Carl Weinschenk spoke with Matt Flynn, strategist, NetVision.

Weinschenk: Your take is that malicious threats may get the headlines, but that dangers from non-malicious sources are greater.
Flynn: I think the other type of threats, the non-malicious threats, are extremely prevalent. Those things are not reported because they are not identified as attacks. I did about eight years of consulting. I was amazed. I could walk into any company and plug in my laptop and not be asked who I was. That to me is a bigger threat than malicious attacks.

Weinschenk: What's going on?
Flynn: I think it is not adequately managed. I think people realize it's going on but are not doing anything about it. One of the surveys I read, from RSA in November, reported that about 35 percent of respondents said they need to work around security policies to get their job done. They decide to go around policies because that’s what they need to do.

Weinschenk: It seems like it is part of the overall change in how companies do — or should — think about security.
Flynn: We are moving away from a perimeter-centric view of security to an information-centric point of view. In other words, it is not just about a firewall and protecting the perimeter. You need good security controls and monitoring inside the firewalls. One example is that it is not a good idea to just set a policy and say certain people do not have access. You should also watch the daily activity. I think it's an ongoing process, to look constantly at policies and your risk posture and see if the right controls are in place or not.

Weinschenk: Are policies and people's willingness to follow them more important than the technology itself?
Flynn: Behavior is more important than the controls that are in place. One example is that every company have super-user administrators with access to everything, but security policies state they should not have access to some data on the network. I don’t want them to access, for instance, HR files that describe other employees' salaries. The organization has to give him rights because he grants and denies rights [to others]. He has to have technical power to access those files, so it's up to him to decide whether he breaks those policies or not.

Previous Page Next Page