5

If you where called by Sony right now, had 100% control over security, what would you do in the first 24-hours?

Improve this question
1
  • @blunders, this idea could be excellent for a series of blog posts if you are interested. See the link to the meta question on a security stackexchange blog.
    – Rory Alsop ♦
    Jun 7, 2011 at 6:53

2 Answers 2

Reset to default
5

Typically, one has an approach that involves isolating breaches, identifying them, restoring service with the immediate attack vectors closed, and shoring up after that.

Sony's issue appears to be systemic. Their systems are varied, complicated, and numerous. As I understand it, weaknesses are everywhere. They cannot return to functioning because even they are not compromised in an isolated way.

In this way, Sony is a bad example for your idea. In another way, Sony is a fantastic boon to us. Need an example of poor security destroying something that didn't go out of business right away and wasn't too small to ignore? This is it.

Isolate and identify is now... forensics on the machines, work with law enforcement immediately because this is a "big fish" issue. Restoring service is just about out. Everything needs to be looked at from a basic level on up with security in mind. Sony in its present state may not even be able to identify where valuable data is located at.

You don't get here, because here is the bad place to be. Too big to react, too long without considering security implications. Nothing can be trusted, and fixing everything will be very expensive.

Improve this answer
4
  • 3
    I think that's all above-and-beyond reaction. It wouldn't hurt to have all that, but the cost would be high and the investment return only worthwhile once the real systems are secured. IDS (IPS) and DLP are useful for the current systems... to an extent. I'm still convinced that Sony isn't aware of their assets -- they don't really know what to protect and everything is there organically. Smoke and mirrors on top of it might confuse Sony more than it would an attacker.
    – Jeff Ferland ♦
    Jun 7, 2011 at 13:27
  • 3
    I agree; it's too early for Sony to start applying technology to the problem. They need to identify their assets, vulnerabilities, and threats. They should be spending millions of dollars ASAP on the best team of internal and external auditors money can hire.
    – user502
    Jun 7, 2011 at 17:20
  • @blunders and IDS, DLP, etc - these are not 24-hour fixes, smart deployment plans take longer than that to do right.
    – AviD ♦
    Jun 9, 2011 at 20:00
  • @blunders, your rules were "... in the first 24 hours". Deploying IDS, DLP, etc do not fit that criteria. (and FTR, I didnt ask you to accept it ;) )
    – AviD ♦
    Jun 9, 2011 at 20:27
2

Since Sony is a Japanese company, I would imagine the management structure of the subsidiaries is very hands off. That is very typical of Japanese owned and managed organizations. A big piece of this is likely due to the autonomy given to individual organizations to "do their own security."

Due to this, I would establish a global governing body and get Sony to require presence in each organization to act in the internal audit and reporting capacity that reports to Sony Legal in Japan on a weekly basis.

Improve this answer
1
  • Great comment! Understanding enterprise governance starts with understanding enterprise culture. And it seems that in Japan it's not exactly what we would expect. Thanks for offering us a glimpse.
    – George
    Oct 5, 2011 at 7:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .