For Executives

I sometimes run across line or mid-level managers who are aware of the need to improve security in their environment but simply don't know how to get the point across to their senior managers. It's a tough sell because security often represents an unbudgeted cost which nobody quite knows how to justify. Senior management is seen as wanting to deal quickly with traditional business problems of budget, cost, competition, productivity, etc. For managers, talking to executives about security is like discussing religion or politics; a very uncomfortable subject, because there are conflicting assumptions and views of who should have to justify it and who should have to budget for it.

There are many ways to portray security, and each one seems to have its weakness. People often talk of the Return on Investment (ROI) for security. But you can't really measure an ROI on a security investment, because you can't accurately estimate the outcomes for security safeguards you invest in.  That's because a security safeguard protects you from an unknown number of uncertain future events. You are simply counting on the safeguards employed to reduce the likelihood or impact of such events. That's what security risk management is all about.

Many people like the "insurance" analogy? You pay a premium up front, and if something goes wrong you get a lump sum of money to cover a portion of the cost resulting from a compromise or security failure. There are a lot of similarities between insurance premiums and the cost of security safeguards. But security safeguards don't pay you back according to how much was lost or how much coverage you had. They either help prevent the loss, help recover from the loss, or ... they miss the loss. So, insurance is not really an ideal analogy for illustrating security in a business model.

So, how can we view security in a way that everyone can relate to it? Here's my suggestion. If you can look at business as you would a poker game, you have to decide if you are in a certain business or not. Are you going to play the game or not? The cost of Security is the "Table Stakes". It's the cost of getting into the game. If you can't afford to protect the your accumulated assets by implementing security safeguards, then you shouldn't be in the game in the first place. What's worse, you are gambling with your shareholders' and customers' money!

To elaborate on this concept, consider that in any business model the aim should be to provide Clients with value via a system, service or product in return for remuneration. Whether implied or written, the ultimate goal for the business system (internal), service or product (external) is for it to operate "correctly", as intended.  (In other words, play the game fairly, and don't cheat.) If the system fails to operate correctly, then it is not providing the value that was intended to the shareholder or the customer. 

Security breaches are never "intended" by honest business managers.  They want the product to operate correctly, and therefore, securely. So, the cost of security has to be built into the cost of building the system, service or product to operate correctly. In fact, you can't do a cost/benefit analysis without factoring the cost of adequate security. It really belongs in the business case, before you even start designing the system, service or product offering. An unexpected increase in cost has to be balanced against the anticipated benefit for a system, service or product for it to be a worthwhile business investment.

I have designed an exercise for executives to use in this situation. Your managers would probably like to know how would you answer the following questions:

1) If one of your key business systems, services or products had a vulnerability in it that could expose multiple clients' sensitive information to the general public, would you want to know about it? 

Discussion: The answer should obviously be "YES".  If not, then I respectfully suggest there is a bigger business problem at play than simply justifying security.

2) If you said YES to (1) above, "HOW" would you expect to be made aware of this situation?

1. As a result of a design review escalation (for products designed in-house)
2. As a result of a test failure and problem report escalation (prior to being put into operation or general release)
3. As a result of an operational helpdesk incident escalation
4. As a result of an internal audit report
5. As a result of an external audit report
6. In a publicized media report

Discussion: Again, the answer should be fairly obvious. The design review is the first and easiest place to fix such a vulnerability. This is the key to illustrating the objective of "Building Security In". If you don't think the answer is (a), there is probably a lack of understanding of the costs of addressing major flaws (of any kind) at various stages of a product lifecycle (maybe a topic for my next issue), or an unrealistic expectation of "good luck" in the face of a known risk. So, you either need to see some metrics that show the relative costs for changes at various stages of the lifecycle, or a few months worth of relevant news from publishers of security breach data to show that the risks are real.

3) If you agree that the best place to address a major security vulnerability is during design (or pre-production for commercial products being used in production business systems), "WHOSE BUDGET" should bear the cost of analyzing the problem and implementing the change to address it? 

Discussion: If you are thinking of pointing to the Development or IT group, you should stop and think about the fact that the only group that can accurately perform a Cost/Benefit study to justify the "Table Stakes" is the Business Unit owner. Yes, the Development and IT group has to work with the business managers to let them know the costs, but the Business Managers must make the decision on whether to increase budget or decrease the scope. They need to determine what it will take to build the system correctly. Incidentally, they should also be accepting the risk and accountability for going live.

After you have thought through your answers to the above questions, you might want to gather the managers together to discuss them. You are right to want to delegate these issues, but everyone needs to understand the rules of the game, or you are likely to be over-budget and under-resourced for the projects you have under way, let alone any new ones.

If you would like to discuss the topic of "Justification for Security Investments" please contact me.

For Home Computer Users

Having multiple e-mail accounts can help reduce the amount of spam you get at your most private e-mail address. Thanks to Rich Mogull at the Securosis Blog for posting (click HERE) the method he recommends for utilizing multiple e-mail addresses.

The following are the types of e-mail addresses that Rich recommends:

1) Your Permanent Address - the one you only give to trusted friends who won't abuse it; you don't want to change it

2) Your Work Address - given to you by your employer; most offices allow employees to do a reasonable amount of personal e-mail from work accounts; but don't use this address for subscriptions, online purchases or newsletters

3) Trusted Merchants Address - use it for buying from places like Amazon, eBay, Apple, etc.

4) Untrusted Merchants Address - they only have to send you an email confirmation after you purchase, so you don't need to keep this one active forever

5) Newsletter Address - they need to send you confirmations when you change your subscription or profile, but it's not the end of the world if you need to change it (i.e. when you start getting too much spam).

Rich recommends NEVER using the e-mail address given to you by your Internet Service Provider (Sympatico, Rogers,etc.) as they can be big targets for hackers looking to harvest e-mail addresses. You may also change ISP's over time, and you don't want to have to change accounts every time. Yahoo, Gmail and Hotmail are also targets, but they generally put a lot of effort into protecting their e-mail accounts.

If you can get someone to help you, it only takes a few minutes to set up all these accounts and put them into your e-mail client program such as Outlook, Eudora or Thunderbird. That way, you will be able to view mail coming to all these accounts from one program. 

Many people don't realize that e-mail programs can handle more than one account at a time, and this is a good use for that feature.

For Managers and Office Staff