It has finally become hip not just to predict the demise of passwords, but to call for their elimination. The recent Wired article makes an eloquent case about the vulnerabilities that even "strong" passwords are subject to, such as social engineering and outright theft. And strength is, of course, relative and subject to degradation: The latest computer hardware can make short work of cracking more-complex secrets.
It's true: Static shared secrets are sitting ducks. But passwords are too useful to go away entirely, both because it's handy to be able to synchronize authenticator data between cooperating systems (and people), and because people find using passwords to be less invasive, fiddly, or personally identifying than a lot of other options. So I don't buy the whole "the era of passwords is over" thing. They will be at least one important element of authentication strategies for the foreseeable future -- it's a rare multi-factor authentication strategy that doesn't include a password or PIN somewhere along the line as one of the "things you know."
So, if that's our reality, let's think outside the box in using them. In talking with Mike Gualtieri recently as part of his TechnoPolitics podcast series, I mentioned a few ideas. I had thought of these as pet password peeves, but on the cusp of 2013, why not be positive and think of them as resolutions?
One of the really cool things about this analyst gig is that we get to field client inquiry calls – 30 minutes where we hop onto the phone to speak with our clients and answer their questions about the topics that we cover. As of the week before Christmas, analysts on the security and risk team have jumped onto over 300 inquiries so far this quarter when not on a plane or on site with a client (and this is a slow quarter given all the holidays!). Vendors are one topic that we discuss quite a bit with S&R pros because, let’s face it, there’s are vendors that are really good at marketing and there are also vendors that just haven’t shown up on your radar.
Research report ideas are often born from inquiries as we notice trends in the types of questions that are asked. As we continue to hammer out research agendas for 2013, we’re thinking of adding a new stream of research for our security playbooks: Vendors You Should Know. It would not be the same as a Forrester Wave which compares established vendors, but rather a report which highlights smaller, emerging vendors that are disrupting the existing market with a unique, innovative technology or service to solve a client’s painful challenge or perhaps alter current approaches to information security. It’s a report to recognize emerging vendors who raise the bar, but may not necessarily raise the most buzz. These would be living research documents that are updated periodically as market events and technological developments warrant changes.
S&R pros, does this type of research appeal to you? Which areas would you like for us to identify vendors you should know? What business and security challenges are you grappling with where you would like to see us profile emerging vendors that could help?
When you fly nearly every week, you can get pretty bored on a plane. When I am sick of working, playing games, or watching movies, my latest distraction is checking out laptop screens. Sometimes I'm curious what movie you are watching but other times I am interested in what type of confidential company information you are displaying for the world to see. In the past few weeks I have seen the following types of information on my fellow flyer's screens:
End of year/end of quarter sales numbers
Disciplinary emails regarding employee peformance
Pre launch marketing information (which I presumed to be under embargo)
Competitive displacement information
Most of the time I suggest that my fellow traveler invest in a privacy screen, and most of the time they are receptive to the suggestion. It really is astounding how many people don't spend the approximate $30 on one. If your company doesn't issue them, I suggest you work to change that stance. World readable aren't the permissions you want on your laptop screen, time for chmod (UNIX joke).
You remember the tribbles don't you? The cute, harmless looking alien species from the second season of the original Star Trek that turn out to be anything but benign. They are born pregnant and reproduce at an alarming rate. The tribbles threaten the ship, but fortunately Chief Engineer Montgomery Scott is able to transport all of the furry creatures to a departing Klingon ship. The tribbles remind me of technology investments:
You start out small, but before you realize it the technology is everywhere and you are overwhelmed. It ends up in places you never intended.
Like the relaxing purr of the tribbles, the flashing lights of racks and stacks of gear gives us warm comfort at night
Tribbles consume everything, just like the operational requirements of much of our technology investment: resources, budget, and productivity are all devoured.
Keeping up with the threat and IT landscape, looking ahead to future technology and disruptive technologies, and keeping up with the regulatory landscape to identify what it means to your organization is no small task. It’s also not a technology issue, but one that involves your most valuable asset: people. S&R pros, call it maintaining your security edge: keeping skills fresh, encouraging new ideas to flow, and preventing the security group from getting stale and set in their ways and habits. Fail to invest in your people, and an exodus of talent will the least of your concerns as a new type of internal threat is born. A security team and an organization that maintains their security edge will be better equipped to protect the organization and its assets through better decision making at all levels.
I’m kicking off research on this topic in the coming weeks, and would love to hear what you think it means to maintain your security edge. My initial ideas approach the topic from three angles:
Individual security contributors. These are the folks that need to keep their skills fresh and network with peers. Consider opening up opportunities for them to take continuing education courses, achieve certifications, or attend conferences. Encourage participation in online communities or social networks to connect with peers.
The security group as a whole. This is where group think may occur, and lead to less than optimal decisions, especially if there hasn’t been much focus given to the development of individual security contributors. Bringing in new blood and a fresh perspective with an external advisor can be beneficial. Or, perhaps, engage in information sharing with other organizations where appropriate.