skip to main |
skip to sidebar
April 21, 2009 (Computerworld) SAN FRANCISCO -- Two years after suggesting that independent security vendors were headed for extinction, Art Coviello, president of RSA, is calling for "inventive collaboration" among vendors for dealing with the expanding range of threats facing business and government.
Delivering the opening address at the RSA Security Conference here today, Coviello said factors such as the sagging economy, the proliferation of new technologies and the growth of organized crime were driving the need for vendors to work with each other on key security practices.
Coviello's is a sentiment shared by multiple industry representatives at the conference, who said that the threat facing private and government networks called for a more unified response from all cybersecurity stakeholders.
"Our adversaries operate as a true ecosystem that thrives through interdependence and constantly adapts to ensure its growth and survival," Coviello said. "For us to succeed against such advantaged adversaries, the vendor community must take the lead," in building a similarly interdependent security ecosystem, he said.
The key to this happening is for vendors to stop viewing their technologies as "piecemeal" products aimed at addressing discrete security problems, Coviello said. Rather the emphasis needs to be on ensuring that each vendor's products works well with others' products to provide better information risk management opportunities, Coviello said.
"Technologies are still applied piecemeal from multiple vendors -- cluttering the information landscape -- leaving perilous gaps of risk," Coviello said. "We must embrace a common development process that allows us to clean up this landscape, creating a more secure infrastructure today."
The strategy within the security industry should be to have common standards around certain core functions such as security policy management, policy enforcement and policy auditing, Coviello said. Vendors also need to be willing to share technology -- such as key management -- where appropriate so as to accelerate the "growth and productivity of the ecosystem," he said.
Enrique Salem, president and CEO of Symantec Corp., said that the record pace at which malicious activity has been growing necessitates a change from the single-vendor approach to security that has been the norm. Last year alone, Symantec alone created more than 1.6 million new signatures to deal with malicious code. "That's more than we've created in the last 17 years combined," Salem said.
Attackers are increasingly moving away from mass distribution of a few threats to "micro-distribution" of millions of threats aimed at specific targets, Salem said.
Companies needed to bring together handling of security, storage and systems management tasks, he said. Such collaboration means "more visibility into what is happening in the external threat environment and internally across the organization," Salem said.
Lt. General Keith Alexander, director of the National Security Administration (NSA), said in a keynote address at the conference the task of handling cybersecurity was too big for any one entity alone. Going forward, government, the private sector, and academia need to find ways to collaborate with each other to effectively dispel cyber-threats, he said.
The Internet is shared by not just the government or the military but all players, he said. Securing it effectively will require collaboration and sharing of information among all of the stakeholders, Lt. General Alexander said. (source)
San Francisco - "Dude, it's a blessing."
That was the unhesitating and enthusiastic response of Dr. Hugh Thompson, chief security strategist of PeopleSecurity, the specialist in enterprise security education, when GSN asked him how he felt about the elevation of cyber-security to a fundamental pillar of homeland security.
He had just finished a spirited discussion, with an audience of approximately 150 attendees, at the RSA Conference, now underwayhere, about lessons IT security could draw from other industries.
Why hasn't IT security progressed further? GSN asked him. "We are so damn young," Thompson replied, adding that in some other industries "an armageddon had to happen" before changes were instituted.
Plus, the cyber-security industry hasn't done a good job of marketing security to its users," he said. "Why is that?"
One reason may be that there is no independent third party that's "accountable," in the manner of the FAA in the airline industry.
Airlines, he observed, may lose luggage and delay flights, yet the flying public generally accepts that flying is safe. One of the reasons is that the pilot flying the plane is considered both a "trusted user" and a "motivated user," said Thompson. "We don't have that," he added.
Another possible factor is that "security really isn't taught as a foundational skill" at most universities, he observed, adding that, in fact, he himself teaches such a class at Columbia University.
Another area where security is still lacking is in its standards of training and awareness, and that means potential changes in accreditation. "Are we headed to mandated certification," with additional government regulation of the industry ahead, he asked.
One audience member suggested that, as in some other industries, IT security needs to "stress" its systems until they fail, then it needs to analyze the results and
learn from them.
Thompson agreed and also noted that airline regulators and the airline industry study crashes intensively, examining black boxes and so forth, to learn from them. And in medicine, doctors and hospitals regularly convene "mortality and morbidity" reviews to understand the causes when patients die.
"That's something that's missing in our space," he said.
When one audience member suggested the arcane physics process, straight-out-of-science-fiction, called "quantum entanglement" as a way to ensure password security, Thompson looked amazed by the possibilities.
"Dude," he said, "I smell start-up." (source)
