Be it in healthcare or infosec, the short term is for losers

With all the doctor & hospital visits I've gone (and am still going) through with family members in the past few years, I've come to the conclusion that many (most?) healthcare providers - especially those smart doctors society holds on a pedestal - absolutely cannot see the big picture. They can't think past the appointment time slot in which they're currently working, much less next year and beyond.

Adding to the problem, the left hand never talks to the right so everyone is engaging in their own area of "expertise" yet nothing gets done at a higher level and the patient is the one who ends up suffering because of this approach. Here's an example of what I'm talking about...this is the hospital meal that my father received after going in for a suspected heart attack:

The Dinner of Champions

What's wrong with this picture!? Luckily, for us, it ended up being symptoms from a hiatal hernia. Whew. But still...? Come on healthcare professionals! Hey, at least our beloved Obama is going to fix this...(ha!).

The problem of not seeing the big picture is very common among business execs and even many IT professionals who just don't get what information security is all about. We see it everywhere, especially when data breaches occur...But we also see it when our own peers claim the sky is falling because of the latest Adobe Reader zero day exploit or the Web interface on someone's printer is susceptible to CSRF. Amazing....sad.

The desire for immediate gratification leads to a lot of bad choices. Ask any success/achievement expert and he or she will tell you that the lack of time perspective is one of the greatest problems in society - arguably the one thing that holds people back the most. It certainly has an impact on IT and information security.

If you want to stand out among the noise and the ignorance associated with IT and information security, think long-term in all the decisions you make. Don't expect short-term perfection in your security program. Instead, aim for incremental improvements over time.The missing link is actually making those incremental improvements over time...As Henri Frederic Amiel once said “The person who insists upon seeing with perfect clearness before he or she decides, never decides.” This is no doubt the root cause of the problems we can't seem to solve.

Read More

Perhaps the biggest & most widespread security gaffe of all

Read More

GoDaddy: 'Malfunction' as the new scapegoat?

We've been hearing about 'computer glitch' for a while. That's what the talking heads on the news always cite when something goes awry with a computer system. Perhaps 'malfunction' is the new scapegoat? That's the route GoDaddy is taking. They say it was a 'malfunction', not hacking, that took them and presumably hundreds of thousands (millions?) of other systems offline for hours yesterday.

I'm sure it had nothing to do with poor planning...or people making bad choices. That'd be too simple...and too responsible. It's easier to blame computer problems on the obscure - something that can't be understood - much less proven - by the general population, even forensics analysts.
 
Calling a network outage a 'malfunction' is similar to how legal counsel encourage executives to refer to security breaches as 'events'. In the end, a business continuity problem is a business continuity problem. It's your responsibility.

Stuff's going to happen. You just have to ask yourself what needs to be done to minimize the impact to your business. Don't wait until the you know what hits the fan to try to figure it out. Here's some material I've written that can help you get started down this path.

Read More