147

In my experience management doesn't like to listen to clever analogies. Depending on the person they care about the bottom line in dollars or hours of productivity. I would explain: The actual bottom line is that a compromise of our data will cost the company approximately X dollars + Y hours to recover. This is Z% likely to happen given the malware ...


93

Physical destruction of a drive is tricky business. There are many companies that deal specifically in the field of data destruction, so if you are doing any kind of mass you may want to at least look at their price list. If you contract, make sure the company is properly bonded/insured, and provides audit trails for each destroyed item. In the worst case ...


75

Now usually we gauged such problems by multiplying probability of occurrence by the expected damage, but in this case we are lost trying to multiply a number tending to zero by a number tending to infinity and come up with cohesive answer. Unfortunately this is what you need to do in this case. But I don't believe that this calculation is really as ...


60

High Level Culture In my experience, shifting a security culture takes 3 steps: Get management buy-in to do things differently Get personal management engagement to lead the way on what is important Set the tone through training, media, and in-person events that "people like us do things like this" Here's the thing: management has to be leading the charge ...


56

I would avoid the biological or non-business analogies (unless this is a hospital). Your job is to assess risk, cost, and provide options. Your management's job is to make the decision based on your analysis and advice. Generally, an approach in a tabular format is best. "approach", "likelihood of correcting the problem", "cost" are the minimum needed. ...


56

A warning that this response is coming from theory, not experience. Are there ethical consequences regarding the impact of the bad event on others? Will it hurt your users? Also consider the employees of the company who may be hurt if it is ruined by an attack. If so, you may feel you have an ethical obligation to mitigate. If you do mitigate the attack, ...


39

I think that is a false dichotomy, and your CSO is being plain silly. Though I am fond of the silliness, the security department should be driving risk mitigation. Squabbling over areas of "responsibility" are obviously not productive, though it might fit into the general corporate culture. While there are various ways of qualifying the realm of ...


36

Special firms either degauss, destroy or melt the harddrives. Harddrives are magnetic data. Magnetism can be destroyed by either: Degaussing (changing the magnetism) Heating the drive (melting) (which destroys/changes the magnetism) Hammering (shock) (shock damages magnetism somewhat, but the denting of the drive makes it very difficult to read the surface,...


34

You can drink all the red wine anti-virus you want to try and prevent getting cancer, but once you get that first tumor, more drinking isn't going to help. You need to cut it out and make sure that you get all of it, because if you don't it will come back again. Once you get infected with a virus, the obvious symptoms are an annoyance, but it is what you ...


34

Basically, if you run code from untrusted sources on a machine that has data you don't want that code to have access to, you need to patch. Desktop computers should be patched because they've got an unfortunate habit of encountering untrusted code; shared-hosting servers, particularly virtual private server hosts, must be patched, because Meltdown lets one ...


33

Think of your users as customers. You are helping them meet their business requirements to secure data. That means it's your job to keep the requirements placed on them as sensible, justified and limited as possible. It's UX engineering. Examples: if you make it hard to get a proper login on a system, workgroups will share passwords on post-its or ...


31

When looking for actual physical risks, doxing and the results are most important. There are examples of the hivemind of Reddit and 4chan where peoples exact locations, addresses, names and anything else might useful for actual physical attacks (or swatting) available online to which I will not link for obvious reasons. The amount of information that can ...


28

SSL 2 was deprecated in 2011 It was not deprecated, it was outright prohibited which is a huge difference. See also What's the difference between SSLv3 being deprecated and SSLv2 being prohibited? However many devices are manufactured before 2011 and still in use today TLS 1.0 was defined 1999 and was available in major TLS stacks (including openssl)...


25

Paranoia, professional skepticism, risk management... sometimes these concept are hard to separate. The odds that somebody is reading my packets right at this moment are relatively low. The odds that somebody has sniffed my internet traffic at some point in the past year... I guarantee it has happened, I've been to DEFCON. The advent of wireless networking ...


25

You should be taking into account the fact that your team knows about this attack vector. If simply knowing about the vulnerability makes it easier to execute the attack, you may have a bigger problem than you thought. (For example, a hard-to-find backdoor known to your team.) If that's the case, your own team members are high on the list of opponents to ...


22

In general, it is always best to reduce your attack surface. No system is ever perfect and your deactivation protocol will be no exception due to both programmatic and potential human error. Risk 1: Let's say all your terminated employees accounts have been properly de-activated, for example via altering their role in the employee table in the database (or ...


20

That's easy - just finish the quote in your question, from Aliens. It's the only way to be sure. That's really all there is to it. Nothing more, nothing less. Let them know that if you run the AV software on it and the software says it has found and removed the virus, then maybe they're ok. Maybe. If the virus was really removed. If that was really the ...


17

Yes its used, in a number of mail delivery/filtering sytems. The most recognized and widely used of which is spamassassin, used by some major ISPs and mail services. See http://hashcash.org/mail/ You might also want to read the hashcash FAQ: http://hashcash.org/faq/ It is also used in various other protocols and applications including for combating blog ...


17

While I generally disagree with the CSO, I can see a reason why he drew this line. The question can come down to the delineation of who needs to lead mitigation and remediation efforts. DDoS does, of course, impact availability but is typically handled by the Operations team. If a DDoS event happens, your CSO might feel that there is nothing that he can do ...


16

Although there are exceptions, generally managers do things for one of two reasons: Doing it will make them look good Not doing it will make them look bad Now apply this to your management to see who the key stakeholders are: Stakeholder 1: Somebody's allocated money for anti-virus, which ought to make the manager who owns the AV look good. However, if ...


15

This is a much bigger question than I think you realise - for a start, the major IT audit firms have a very large amount of Intellectual Property in this area, so while you will be able to find high level documentation, you may have trouble finding full detailed documents. From my time in a Big-4 audit firm, I probably saw over 300 workplans for audit of ...


15

If the victim is using an open wireless network, spoofing DNS is easy. It is easy for the attacker to mount a man-in-the-middle attack and send forged DNS responses. Therefore, if you are using an open wireless network, you should not trust DNS at all: it is trivial to spoof. Similarly, if the attacker is on the same subnet as you, spoofing DNS is easy: ...


15

For example, I had experienced this in my practice: When penetration testing one company, I got access to the system via a password recovery form, because the mail server provided options for security questions like "name of your dog" and "your school". This information was displayed in profiles in social networks. Having many accounts makes it difficult ...


13

Try spies. The last James Bond opus appears to make millions of entries, so the crowd at large is, for now, receptive to spy stories. Explain that once unreliable/hostile people are in charge (that's the "compromised" setup), there is no way to recover proper security by asking them to do it; and yet, that's what running an AV on an infected machine is about....


13

To be the devil's advocate, management has heard all of this. Security is risk management and they need to make the decision. Just remind them of the tools. Risk = Probability of occurance X impact of occurance 100% chance of production downtime during the rebuild and costs of rebuild vs. 0.01% chance of malicious software or backdoors remaining in ...


13

So basically what the requirement is saying is that you need to assign one primary function per server. The server you've described sounds like it runs a few applications for production users to utilize. This would be classified as an "application" server. However, you've also mentioned that there are multiple applications on that server, some touch the CDE ...


13

This is a really difficult issue, but if you have the chance to change things, you should give it all you've got. You can't change a culture overnight. However, there are steps you can take to begin changing the culture for the better. Policy enforcement This is first on my list. I'm in full agreement here that you need to enforce security policies, and ...


13

You have choosen the correct approach: Now usually we gauged such problems by multiplying probability of occurrence by the expected damage... and just faced its limits: we are lost trying to multiply a number tending to zero by a number tending to infinity I would say that you are facing an inacceptable risk (could cause a major blow to the company's ...


Only top voted, non community-wiki answers of a minimum length are eligible