5 ms·

Cybersecurity is one of my roles I suppose (small place with an operations team of approximately 2.5), and I have to say that I have no idea what proper securit

Cybersecurity is one of my roles I suppose (small place with an operations team of approximately 2.5), and I have to say that I have no idea what proper security is supposed to mean today; it's very hard for me to tell the marketing from best practice now. It seems like what most products really are is an ass covering service so you can tell your leadership and your customers that you did the right things. Basically we work on keeping everything patched and try not to create any obvious issues. Honestly, I think the best thing we have going for us is obscurity.

nannal 4y ago
Consult with a security firm or specialist and they should be able to steer you in the right direction.
- chadash 4y ago
  Two problems with this: 1) Like a car mechanic, these people get paid to sell you solutions and they are incentivized to sell you more. 2) Plenty or honest people have biases because of what they do. If you spend all day thinking about security you might be overly concerned about things that are actually not that risky. This isn’t to say that there aren’t great people working in the field. But it’s daunting from an outsiders perspective.
  - analyst74 4y ago
    It's still comes down to a matter of urgency or value perception. You don't want your doctor to overlook any problems just because they are rare because your health is really valuable.
    - SketchySeaBeast 4y ago
      With the example of the doctor you run into the nocebo effect - you can spend a lot of time tracking down things that turn out to be of very low value which ends up causing more harm than good. To painfully extend the metaphor you could have an overly aggressive password policy and end up having users reusing passwords or writing them down.
  - mrex 4y ago
    Develop sufficient in-house subject matter expertise so that you're not depending on sales consultants to do your cyber program for you. Develop an empirical understanding of risk management. While we can't predict the future, through well established techniques and adequate resourcing, professionals can achieve consistent results that are far better than random guessing. Risk management principles drive not just corporate stragegy writ large, but entire industries like banking and insurance.
  - nannal 4y ago
    To answer points 1 & 2, you're more than permitted to think for yourself and establish if their recommendations are worth perusing. You could even get multiple opinions and see if there are any recurring themes that might suggest areas to look at first.
gsatic 4y ago
Corporate robots don't care. They have gotten away with so much for so long, they live in their own disconnected reality. When things break some of them cash out. Others find someone to blame. They don't pay a price at all. And the cycle continue. In China atleast people are scared of the govt. In the west its a total joke how no one is ever held responsible.
- coliveira 4y ago
  - dd36 4y ago
    Right. Democracy is fake…
- 12many 4y ago
  Yikes, I wouldn't boast about being scared of a govt. That's on the cusp of being fascist.
  - reitanqild 4y ago
    Isn't the ideal something like: Citizens should respect Government, and Government should fear citizens? I think we are straying away from both of these at the moment.
  - kvathupo 4y ago
    I think the commenter brings up an interesting point that China more effectively regulates industries that commit wrong [1]. I wouldn't reduce their point to being tantamount to fascism; rather, I read @gsatic as arguing for equal application of the law. This seems fundamental to the US constitution vis à vis John Locke: people (corporations in this case) cede rights for security. If we give corporations regulatory fines that pale in comparison to revenue as a result of malfeasance, are we allowing companies to enjoy our society's benefits, without having to sacrifice the same rights others do? [1] - Of course, this isn't the complete picture: China has a penchant for arbitrarily dealing a heavy hand to law-abiding companies/persons.
infosecSnowman 4y ago
I've recently gotten a lot of good guidance on security best practice from a new boss. A great place to start is the CIS 18 critical security controls. They cover most things for protecting an organization. Walk through the controls list, see where you compare to the controls and sub-controls and then start to establish a path forward.
markwisde 4y ago
I’m a security engineer and nobody knows what’s best practice. Everyone is making it up at this point, and security is still a nascent field. Most companies don’t even have a security team. I think it’s still not clear how you should build a security org, and if you should at all (should security be part of normal workstreams of your devs?) Btw I wrote about my experience in https://securityhandbook.io/ https://securityhandbook.io/
- dd36 4y ago
  Is there even best practice for non-cyber security at private businesses?
  - shagie 4y ago
    There is a best practice... but the issue is that the "best practice" is something that gets abused for cargo culting and stopping at the discovery of the best practice. Some time back, I got a copy of "A Practical Guide for Policy Analysis: The Eightfold Path to More Effective Problem Solving" so that I could properly quote back the use of best practices. https://en.wikipedia.org/wiki/Best_practice https://en.wikipedia.org/wiki/Best_practice With most times people are looking at best practices, they skip to the decide step without defining the problem - that's even been done here. Is there a best practice for non-cybersecurity at private business? Well, yes - but first, what is the problem that is trying to be solved? There's no "get this book of everything to do and you're good". On the other hand a "we have customer data that includes PII data, we need to secure the data and prevent casual examination of it in house" is a problem that can be looked at and a best practice can be found. The best practices involve a survey of looking at other organizations and seeing what they have done - what worked and what didn't. > Part IV "Smart (Best) Practices" Research - Understanding and Making Use of Whatlook Like Good Ideas from Somewhere Else > It is only sensible to see what kinds of solutions have been tried in other jurisdictions, agencies, or locales. You want to look for those that appear to have worked pretty well, try to understand exactly how and why they may have worked, and evaluate their applicability to your own situation. IN many circles, this is known as "best practices" research. Simple and commonsensical as this process sounds, it represents many methodological and practical pitfalls. The most important of these is relying on anecdotes and on very limited empirical observations for your ideas. To some extent, these are - one hopes - supplemented by smart theorizing. This method is never perfectly satisfactory, but in the real world the alternative is not usually more empiricism but, rather, no thoughtless theorizing. > Develop Realistic Expectations > Semantic Tip First, don't be mislead by the word best in so-called best practice research. Rarely will you have any confidence that some helpful-looking practice is actually the best among all those that address the same problem or opportunity. The extensive and careful research needed to document a claim of best will almost never have been done. Usually, you will be looking for what, more modestly, might be called "good practices." --- A "here is a list of all the best practices, follow these" is the wrong way to try to use best practices but rather relabeled cargo cult security.
dogman144 4y ago
Eval yourselves with the NIST Cybersecurity Framework and you’ll get a good idea of where to work on. It’s useful to guide an early stage security program doing all the things. Also, build a risk matrix of security risks the company can face by impact vs likelihood of the risk happening. Get someone senior to sign off on it. Use the NIST CSF and the risk registry with senior leadership support to guide the work you do. Itll be easier if you think about security as understanding your risk posture as an org, and that risk is either fixed at your level, carefully escalated to outside your teams for a fix, or labeled and accepted risk. security teams should never be the ones to accept risk, so get a a manager to see and acknowledge in writing whenever it’s decided to just roll with a known vuln you’re Unable to fix without more time/money/tech. Try to fix as many risks as possible at your level as to not build an alarmist rep. Then, that leaves space to escalate into cross-team fixes (and you can point to the NIST CSF and the risk register with a senior leader’s sit side as a baseline reason for why they need to fix it).
mellavora 4y ago
It is also about governance. Do you have runbooks for your systems? (describes how to operate the system normally.) What about playbooks? (how to handle errors) Have you game-day-ed various failures? How long does it take you to restore everything from backup? What order do you bring your systems up? What level of monitoring do you have on your systems? Can you spot unusual activity? How quickly? What sorts of firewalls? Say "system X" is compromised. How far could damage spread from there? Obscurity won't protect you when cybercrime is a business model.
trasz 4y ago
>It seems like what most products really are is an ass covering service You do have a pretty good idea then. Sadly, this is exactly what it looks like at the moment: because business decisions are made by clueless dummies, there’s no way to sell a proper product; to make money you need to focus on snake oil instead.

nannal 4y ago

Consult with a security firm or specialist and they should be able to steer you in the right direction.

chadash 4y ago
Two problems with this: 1) Like a car mechanic, these people get paid to sell you solutions and they are incentivized to sell you more. 2) Plenty or honest people have biases because of what they do. If you spend all day thinking about security you might be overly concerned about things that are actually not that risky. This isn’t to say that there aren’t great people working in the field. But it’s daunting from an outsiders perspective.
- analyst74 4y ago
  It's still comes down to a matter of urgency or value perception. You don't want your doctor to overlook any problems just because they are rare because your health is really valuable.
  - SketchySeaBeast 4y ago
    With the example of the doctor you run into the nocebo effect - you can spend a lot of time tracking down things that turn out to be of very low value which ends up causing more harm than good. To painfully extend the metaphor you could have an overly aggressive password policy and end up having users reusing passwords or writing them down.
- mrex 4y ago
  Develop sufficient in-house subject matter expertise so that you're not depending on sales consultants to do your cyber program for you. Develop an empirical understanding of risk management. While we can't predict the future, through well established techniques and adequate resourcing, professionals can achieve consistent results that are far better than random guessing. Risk management principles drive not just corporate stragegy writ large, but entire industries like banking and insurance.
- nannal 4y ago
  To answer points 1 & 2, you're more than permitted to think for yourself and establish if their recommendations are worth perusing. You could even get multiple opinions and see if there are any recurring themes that might suggest areas to look at first.

gsatic 4y ago

Corporate robots don't care. They have gotten away with so much for so long, they live in their own disconnected reality. When things break some of them cash out. Others find someone to blame. They don't pay a price at all. And the cycle continue. In China atleast people are scared of the govt. In the west its a total joke how no one is ever held responsible.

coliveira 4y ago
- dd36 4y ago
  Right. Democracy is fake…
12many 4y ago
Yikes, I wouldn't boast about being scared of a govt. That's on the cusp of being fascist.
- reitanqild 4y ago
  Isn't the ideal something like: Citizens should respect Government, and Government should fear citizens? I think we are straying away from both of these at the moment.
- kvathupo 4y ago
  I think the commenter brings up an interesting point that China more effectively regulates industries that commit wrong [1]. I wouldn't reduce their point to being tantamount to fascism; rather, I read @gsatic as arguing for equal application of the law. This seems fundamental to the US constitution vis à vis John Locke: people (corporations in this case) cede rights for security. If we give corporations regulatory fines that pale in comparison to revenue as a result of malfeasance, are we allowing companies to enjoy our society's benefits, without having to sacrifice the same rights others do? [1] - Of course, this isn't the complete picture: China has a penchant for arbitrarily dealing a heavy hand to law-abiding companies/persons.

infosecSnowman 4y ago

I've recently gotten a lot of good guidance on security best practice from a new boss. A great place to start is the CIS 18 critical security controls. They cover most things for protecting an organization. Walk through the controls list, see where you compare to the controls and sub-controls and then start to establish a path forward.

markwisde 4y ago

I’m a security engineer and nobody knows what’s best practice. Everyone is making it up at this point, and security is still a nascent field. Most companies don’t even have a security team. I think it’s still not clear how you should build a security org, and if you should at all (should security be part of normal workstreams of your devs?) Btw I wrote about my experience in https://securityhandbook.io/ https://securityhandbook.io/

dd36 4y ago
Is there even best practice for non-cyber security at private businesses?
- shagie 4y ago
  There is a best practice... but the issue is that the "best practice" is something that gets abused for cargo culting and stopping at the discovery of the best practice. Some time back, I got a copy of "A Practical Guide for Policy Analysis: The Eightfold Path to More Effective Problem Solving" so that I could properly quote back the use of best practices. https://en.wikipedia.org/wiki/Best_practice https://en.wikipedia.org/wiki/Best_practice With most times people are looking at best practices, they skip to the decide step without defining the problem - that's even been done here. Is there a best practice for non-cybersecurity at private business? Well, yes - but first, what is the problem that is trying to be solved? There's no "get this book of everything to do and you're good". On the other hand a "we have customer data that includes PII data, we need to secure the data and prevent casual examination of it in house" is a problem that can be looked at and a best practice can be found. The best practices involve a survey of looking at other organizations and seeing what they have done - what worked and what didn't. > Part IV "Smart (Best) Practices" Research - Understanding and Making Use of Whatlook Like Good Ideas from Somewhere Else > It is only sensible to see what kinds of solutions have been tried in other jurisdictions, agencies, or locales. You want to look for those that appear to have worked pretty well, try to understand exactly how and why they may have worked, and evaluate their applicability to your own situation. IN many circles, this is known as "best practices" research. Simple and commonsensical as this process sounds, it represents many methodological and practical pitfalls. The most important of these is relying on anecdotes and on very limited empirical observations for your ideas. To some extent, these are - one hopes - supplemented by smart theorizing. This method is never perfectly satisfactory, but in the real world the alternative is not usually more empiricism but, rather, no thoughtless theorizing. > Develop Realistic Expectations > Semantic Tip First, don't be mislead by the word best in so-called best practice research. Rarely will you have any confidence that some helpful-looking practice is actually the best among all those that address the same problem or opportunity. The extensive and careful research needed to document a claim of best will almost never have been done. Usually, you will be looking for what, more modestly, might be called "good practices." --- A "here is a list of all the best practices, follow these" is the wrong way to try to use best practices but rather relabeled cargo cult security.

dogman144 4y ago

Eval yourselves with the NIST Cybersecurity Framework and you’ll get a good idea of where to work on. It’s useful to guide an early stage security program doing all the things. Also, build a risk matrix of security risks the company can face by impact vs likelihood of the risk happening. Get someone senior to sign off on it. Use the NIST CSF and the risk registry with senior leadership support to guide the work you do. Itll be easier if you think about security as understanding your risk posture as an org, and that risk is either fixed at your level, carefully escalated to outside your teams for a fix, or labeled and accepted risk. security teams should never be the ones to accept risk, so get a a manager to see and acknowledge in writing whenever it’s decided to just roll with a known vuln you’re Unable to fix without more time/money/tech. Try to fix as many risks as possible at your level as to not build an alarmist rep. Then, that leaves space to escalate into cross-team fixes (and you can point to the NIST CSF and the risk register with a senior leader’s sit side as a baseline reason for why they need to fix it).

mellavora 4y ago

It is also about governance. Do you have runbooks for your systems? (describes how to operate the system normally.) What about playbooks? (how to handle errors) Have you game-day-ed various failures? How long does it take you to restore everything from backup? What order do you bring your systems up? What level of monitoring do you have on your systems? Can you spot unusual activity? How quickly? What sorts of firewalls? Say "system X" is compromised. How far could damage spread from there? Obscurity won't protect you when cybercrime is a business model.

trasz 4y ago

>It seems like what most products really are is an ass covering service You do have a pretty good idea then. Sadly, this is exactly what it looks like at the moment: because business decisions are made by clueless dummies, there’s no way to sell a proper product; to make money you need to focus on snake oil instead.