Aug 1, 2011

Change is a security opportunity

In my previous blog, security threats no-brainers 2011, I kind of promised continuation. I said that it would be more interesting to think what security opportunities mentioned changes would bring than falling straight into risk management mode. Yes - I know that some people say risk may be a positive thing. I don't buy that. In my thinking risk is always negative. You may achieve positive things when accepting risk, but that's different.

Five most common trends/changes typically mentioned as causing security risks I covered in my previous writing were smartphones/tablets, Stuxnet-like advanced attacks, social media, mobile applications and cloud. Let's see, if these can help us with security. I haven't done any thorough analysis or such, but write down things that comes to my mind right now.

Smartphones and tablets

These are new devices what users desire. It's a good opportunity to introduce some security guidelines and practices which may have forgotten earlier. Users are ready to do anything in order to be able to use latest and greatest gadgets. Just be careful not to overdo it - don't kill the usability.

Stuxnet-like advanced attacks

Hmm. Tough one. Lets say that at least it's been a wakeup call for many companies who thought they were safe. Awareness building opportunity.

Social media

Easy. Your users are using social media, so you want to be there too. Good opportunity to build awareness, educate users and bring security down from the ivory tower. Finally there's a channel to get some feedback, if you play your cards right. I don't mean log reports, but actual concerns and suggestions of your users. See this great picture, how information security people think differently from regular people.

Mobile applications

How about offering security awareness apps? In form of games, videos, guidelines, FAQ, etc. Maybe offer a quick way to ask questions and send feedback.

Cloud

Excellent. Someone is doing all security work for you, if you just know to ask. Sometimes getting in-house IT into speed is hard work - there's always production-related issues and more important tasks to do. Vendor rarely says no and if the price tag is too high, at least management knows what security they decided not to buy.

There - quick-and-dirty list of how new trends can enhance security. I'm sure there's lot more.