

BOSTON--When IT security pros brief the executive board, they should use language that senior executives can relate to, such as the impact of security on profits and losses, not language used by the IT security team, James Tarala, senior instructor at the SANS Institute, told an audience at the SANS Senior Security Leadership Summit being held here this week.

"People in the security space need to communicate in the language that executives understand. The more we talk about the configuration of our firewalls, the more they tune out. The more we can talk in terms of profit ratios or sales quotas, the more likely we are going to catch their attention and start having an impact on the organization," explained Tarala.

One way to bridge the "language gap" is for IT security pros to use metrics to measure progress in security and communicate that progress to business leaders. "What is measured improves," Tarala said, quoting management theorist Peter Drucker.

Jack Nichelson, global information security and network manager at graphite products supplier GrafTech International, told the audience that he implemented a metrics-based IT security program at his firm. "I mapped the metrics that mattered to the initiatives I was trying to achieve. I wasn't trying to eat everything. I was just targeting what mattered most to my goals and I made sure those goals resonated up the chain to who was sponsoring the program," Nichelson related.

Drawing on insights from the Six Sigma program for process improvements, Nichelson developed a large board that provides an overview of all of the IT security initiatives, programs and performance at GrafTech. "We rolled this out for security because I wanted to not just keep the metrics in IT, I wanted to them to be public," he said.

"You want to make sure you are not just reporting metrics, but you are creating actionable results from those metrics," Nichelson added.

Read more about: Peter Drucker, Information Security
back to top

5. Network segregation is the best solution for diverse university environments, say IT pros

By Fred Donovan

Comment |