THE EVOLUTION OF THE INFORMATION SECURITY MINDSET: A HYPOTHESIS OF STAGES OF INDIVIDUAL AND ENTERPRISE SECURITY MATURATION

This paper explores the evolution of individual and enterprise thinking around information security. A theoretical model of how corporations typically develop and mature in their security strategy is postulated with corroboration from some leading security consultants. The premise of this work is if you can gauge your security stage, you can not only manage it better, but could think through and possibly transcend intermediary stages to fast track you to the ultimate stage of being practically secure. The potential benefits of this work arise from minimizing activity that does not take you on the shortest path to the ultimate stage. Introduction Like many things in life, one’s understanding of a concept is a catharsis; an evolutionary process as the knowledge gained systematically shines light into the darkness of ignorance. Is there a parallel that applies to security? Could the way companies think about and react to security challenges follow some type of pattern? Individuals experience paradigm shifts that galvanize them into evangelism of some new security strategy, or renewed support for a management idea. The catalyst that triggers these responses can be anything from a newspaper-caliber exploit which rocks the organization, to something as simple as someone stumbling over a really dumb thing a developer did to open a security hole. This paper is an attempt to establish if there is a pattern to this maturation process. This is an effort to quantify some possible milestones along the road of security maturation. Having identified some of these milestones, enterpr ise management would possibly consider strategies to effect the end-point sooner than would otherwise be reached. Methodology To establish what companies go through as their security-awareness matures, analysis of documented security behavior is warranted. There is unfortunately a dearth of published material on this topic, most security related thinking studies seems to have focused on the mindset of the hacker, instead of that of the hacked (Rogers, 2000; Gordon, 2000; Quitner, 2002,: Shaw et al, 1998). A few models exist and are discussed later, but more commonly © S A N S In st itu te 2 00 2, A ut ho r r et ai ns fu ll ri gh ts . Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 © SANS Institute 2002, As part of the Information Security Reading Room. Author retains full rights. documented are cases of enterprise response to threats and even cataclysmic examples like the September 11, 2001 terrorist attack (Armour Group, 2001). It was the information gleaned from personal communication with respected security professionals (Fossen; Prosier; Shunn) that confirmed there was merit in what was alluded to in published material. It was the experience of these professionals that is of particular interest, because they are seasoned consultants. As such, they get exposure to many companies, and almost always engage the leadership on strategies to secure their organization. This provides valuable insight to the questions of patterns and the thesis of thought evolution. Stages in Security Thought Evolution What follows is a postulation of the different macro security stages employees, and by implication, corporations may experience. Though executive management, technical, business and product management staff may individually be at different stages at any one time, the stage that applies to the enterprise is the one which best describes the bulk of the employees. The stages are summarized below: Stage 1 – Ignorant – where the bliss of ignorance causes no discomfort Stage 2 – Awake – where some catalytic event breaks a core paradigm Stage 3 – Vulnerability Flood – knowledge exposes the scale of the problem Stage 4 – IDS – Fighting back Stage 5 – Forensics – Building in the non-repudiation components for prosecution Stage 6 – Practically Secure In more detail, these stages could be characterized by some or all of the following activities: Stage 1 – Ignorant – where the bliss of ignorance causes no discomfort. This is the condition where the bliss of ignorance causes no discomfort! People may even be engaging in brief security discussions when building some applications, but these are typically focused in isolated areas, use out-dated technology or worse, implement “security” into applications out of step with the real world, thus giving a false sense of security. The over-riding common characteristic of this phase is ignorance. This ignorance extends to the hostility of the internet or the nature of hacking, tools and ease with which vulnerabilities can be introduced into a system through procedural or systemic issues in application development or poor installation practices. Characteristics of this Stage • There is a pervasive ignorance of the hostility of the internet and the current state of hacking, including hacker tools, techniques and exploits. • There is a belief that systems are generally secure, being patched and never have been hacked without measuring any of these to get the real picture. © S A N S In st itu te 2 00 2, A ut ho r r et ai ns fu ll ri gh ts . Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 © SANS Institute 2002, As part of the Information Security Reading Room. Author retains full rights. • Management has an unrealistic trust of their team’s diligence and knowledge regarding security • Security planning and design in applications tends to be out of touch with reality and often misdirected. • Security audits may in fact be undertaken during this stage on key systems, but often the auditors used are also not in touch with the real world and primitive security fixes are recommended • Sensitive documents are not secured – like database models on pa sageway walls as decorations • The enterprise does not appreciate the value of its assets at risk. • The focus of business is to keep the operation going and IT budgets and activities are driven to that end. Stage 2 – Awake – where some catalytic event breaks a core paradigm This is the condition where some event brings security into focus. This can be an exploit, sometimes publicly made known or even just a key person gaining some insight of current hacker practices, often from a training course. In most cases this acts as a catalyst which reverberates through senior management – initially with only a few believers and the rest somewhat skeptical that the situation is as bad as the evangelists are saying. This phase triggers a call to action, most significant of which is a plan to measure/audit the condition. Sometimes the catalyst is a hack that has a devastating consequence, like the Homepad Domain Service. Their status page detailing their trials after a successful exploit caused them to conclude they needed to re-architect their systems (Homepad, 2000). Auditing the systems on a large scale is a common response during this stage. Typically companies audit only myopically or not at all, until a catalytic event occurs. (Bernstein, 2000). Components of typical post-catalyst actions are detailed below: Characteristics of this Stage • A security breach or a key person gains knowledge which acts as a catalyst to get a critical mass of management to appreciate that there is a security problem • If this was an exploit, most people still believe this was an isolated event and that the remaining systems have never been hacked – though typically they cannot prove otherwise because it is not measured. • The security evangelists get enough momentum to conduct an inventory of applications operated by the enterprise, with a view to prioritizing an audit of those considered most at risk. • If the auditing team used has the necessary skills, this results in a mass of vulnerabilities being recorded, which heralds the next stage. © S A N S In st itu te 2 00 2, A ut ho r r et ai ns fu ll ri gh ts . Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46 © SANS Institute 2002, As part of the Information Security Reading Room. Author retains full rights. Stage 3 – Vulnerability Flood – knowledge exposes the scale of the problem As the auditing process proceeds, the reality of the situation starts to dawn to more and more employees. This typically results in more audits of other systems in the enterprises. The gap between the increasing number of believers and the skeptics become more visible. Characteristics of this Stage • The process of auditing the systems results in far more recorded vulnerabilities than anyone expected. • This triggers audits of other systems in the enterprise, which in term results in more recorded vulnerabilities. • The management of patch and deployment gets more attention and accountability loops could be setup to address the state of servers in the enterprise. Policies are starting to emerge. • Application development, infrastructure teams and especially business people, find the concepts and mechanics of the vulnerabilities hard to understand and foreign. • Some naysayers often call the evangelists bluff by requiring them (or the auditors) to prove that a particular vulnerability is potentially as devastating as alleged – usually resulting in a spectacular demonstration which immediately settles the argument! • Mechanisms are set in place to manage the vulnerabilities and track their remediation to completion • Key individuals are sent for quality security training which rewards the enterprise with more accurate planning for the real world and a better focused strategy. • At this stage the entire enterprise focus changes to security and business activities take second place – particularly as demonstrated in budgets and human activity. • The executive starts to call for accountability and this often leads to heated discussions of