2015-03-09

implementing is not establishing

Implementing something is about solving a problem, finding a workable technical solution, showing that it can be done.

Establishing something is about making it happen in the real world. Communicating the implementation to stakeholders, gaining their acceptance, understanding and commitment to use it. Integrating it into their processes, making it part of their business-as-usual.

From firewalls to access control models - implementing is not establishing. Security folks should ponder the difference.

2015-02-16

security is about timing

Beside the who, the how and the where - security is a lot about the "when".

In the best of worlds, you will be able to deter an adversary from even trying to compromise your system.
If not, can you prevent the attack from succeeding?
If not, can you detect the intrusion in a timely fashion?
Once detected, can you contain the attacker and prevent a wider compromise?
Finally, can you swiftly restore your system to agreed service levels?

Better get the chronology straight. Security is a lot about timing.

2015-02-12

obligatory quality

I'm reflecting on Business Continuity Planning. The ability to withstand the unexpected and carry on, serving customers as best you can.

Two observations.

The field is compliance-driven. Before the advent of regulation, interest was lukewarm at best. Whatever happened to self-preservation? Haven't we learned anything from 9/11?

Terminology is confusing. Guidance refer to several categories of plans. Relating them and putting them in context is left as an exercise for the layman. A challenge for us educators!

2015-02-04

still blogging, a decade down the line

Ten years ago I got an idea. It was rather trendy in those days, having your own blog. One purpose soon emerged though. I wanted to practice my English. The topics have been widely varying, so picking a generic blog title proved useful.

I used to be interested in politics, as became apparent in the first posts:


In recent years I have shifted focus. When I got started within the security realm, I chose to devote the blog to precisely that:


As for the next ten years, who knows? What will be my perspective?

2015-01-26

assets and motives

How do they do it, asks the technician.

Why would they do it, asks the criminologist.

Considering motives is a great way to analyse potential abuse. What are the assets? What could make an adversary attempt to compromise the system?

If you run a bank, one answer is obvious. But people are not driven merely by financial gain. Revenge, power, politics, publicity, and let's not forget curiosity ("because I can"). The list goes on.

Get those assets and motives straightened out before calling the technician.

2015-01-05

trusting a system

In the best of worlds, we could all trust each other not to compromise security qualities of information - neither intentionally nor accidentally.

In the real world there is not sufficient trust in this regard. Instead, we need to implement protective measures to uphold sufficient information security. When we cannot trust other parties as much as we like to, we need to establish trust in our protective measures instead.

What does it mean to trust a system? How do we create and maintain such trust?

2014-12-31

go see!

It was just another wild idea. Together with a friend I made several long rail journeys through Sweden. We were in our twenties and found train-riding to be the ultimate pastime. Solving philosophical problems with a soul-mate, a cup of tea in the restaurant car and this lovely land of ours passing by outside the window. It was just for a winter, then we went different ways but the idea was already forming in my head: go see Sweden! There's so much to enjoy, it's a huge country with very distinct seasons. Take a year, spend some money, do it right.

Eighteen years went by and my idea lay deep in the pile of dreams-never-to-be but somehow I couldn't let go. Finally in October 2003 the time was right. I was on a three-week trip through France and Italy and I was bored stiff. Having the Mediterranean glittering outside the first-class-compartment and a ticket for Sicily in my wallet was just fine, the train-tour had cost a small fortune but I was homesick.

By the time of Christmas I made the decision. I had been saving vacation time without any particular purpose. Now here was my purpose. On New Years Eve I went to Stockholm Central Station and purchased a twelve-month first-class rail-pass. The time had come to go see Sweden 2004.

(edited, previously posted 2005-03-03)

2014-12-15

security without trust

The effect of investing in security depends on the actual level of security achieved in the system. It also depends on the degree of trust from my stakeholders.

Imagine a system with perfect security which - for whatever reason - isn't trusted by those who should depend on it. Their distrust might appear totally irrational to us. That doesn't matter. It's not our call. Our effort is a failure.

Putting all our money into "actual" security and ignoring the need for assurance is a recipe for failure.

2014-11-24

on elusive security requirements

A system should have certain properties (but not others). It should do certain things (but not others). It should be handled (or interacted with) in certain ways by certain parties (who should not be allowed to do things differently) while an authoritative party enforces this state of affairs by means of policy.

All this is subject to change without notice due to changing factors such as regulations, architecture or risk.

Functional, non functional or derived - no wonder security requirements are elusive.

2014-11-03

question the cook book

Security is a process. It keeps the bits and pieces together over time - risk, requirements and testing. Case closed? Maybe not.

Legacy systems, management priorities and sourcing are three examples of circumstances that challenge our theories and force us to question the cook book.

What do you do when the terrain simply doesn't match the map? Be flexible. Don't lose the process - you will be needing it more than ever! - but identify hurdles, prioritize which ones to confront, mitigate and adapt.
20141025