IT TO GO ON THE OFFENSIVE
Bangkok Post (3 Oct 2007)
John Pescatore, Gartner VP, explains how Security 3.0 will be about baking in security earlier in the systems lifecycle rather than reacting to threats.
The IT industry today is on the cusp of embracing ''security 3.0.'' For the first time since the advent of the PC, the focus changes from reactive security to a proactive one through ''baking in'' better security earlier in the systems development processes, according to Gartner Internet Security Group vice president John Pescatore. Speaking at the Gartner IT Security Summit in London, Pescatore explained by way of analogy how historically improved safety related to building fires and shipping did not come from the firefighters or coast guard, rather they came through planning and regulation from insurance companies. Similarly, security 3.0 will not come out of the IT security department, but through using policies to move security up the software development chain and embedding security in programming and eventually systems and outsourcing contract design. He observed that IT security seemed to be conducted in a way where people hoped they were secure, rather than knew what was going on. This is in contrast to the retail industry, where it is customary to spend 1.5 percent of revenue to bring shoplifting losses down. Today many IT departments are seeing security eat up to nine percent of their budget, a trend which is unsustainable. According to Pescatore, security 1.0 was in the day of the mainframe, a time when he was working at the United States National Security Agency (NSA). Back then in the 1970s, a user would be assigned a terminal and a time slot by the system administrators. They decided exactly what could be done and not done in a completely locked down system. Security was achieved by restricting the user. However, it failed in its greater mandate to provide for IT needs the same way centralised economic planning failed in communist countries. Security 2.0, which is where we are today, is what Pescatore described as ''data anarchy'' and likened the security department's practices to the fairground ''Whack-a-mole'' game. In this game, moles pop out of a series of holes and the player has to hit them with a hammer within a split second in order to score points. Similarly today's security is reactive and success is often measured in time to patch systems. Security 2.0 began with the age of the PC. Freed from the mainframe IT department, users downloaded sensitive corporate data to model it on their PCs and later their laptops, because the enterprise reporting tools were too rigid. And quite often they would lose their laptops along with that sensitive data somewhere along the line. Another characteristic of security 2.0 is the tendency for the overwhelmed IT departments to say no to any new technology, which is then brought in anyway through the back door. Pescatore said that during the early days of Wi-Fi, he could bet that every company who said no to Wi-Fi deployments would have at least two rogue access points. One would be in the shipping department as DHL had rolled out wireless equipment to its customers and the other would be in the director's office as his couch was a bit too far from the LAN to be able to reach comfortably. Rather than react to this after the fact, security 3.0 would say that since we know that Facebook and iPhone are coming one way or another, security policies should look ahead to likely trends and plan on how to cater for them. But in order for that to happen, they need to be freed from the day to day chaos first. In the age of security 3.0, the nature of attacks has also changed. It is no longer the worm or virus aimed at causing damage and disruption, but it is a group of professional criminals aimed at financial gain. The TJ Maxx case, where credit card details were stolen, was not aimed at humiliating the company but at making lots of money though selling those credit card details. It cost the US retail giant around US$150 to 225 million to compensate for fraud and to pay the banks who issued new cards _ roughly twice what it would have cost to prevent the breach in the first place. Prevention in the age of Security 3.0 is done proactively. By giving the security tools to the application development team to preempt just half of the number of security lapses before they are caught by the security team, the cost of security would be reduced by a factor of five. Pescatore estimates that the cost of preventing a vulnerability during the development phase is just between one and two percent of the cost to repair the damage it has inflicted once a piece of malware goes live and data is compromised. Taking that thought forward, security metrics and goals should be put into requests for proposals so that security becomes the responsibility of the partner or vendor. Pescatore uses the term ''baking in'' security costs earlier in the systems lifecycle into outsourcing projects and even into products and appliances as a key feature of security 3.0. Vendors who do not comply will not get the contracts, he noted. In turn, this will help reduce the percentage of security in the IT budget and free up resources for innovation and for proactive security planning.