There are many types of criminals. These include thrill-seeking hackers, politically motivated hackers, organized criminals after financial gain, and state-sponsored groups after financial gain and intellectual property or both. Any of these have the potential to break these capabilities through information loss, or denial of service. Business processes and their associated transactions need to look at information security as a key component of any architectural design we might create as Enterprise Architects.
Security architecture is dependent on the idea of “security.” Security by some definitions is the trade-off of convenience for protection. When I am unloading the car and have an armful of groceries, it's challenging to unlock the front door at the same time. Alternatively I could just leave the front door unlocked but that might invite guests I had not planned for. So I trade convenience for protection.
Security is often seen as in conflict with business users; however, security is a process that protects the business and allows it to effectively operate.
Security is in response to perceived business risks.
Security can be seen as a benefit and a business enabler and can aid organizations to achieve their business objectives.
While you are at the Forrester Security IT Forum in Miami, you might also want to attend my session on Managed Security Services Providers. In my role as an analyst, I speak to many security leaders that wrestle with the outsourcing question. Security is a sensitive topic and many security executives are uncomfortable transferring operational responsibility for this function to a third party.
This presentation will present techniques to help security managers make decisions on what they can trust to a third party and more importantly, what they should outsource to a third party. This should be a lively presentation and discussion on what is a sometimes-controversial topic. I hope to see you there.
At the upcoming Forrester Security IT Forum (November 9) in Miami, Florida, I will present information on President Obama's cybercrime legislative initiative. This presentation and discussion will focus on the pending legislation in Congress and the Obama administration’s proposal to strengthen cybercrime law. There is a real need for this. Today there are 46 states with cybercrime breach reporting laws. While similar, there are enough differences to make reporting more complex. In addition, these laws only address PII and do very little to address other types of cybercrime. This new proposal addresses both PII and attacks on the nation’s critical infrastructure. The proposal stiffens criminal penalties and provides for the Department of Homeland Security to serve as the “new sheriff in town” when it comes to cybercrime.
Also associated with this proposal is a mandatory reporting requirement for organizations that manage more than 10,000 pieces of PII in a twelve-month period, or who provide critical infrastructure. Critical infrastructure is a very broad definition and includes financial services, utility, healthcare, as well as other industries. Please join me in Miami, as we present and discuss the proposal and its impact on private industry. I hope you can join us.
Some of you may have seen the article in the New York Times by John Markoff (endnote1) announcing a paper to be presented at last week’s IEEE conference. This paper is an update to research conducted by a team at the International Computer Science Institute in Berkeley, California. The institute is associated with the University of California, San Diego and the University of California, Berkeley. A paper published by the team in 2008 Spamalytics: An Empirical Analysis of Spam Marketing Conversion outlines interesting research in the area the research team has coined as “spamalytics.”
The paper describes a methodology to understand the architecture of a spam campaign and how a spam message converts into a financial transaction. The team looks at the “conversion rate” or the probability an unsolicited email will create a sale. The team uses a parasitic inﬁltration of an existing botnet infrastructure to analyze two spam campaigns: one designed to propagate a malware Trojan, the other marketing online pharmaceuticals. The team looked at nearly a half billion spam emails to identify:
the number of spam emails successfully delivered
the number of spam emails successfully delivered through popular anti-spam ﬁlters
the number of spam emails that elicit user visits to the advertised sites
At Forrester, we place a great deal of emphasis on relevance and what it means when researching a topic. For the busy executive, it's sometimes difficult to wade through deep lists of operational security metrics and really understand how relevant the information is to the mission of the business. Further to the problem is the need to understand what your metrics say about the security posture of your organization and the health of the business overall.
The draft title of the report I'm currently working on is Information Security Metrics – Present Information That Actually Matters To The Business. In the paper, I plan to focus on the key factors that make security metrics relevant. The idea here is that if people start checking their BlackBerrys and iPhones while you're presenting your report, it's probably time for some new metrics.
Success is the ability to educate positively the C-Level suite in your organization and demonstrate the value you and your information security program provide.
I just finished a final draft of a presentation on information security executive reporting that I and some colleagues will present at the upcoming Forrester IT Forum in Las Vegas. For those of you who want more information on the Forum please see Forrester's IT Forum 2011 in Las Vegas. In this presentation Alissa Dill, Chris McClean and I will present an approach for using the Balanced Scorecard to present security metrics for senior level audiences. For those of you who are not familiar to the Balanced Scorecard, it was originated by Robert Kaplan currently of the Harvard Business School and David Norton as a performance measurement framework that added non-financial performance measures to traditional financial metrics to give managers and executives a 'balanced' view of organizational performance. This tool can be used to:
Align business activities to the vision and strategy of the organization
Improve internal and external communications
Monitor organization performance against strategic goals
I always have been interested in Enterprise Architecture. Enterprise Architecture is one of those terms that security professionals hear about but do not always know how it can benefit what they do. Recently a client asked Forrester to review their information security enterprise architecture. I was both excited and pleased to do so. One of my accomplishments is I hold a patent in software engineering for the traceability in software systems, supporting business and IT alignment. Several colleagues and I developed an approach to use different types of models, both business and technical, to model the enterprise. The Object Management Group at about the same time championed the notion of "Model Driven Architecture." The premise of theses ideas is that the enterprise can be modeled and the relationships between business processes and underlying systems identifed.
Information security, focused at people, process and technology can leverage many of the techniques of the enterprise architect to evolve the security posture of the organization from its current state to a more optimized state over time. This presents interesting opportunities for security professionals to look at their security processes and tools to determine if they are really meeting the needs of their organization.
Add to the discussion. I would like to know your thoughts on this topic. I will be posting more over the next several weeks.
Forrester receives a significant number of inquiries from clients requesting Forrester guidance on Information Security Metrics. Chief Information Security Officers (CISOs) need new types of metrics to address economic, legal, regulatory, human resource, communication as well as traditional IT information security concerns. Security metrics must evolve to show the information security effort provides quality, efficiency, and a correlation to cost reduction and profit improvement. CISO’s need new methods for demonstrating the value they and their programs create. Over the course of the next several months I will be working with our clients to provide additional guidance and insight into this important topic. Look for additional research from Forrester in a new information security metrics research paper series. As these papers develop I will comment on their development as well as important issues that surface as a result.