Security Dreamer

Steve on the future of smart cards, access control and security management at ASIS

Please come to a open luncheon in Anaheim on Tuesday, September 22, 2009, 11:30a - 1:00p

I'll share some of my research and vision on access control and security management and the role of smart cards.  I'd love to hear what you think, too.

Lunch is sponsored by Salto Systems.  If you'd like to come to this free event, send an email to Cindy (c.downing@saltosystems.com) and let her know I invited you.  She'll give you the details.

See you in Anaheim!

The Security Industry Post Convergence, Post Standards (Integrators and Dealers, pay attention)

Over the last decade I’ve been trying to help the security industry grow and evolve.  I spent several years elevating the discussion of convergence, defining it, and helping end user organizations build lines of collaboration across physical security, IT and business units.  Then I worked closely with the vendors, manufacturers of security equipment and software, helping them to see the usefulness of standards, interoperability and effective use of computers, software and networking for security.

Now I want to help the industry in a new way.  I have a program to assist “the channel” – value added resellers (VARs), integrators, managed service providers, dealers, and monitoring companies – to demonstrate their ability to provide high levels of service.

A few years ago I began collaborating with some other industry experts to craft a new kind of accreditation called a Trustmark.  The idea behind a Trustmark is to certify that service providers (including integrators, dealers and even manufacturers) uphold information security best practices internally, themselves.  In my experience, loads of folks know how to screw equipment to a wall or rack, but few understand what business value the customer really wants.  I want all service providers to demonstrate that they understand security from the customer’s point of view.

The Trustmark will be that accreditation.  CompTIA, a venerable professional association, manages the Security Trustmark program.  I will be devoting much of my time to helping CompTIA find the industry players who are qualified to carry the Trustmark accreditation.  The cost is nominal, just sufficient to cover the program management and auditing process.  However, companies that qualify will be showing me and their customers that they are different.  That they “get it.”

If you are interested in learning more, contact me (steve.hunt@huntbi.com) or visit the CompTIA website.

Hiking the mountain to security enlightenment (video)

Freeform ramblings while hiking to the top of Multnomah Falls in Oregon.

Sue the Auditor and Shut Down the Firm, says Rothke

Irresponsible auditors deserve a harsh fate, and irresponsible auditees deserve a legal injunction, say Ben Rothke and David Mundhenk.  Read the strongly worded opinion here.

The Emperor Has No Clothes

[I'm pleased to post another essay from our favorite guest writer, Padded Arrow, a US-based end user who works in the security department of "a really big, global company." - sh]

We are all aware of the challenges the economy is having right now; what I find interesting is watching the reaction from within a global organization.

A few years ago, projects were abundant to the point that it was next to impossible to complete them all. Employee morale was at an acceptable level and most worthwhile projects were funded. Management was content to set direction and keep projects moving. The larger the organization, the more siloed (or segmented) technology became.

Today, after subjecting the same ecosystem to increased pressure from regulations, lower margins and a shrunken bottom line, I am noticing some interesting / disturbing trends:

• Employment is used as a weapon to humble employees. If I hear "at least you still have a job" one more time, I am going to scream. Employment is about finding the best talent and keeping them happy.
  
• Management is forced to rank projects by investment rather than risk. The budget cycle becomes more important to managing projects which doesn't affect project that fall within the cycle. Projects that span multiple budget cycles are usually negatively impacted first. The best way to show that you are helping the bottom line (and protecting your job) is to cancel all spending in the current budget cycle.
• The dance of the "management shuffle" starts...change makes opportunities for career advancement but is bad for long term projects. My theory is that each management restack adds at least 6 months to all active projects.

In my strongest yet respectful tone...now is the time to be introspective. The silver lining in the current economic cloud is this is a great time to do some much needed housekeeping.

• Inventory what you have. People, equipment, software, facilities, etc. are all resources that are needed to build a successful organization. Creative use of technology and resources will help stabilize the organization and possibly future-proof your operations.
• Finish your projects! Too many times I have seen great projects fail because management changes and priorities are different.
• Focus on details that get missed during project delivery. Documentation, documentation, documentation...if done correctly, documentation can be a valuable asset to your organization. Many regulations now require that proper documentation is available.

The government has a long history of protecting the public from themselves. Seat belts in cars weren't used until it was mandated. We are not smart enough to realize using cell phones, texting, applying makeup, shaving, reading, etc. are dangerous while driving so laws are created. The same thing applies to regulations. Businesses are too ______ (fill in the blank: stupid, lazy, defeatist, short-sighted) to do it for themselves so regulations are created. They are usually a MINIMUM standard. Exceeding the standards (or building it right in the first place) is a way of future-proofing the organization and keeping you out of the media due to security incidents.

The bottom line is "get the basics right first." If every employee had ALL the information required to do their job readily available to them, efficiency would skyrocket. Now is the chance to get the technologies, people and processes in place to fortify the organization for future survival. Get to work and stop crying around the coffee pot.

One final note for managers - focus on being the best manager you can be rather than making opportunities for your next move up the corporate ladder. Protect your people in hard times and you will be rewarded. Your staff are your most valuable resources.

My goal is not to offend but rather inspire some discussion. If you do what you've always done, you'll get what you've always gotten. Feel free to contact me if you would like to discuss this further or want to offer me my dream job ;-)

- Padded Arrow

Steve speaking in the Pacific Northwest this month

I'm speaking at a morning workshop in Portland, Seattle and Vancouver in a couple weeks.  I'd like to invite my SecurityDreamer readers to attend. 

The free event is designed to promote discussion on a very important issue facing all of us in the the security industry, namely standards and integration.  As new technologies are developed to better meet the needs of our customers, how can we risk deploying them without straightforward integration? 

Please join me for this discussion. And please do tell your friends. Details are here.

Not inclined to reveal the culprit just yet

I've gotten tons of requests from a variety of folks to reveal the company that discarded all that confidential and very scary data, which I chronicled in a video on this blog, and then posted as an expanded video with the help of CSO Magazine. 

Was it Bank of America? Chase? Harris? Northern Trust? 

I ain't telling unless I can decide that it's really in everyone's best interests to know.  But I've heard some compelling arguments.  What do you think?  email me: steve@securitydreamer.com

Approaches to enterprise information protection changing - as Axelrod, Bayuk, Hunt and others show

A book I contributed to is available on Amazon.  Warren Axelrod and Jennifer Bayuk edited this collection of essays on security and privacy.  I think it is a special, unique view of how physical and logical threats, plus dynamic business and compliance trends are changing how security needs to be done.  My chapter was on security as it relates to the Transportation industry.  I took a logical and physical view of the problem.

Learning an IT lesson from a home contractor

Here is a post written by an end user security professional who will be known here simply as Padded Arrow.  I believe you will find his perspectives on IT, security, risk management, and technology to be enlightening. -sh

Mike Holmes is a Canadian building contractor whose popular TV show tag line is "Make it right". Not just a catchy phrase but rather his way of working.  If you have watched his shows, one of the underlying messages is “Building codes are MINIMUM guidelines.”  Often, the right way to do the job is not in the same league as "code."  Mike prefers to "Make it right" rather than "make it code."

What does this have to do with IT and Security?  Many regulatory requirements (SOX, GLBA, HIPAA, etc.) come from a need to "raise the bar" on the quality of IT construction, safety and security.  Too often, IT projects are a knee-jerk reaction to the current challenges in the IT environment, both real and perceived (aka marketing hype). Sometimes, regulations (building codes) seem to have more influence to direct IT than what is the best course of action for the company.  At what point does a company decide to plan its IT strategy with the business and long term survivability as a priority?

Instead of "Make it right", team up to "Make IT right".

Topics We're Talking to Clients About

My team and I are spending more time talking to end user business managers about compliance lately. Here are some of the inquiries we've received.

1.       The area of compliance is very complex. My organization is multinational and has several overseas locations – what is the best way to approach compliance from the corporate standpoint?

2.       Massachusetts has just enacted a new data privacy law “201 CMR 17.00 "Standards for the protection of personal information"; how does this law differ from others and what should organizations do to prepare for similar laws?

3.       Is it true that payments that are legal in many countries are prohibited by the Foreign Corrupt Practices Act (FPCA)?
   a.      How do organizations avoid issues with FCPA?
   b.      What are an organization’s core responsibilities under FCPA?

4.       How can organizations figure out what they should be doing in terms of preparing and executing electronic discovery?

5.       What are the latest trends in domestic partner law and how will they impact employers?