Top 5 #InfoSec Reads: May 27-June 4
Sensibilización sobre la seguridad, un término de seguridad a la vez

Defense _is_ sexy

Violet Blue begins a post reviewing a recent RAND study: Cyber-defense must change course, or else, with an apt summary of the report:

Defense isn't sexy.  We mythologize being the hacker, not the hacked.

The RAND study depicts network and system defenders as a hapless, hopeless, dispirited, confused lot. Defenders, it seems, have accepted the sum of disparaging or condemning remarks from journalists to bureaucrats and even their purportedly security practitioner peers and have raised the white flag.

Steve Werby (@stevewerby), Jerry Gamblin (@jgamblin) and I discussed this lamentable state of affairs in a thread on Twitter this morning. Jerry aptly summarized our shared perspective:

DefenseplayedwellPeople who say defense isn't sexy are not playing it correctly 

I'm not questioning Rand's results. Given the carnage we've witnessed, the smell of defeat is palpable.  Steve, Jerry, and I are more interested both motivating deflated defenders and debunking the myth that defense isn't sexy.

We're using the wrong analogs. We're living in the past, describing defense in what is not only antiquated language but misguiding and constraining imagery as well. I'm as guilty as anyone, having used castles and the Maginot Line as analogs when describing firewalls or defense in depth.

"It should & can be sexy if we change how it's done"

Steve Werby  instigated a discussion about change. We've traditionally characterized defense using military terms and static defenses. While useful at the time, these terms put us in a Helm's Deep mindset: standing on the parapets waiting for the Urukai onslaught and inevitable defeat. It's time to modernize analogs. 

Defend with an attitude

Organizations who have had their ineffective defenses overrun make headlines. Organizations that, as Jerry says, "play defense correctly", don't make headlines. They defend with a "Not in my house" attitude. They're confident but not arrogant. 

Roll your eyes all you wish, but let's experiment with sports analogs to give defenders a more positive outlook. Werby laments that "The state of our analogies are so bad that almost anything is better." He's right.

It's time to bolster defenders' attitudes by making defense Sexy. Virile. Spirited. Indomitable. 

Defense in depth? Perimeter defense? Out. Hereafter, convince your defenders to play shot-blocking, ball-trapping, in-your-face-man-to-man, grind-you-down-I-own-you defense. If you prefer football analog, forego the zone, play man up gang-tackling, blitz-your-brains-out D. 

You want better security? Replace what Rand tells us is a culture of "awaiting annihilation" with a culture of relentless pursuit. It's long overdue. If your defenders aren't up to the task, find or make defenders who hate losing, hate being embarrassed by unskilled little shites who've downloaded or purchased an attack tool, criminal conspirators or state actors. Gather your defenders and quote from the 1976 movie, Network: "I'm as mad as hell and I'm not going to take this anymore!" 

Comments

Feed You can follow this conversation by subscribing to the comment feed for this post.

Verify your Comment

Previewing your Comment

This is only a preview. Your comment has not yet been posted.

Working...
Your comment could not be posted. Error type:
Your comment has been saved. Comments are moderated and will not appear until approved by the author. Post another comment

The letters and numbers you entered did not match the image. Please try again.

As a final step before posting your comment, enter the letters and numbers you see in the image below. This prevents automated programs from posting comments.

Having trouble reading this image? View an alternate.

Working...

Post a comment

Comments are moderated, and will not appear until the author has approved them.

Your Information

(Name is required. Email address will not be displayed with the comment.)