'Security Through Obscurity' shows lack of maturity

My last post for 2011 will be about a favorite and common topic amongst security professionals: the art and technique of ‘security through obscurity.’  Anyone and everyone in the privacy and security fields knows about this and I am sure that 95% of the readers have knowingly used this approach to protect data and other assets (the other 5% are probably lying).

Simply put, the ‘security through obscurity’ control, if you will, is making some weakness so discreet, subtle or inconspicuous that you are hoping that a user or bad guys does not find the loophole or back door, intentionally or otherwise. I am not talking here about unanticipated ways to defeat your explicit and obvious controls that the developers or programmers could have never contemplated; I am talking about the “ignore that man behind the curtain” ones. Exactly the ones that little Toto sniffing under a curtain uncovers….Like the empty police car on the side of the highway. Or like stating that your password complexity requirements are 9 characters that must consist of 1 lower case letter, 1 number, 1 special character and 1 upper case letter. And then not enforcing the policy.

I got to thinking about this when I recently thought about a line in a Gnarls Barkley song, “Smiley Faces.” The line was “Was knowing your weakness what made you strong?” Now I have asserted in the past that a secret is only a secret if it remains between a minimal amount of people; when the world knows it, it becomes as useful, and valuable as yesterday’s newspaper. And if you would make (most) private data held by governmental institutions and corporations easily available to any one, acquiring it would mean nothing since it cannot be readily misused, like it can be today. In the security context, knowing that the weakness exists in your application/program/website is the strength you need to resolve the fault proactively. And in the future, you can build in ‘privacy by design’ rather than trying to bolt on security after the fact. Always an ugly outcome, both aesthetically and from a user experience.

My point here is that relying on the ‘security through obscurity’ approach, to any degree, for information protection shows an overall lack of sophistication and maturity in your security process and program. I realize that many companies take this approach because it is cheap and fast to deploy – building in proper controls takes time and money. Ultimately, though you will have two choices when you decide to take a path toward security: you can either pay now or pay later. You pay now by making the investment in proper coding controls and preventative measures; you pay later when someone finds the weakness/hole in your program, application or website and posts it on YouTube and then you have re-engineer the code all over again, making double work. In my opinion, paying now lays the groundwork in your organization for both a respect for security and privacy considerations as a corporate value, and for a discipline of doing the right thing right now.

Make a New Year’s resolution then to avoid the temptation of at least one venial sin this year as you think about your security program and policies in 2012– the sin of sloth.

Happy New Year!

Ignoring Risk management is the riskiest act of all

I always say that everything comes down to risk management. From whether you fly or drive to your vacation spot, to whether you have one more beer at the party, to what stocks you invest in within your 401(K), it all comes down to decisions about risk. Sometimes the decisions are monumental, but mostly they’re insignificant. Most of the time we can ignore, or accept the risks we take on daily with no impact, other times we see the very real repercussions.

If there were ever a poster child for what happens when you blatantly ignore risk management, it would have to be Jon Corzine. The former CEO of MF Global, and former Governor of New Jersey, and former Chairman of Goldman Sachs – whom you would think would understand essentials of risk management as well as anyone on this planet, apparently routinely ignored the pleadings of his Chief Risk Officer about the tenuous position of the firms investment positions.

Tragically, Mr. Corzine not only ignored what his Risk Officer was telling him, he undermined him by complaining to others in the company about the “dour attitude and persistence” (?!?!) of the Risk Officer.

No surprise that the Chief Risk Officer was let go in March of this year.

The act of ignoring risk management as the riskiest possible action is a tautogical overstatement of mythical proportions.  It is true that America's culture, more than any other in the world, forgives failure, tolerates risks, and embraces uncertainty in almost any endeavor. In fact the more brazen the better. Think of the Moon landing, or Evel Knieval.

Yet what is it about a CEO who arguable is a brilliant individual, with undeniable talent, insight and an ability to lead organizations successfully that allowed him to take on risks that were not commensurate with his company’s, or at least his Chief Risk Officer’s risk appetite? Your CRO and General Counsel should be the two people with whom you get full agreement on every significant decision that you as a CEO makes. Undermining your CRO about his warnings on your risky behavior is like telling everyone your cardiologist is a ‘Debbie Downer’ because he diagnosed you with lung cancer.

I think our general nonchalance, or maybe disdain for risk management in general stems from what we as lay people interpret as its accessibility. Everyone has heard or has used the question “What’s the risk?” Yet how many people really under stand true risk management principles? Inherent risk? Residual risk? Really? Do you know what it means? (Ultimately, I blame Parker Bros. for creating the board game, Risk, which we all played as kids. Now everyone thinks they understand, in addition to world domination, ‘risk.’)

You rarely hear people throwing the term “quantum physics” around as cavalierly as we do with the phrase “risk management.” Many of us in the Corporate world think we understand what risk management is like many homeowners think they under electricity or plumbing. Sure, you can change a faucet out or wire a ceiling fan, but would you as untrained homeowner really think that it is worth the risk (the word, again) to rewire the circuit panel that powers your whole house? Most rational individuals don’t think it is worth the tradeoff of saving the $300 it costs to have the electrician come and do the job right, versus the possibility of burning your own house down. A tough sell to the wife under any circumstances.

Just like I don’t expect my dentist to tell me about best practices in privacy, I don’t pretend I know the best way to extract a bicuspid either. So, please, begin to give risk management its due as a genuine discipline practiced by professionals who have different and specialized skills that you don’t have. Don Corleone needed a professional risk manager (Consigliere, Tom Hayden) and so do you, I’ll bet. Don’t go it alone. It’s not worth the risk.

Ready for its closeup: Privacy in the Board Room

When (and if) you ever think of or hear the term “Board of Directors” you probably envision of panel of crusty, old-timers sitting around a long board room table day-dreaming, doodling, or dozing off while a CEO goes through yet another Death by PowerPoint presentation. If you think those people are there just to enhance their resume and collect their stipend, think again. It’s whole new world for Board members these days.

The visibility and implied responsibility that Board members have in today’s business environment is as substantial as it has ever been. No longer can Board members be asleep at the wheel while the CEO and/or the company explore every whim or hare-brained idea they want. Starting somewhere around the implosion of Enron back in 2001, investors and other interested observers began asking in earnest “Where was the Board in all of this?”

As recently as late 2010, the Board of Hewlett-Packard fired CEO Mark Hurd in a very public way claiming some impropriety with a female contractor and his expense reports. Even during the most recent scandal at Penn State, the media began questioning why the college’s Board of Trustee’s did not raise a red flag or call into question the very questionable actions of a rogue assistant coach. So why has this group of people who had forever been seen by many as rubber stamps now suddenly, and finally, taking on task of ‘guardians of the corporate reputation’?

The Board of Directors or Trustees acts in trust for the shareholders and employees of a company or taxpayers and students in the case of a school. They are tasked with ensuring that integrity of action and quality of product is delivered by the institution that they are with which they are engaged. It is a duty that should not be taken lightly; and appears as though it is taken more seriously now that ever.

Good thing too. In addition to overseeing their respective institutions, one duty that governing boards must address is the various competing priorities of mission, vision, growth and the mundane administrative. One contemporary matter that will be occupying the board’s agenda more and more is that of privacy - privacy of customer’s data, privacy of driver’s location, privacy of users preferences, privacy of subscriber’s habits, and on and on.

Privacy must be a board level topic. Why? Because privacy and its first cousin, security, are not just compliance issues anymore; they are business issues. Business issues that deserve a seat at the table just like innovation, marketing, sales and design have had for years. A company with a core corporate value of privacy has a distinct competitive advantage over one that treats its customer’s privacy cavalierly. Witness two of the year’s highest profile cases of consumer backlash against a company’s apparent disregard of its customer’s privacy: Google’s covert use of collecting Gmail accounts when it rolled out its Social Circles product in May this year, and Facebook censure by the FTC for a host of infractions, all centered around their indifference to user’s privacy. Both companies must now submit to privacy audits for the next 20 years, said the FTC. Facebook took its act of contrition serious enough to go out and hire not one, but two (!) Privacy Officers in response to the action.

As a practitioner of the art, I take it as my responsibility to advance and elevate the issue of privacy all day and every day as far up the chain as I can, and provide visibility to current and pending privacy issues to senior management and ultimately Board if and when they need it. Like so many other topics this year that got their time in the sun (the Arab Spring, WikiLeaks, Occupy Wall Street, to name a few) it is the right time for another, quieter, more discreet but no less revolutionary movement: to finally bring privacy & security from the back room to the board room.