Industry Should Share Data Loss Information
By Danny Lieberman, Security Expert and Founder of Software Associates
In a previous article, I suggested that fragmentation of knowledge is a root cause of security breaches.
I was thinking about the problem of sharing data loss information this past week and I realized that we are overwhelmed with solutions, technologies, policies, security frameworks and security standards – COBIT, ISO27001 etc..
The German physicist Helmholtz identified three stages of creativity: saturation, incubation and illumination.
We appear to be in the saturation stage right now.
Henri Poincaré identified a fourth step that follows the other three: Verification is putting a solution into concrete form and checking it for errors or usefulness.
In the early 1960s, the American psychologist Jacob Getzels proposed that a preliminary stage of creativity involves formulating a problem.So let’s start with formulating the problem of security information sharing.
People and their employers are unwilling to discuss the details of security events that happened, their security vulnerabilities, the damage in dollars was actually caused, how the events were discovered, how the threats that exploited the vulnerabilities were mitigated and most importantly – how well their current security products perform.
In our threat analysis work, we run into these problems daily.
We offer an excellent free threat modeling tool from our colleagues at PTA Technologies called PTA – Practical Threat Analysis.
I think we have over 15,000 downloads. Users sometimes have questions that require taking a closer look at their threat model but it almost never happens because of the fear of disclosure.
On one occasion – a user shared his threat model after obfuscating the data (you can download the software here – free risk assessment software.)
Here is a possible solution to the problem we just formulated:
- Define a language for describing a security event - having a canonical language to describe things is a basic requirement for sharing information between people.
- Build models of attackers, vulnerabilities, assets under attack and security countermeasures in order to describe loss events using the common language.
- Enable people to build, maintain and share models anonymously. What is important is not the identity of the company who had the loss event, but the details of the model.
- Use the models to measure the loss impact and the effectiveness of their security countermeasures in dollars. This provides a security metric that will enable people to look at models and compare ‘apples’ to ‘apples’ without involving marketing factors such as product features and distribution channels.
Danny Lieberman is a serial technology innovator and leader – implementing ideas from brain to business. Danny has a graduate degree in solid state physics and has spent most of his adult life developing software. Since 2003 – Danny has been doing data security consulting and data protection/information assurance projects using data loss prevention /extrusion prevention technology.
Danny’s data security business, Software Associates provides enterprise information protection to clients in Europe and the Middle East. His latest venture is MedRep, a professional network for medical representatives and doctors. Feel free to text Danny at any time of day at: +972 54 447 1114 - he is always looking for interesting projects and ideas.
* * *
Stay Informed With ISR News Feeds and Email Alerts Here:
The Publisher gives permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author and to Information-Security-Resources.com
Filed under: Breach, D&O Liability, Danny Lieberman, FEATURE ARTICLE, Financial, Government, ISR News, Insider Threat, Military, PCI, Sarbanes-Oxley, Software Associates, Uncategorized, due diligence, hackers, healthcare, identity-theft, malware, national security, privacy
Comments
One Comment on Industry Should Share Data Loss Information
-
Michelle on
Wed, 23rd Sep 2009 3:31 pm
Great point about enabling people to build, maintain and share models anonymously. Perhaps if this sort of information were anonymous, people and companies would be more likely to share.
Tell me what you're thinking...
and oh, if you want a pic to show with your comment, go get a gravatar!
