Most Important Security Lesson

During a job interview several years ago, I was asked a question that has stuck with me ever since. The question was along the lines of:

“If you could offer one piece of security advice to your customer, what would it be?”

At the time, my immediate answer was “Education, education, education. Teach your employees about security as they are the weakest link in the chain.” Over the years since that interview (disclosure: I got the job), I have often thought whether I could have provided a better answer. In fact, when I interview candidates for jobs today I often ask them that same question to see what their response it. I receive a variety of answers, usually technical.

So far, I haven’t come up with a better answer. Sure, we need to enforce perimeter security as well as standard security best practice, such as “Least Privilege” etc, but I can’t think of a single more important security lesson that my lesson above. You can have a very mature Information Security Management System will all the right controls in place but if you have a compromised user, or even worse a compromised, privileged user, then many of those controls are ineffective.

It is commonly recognised that security controls are a combination of people, processes, and technology. I think, too often we pay too little attention to the people aspect. Security controls have to be looked at holistically, taking into account all three of these facets. That will ensure that you can minimise the potential loss when you are hacked.

Yes, I use the term “when” as opposed to “if”. Every day almost, we see reports of data breaches, many from companies with good security controls in-place. Therefore, I believe it is naive to think that your organisation is un-hackable. That is why it is so important to make sure you have the right security controls and training in place, before this happens, not after.

Protecting Children Online

Over the last two days I have had the privilege of participating in a summit of industry experts to look at innovative ways that technology can help prevent online sexual abuse of children. The event, organised by WeProtect, brought together over 80 individuals from around 40 companies to look at the threats and how they can be addressed.

It was great to see so many competitor organisations putting their differences to one side, leaving their company affiliations (and egos) at the door and instead working together, as individuals to come up with solutions to these very real threats to our children, not just in the UK, but globally. There were some fantastic and inspiring ideas generated that I hope we can build on and, as an industry, start to deliver over the coming months.

Of course, as expected some of these solutions are not overnight fixes and there is no silver bullet to solve this problem (or it would have been done already). However, there were some very pragmatic, tactical solutions that are eminently achievable without hvaing to move mountains.

It was a real honour to work with my industry colleagues at this event on such a difficult and emotive subject that everyone at the event was so passionate about. It’s time like this when I am really proud of the work that the collaboration of great minds can produce.

UK Govt – No preventative security measures for internal users. Are they mad??

Reading the Government Service Design Manual and especially the section on Security as an Enabler, I found an interesting paragraph in there, when talking about internal users, it states:

“It is the intention of the Civil Service Reform Plan and the new Security Classification Policy that there is greater emphasis on user responsibility, reducing expensive and overbearing technical controls. This requires proper training to assist users in handling sensitive information, and auditing to verify users are acting responsibly.

Users should be trusted to carry out their roles and given the responsibility to do so securely.

Audit and verification of user behaviour should be used to ensure policy compliance instead of preventative measures which add cost and degrade productivity. Such audit and verification should be implemented by services or network infrastructure, away from the end user device.”

I find this a shocking statement. You only have to look at the press or read the annual Verizon Data Breach report to show that the threat from insiders is growing (14% in 2013) with 13% of breaches occurring from privilege misuse or abuse.

It’s very brave (or stupid) to rely on detective controls and therefore close the stable door, only once the horse has bolted. Surely the cost and ‘degraded productivity’ should be measured against the increased risk and reduced compliance.

I would argue that to use security as an enabler, you must ensure that you do have the appropriate mix of preventative AND detective controls in place before you can enable those services that are going to provide the real benefits and savings.

What makes a good presentation

Working in the field that I do I have to present and receive lots of presentations. A few months ago I started to get really frustrated with the poor quality of people’s presentations. Sometimes, this was their speaking, sometimes it was their slides or materials. I decided that I wanted to change the way that I approached the whole issue of presenting.

Therefore, I have spent the last few months trying to improve my presentation skills, both in terms of speaking and the material that I use. One of the great inspirations for my change has been Garr Reynolds, whose book, Presentation Zen has really helped me to understand the good and bad points of design for powerpoint presentations. As a result of reading this book, I have started to change my approach. Here is an example of some slides I created which I have used recently in a couple of presentations I gave.

I have only used these slides on internal presentations so far, but they seemed to be received well compared to the more traditional approach. Hopefully, if he saw these, Garr would be proud.

The only problem I have with his approach is the length of time it takes to not only prepare the presentation content but also any accompanying handout (if required). I’m sure, as I get more used to this approach I will become quicker at it and can re-use much of the content.

Presenting, however, is not just about the slides that you use. In fact, sometimes you don’t even need slides. The most important part of any presentation is the message that you are trying to convey and the way that you get it across. I am currently reading Presenting to Win by Jerry Weissman and, whilst a lot of what he talks about is common sense, its amazing how many presenters seem to leave common sense at the door.

So, when watching presentations, how can I tell if the presentation is good or not. Simple, am I captivated? Lawrence Lessig is a fantastic example, as shown in the video below.

I’ve never heard Lawrence speak before and aren’t particularly interested in copyright (the theme of his presentation). However, for the 1hr 5mins that he presented, I was absolutely captivated. His combination of conversation and supporting materials made a very enthralling presentation. It just goes to show, a good presenter can capture his audience regardless of what he is talking about.

Authorisation comes full circle

I find it really interesting to look at access control of web-based applications to see how they have changed over the past decade.

When I first started working with Identity and Access management back in 1998/1999, web applications were still emerging and there functionality was limited. At that time people were building silo’d applications containing all of the security within each application. Then along came the web access management (WAM) vendors including Netegrity, Oblix etc. All of these vendors took a new approach to web application security. Their approach was to remove the security out of the application and instead, put it into a security framework which surrounded your applications. This became a common access point which provided a range of features including:

  • Web-based SSO
  • Authentication
  • Authorisation
  • Auditing

This was all well and good but as applications developed and became increasingly complex, it became harder to meet all of the applications’ security requirements through this framework. Sure, authentication was straight-forward. Lets authenticate the user and then pass a token to the application containing the user’s identity. This has been done over and over again and is now a very well-trodden path.

However, what about authorisation? This wasn’t so simple. Despite their claims of handling authorisation, the WAM products primarily worked on URL. They were able to carve up the URL into chunks and decide which user’s got access to which chunks. This was fine in some cases, but more often than not, was not enough for many applications.

As applications matured, there were more requirements to do complex authorisation based on defining access control at levels deeper than the URL. The WAM vendors answer typically was to pass some information from the user directory to the application and let the application perform that level of authorisation. I have deployed many WAM solutions during my consulting days. The majority of those used WAM to provide authentication but left the authorisation to the underlying applications. So, we ended up with a half-way house. WAM providing authentication and some high-level authorisation, with applications providing the more detailed authorisation. Not ideal!

Then as the market has matured even more, we see the advent of products like Oracle Entitlements Server which addresses this problem. How do we provide a solution which allows us to not only externalise authentication and the high-level (coarse-grained) authorisation but also the low-level (fine-grained) authorisation? We now have the answer to providing a complete solution in this area.

We can now use WAM to provide the authentication and coarse-grained authorisation whilst allowing an entitlements service to provide the fine-grained authorisation.

Surely, this is where the WAM vendors first imagined we would be, i.e. externalising all of the access control from the web application. It just seems that it has taken us a bit longer than expected to get there.