Security must evolve, CERT official says

Comments

Related

Active Comments

Lando says: "If you allow security to be driven by business leaders, they will always err on the side of convenience..." I...

Read the rest | Reply

Anonymous says: I'm sorry, but this is ridiculous. If you allow security to be driven by business leaders, they will always err...

Read the rest | Reply

All Comments (4) | Post New

• Moving to a start-up? Fasten your seatbelt
• License server glitch exposes SonicWall users to e-mail security threats
• Clues point to Jan. 13 release of Windows 7 beta
• Chinese city requires Net cafes to use legitimate software
• U.S. Report: Major terror attack by 2013

Zone

The Security Zone With the mobility of employees and the ease with which external devices can be brought in and out of a network, continuing to build your security plan for network servers and clients is a must. Fortunately, there is much that organizations can do to protect themselves from attacks - internal and external. Having the right policies, procedures and server configurations is critical... Learn more in The Security Zone See All Zones

March 11, 2008 Security has to evolve into something that supports business, rather than the other way around, according to Lisa R. Young, senior member of the technical staff at Carnegie Mellon University's Computer Emergency Response Team.

Security has gotten a bad rap in today's enterprises, said Young, in Stockholm to speak at the European Computer Audit, Control and Security Conference.

The tendency is to want to start locking things down, so security is something that disables, not enables, business, according to Young.

It's still an area where boxes and technology rule, she said.

"Solving your security problems by buying another box is just wishful thinking. But security is bigger than that," Young said.

"As security managers it's up to us to elevate the profession, and include both people, processes, not just technology," she said.

Today, security processes are often not mapped to business processes

"People just haven't thought of security as a discipline that can be measured, managed and mapped. It's a new way of looking at it," Young said.

Security requirements have to spring from business-process needs, she stressed. "Requirements should be driven by owners of business processes, not the caretakers of technology," Young said.

For companies that learn to evolve, rewards are plentiful.

To simplify efforts to make changes to security strategy, Young's development team at CERT has developed the Resiliency Engineering Framework (REF), which was launched last year.

It doesn't compete with other frameworks, such as ITIL. REF identifies enterprise-wide processes for managing operational resiliency -- including everything from training to compliance management -- and provides a structure from which an organization can start to improve.

"You can reduce cost, eliminate duplicate efforts and improve compliance efforts, for example," Young said.