Opinion

Complacency Can Be a Dangerous Thing

By Bob Bragdon, Publisher, CSO

October 18, 2007 — CSO —

I think my paranoia is getting to me again. Im seeing complacency everywhere I look and, frankly, its pretty unsettling. Ive watched the memory of 9/11 sink into the background of Americans minds, replaced with a belief that since nothing has happened since 2001, we must be safe. Time can be a powerful driver of complacency.

I have also watched our businesses and organizations become complacent in their efforts to secure their assets. It has been years since weve had any sort of major, widespread malware attack. While many security professionals understand that the risk has never left (its only changed), our business leaders are falling into the mind-set that its been years; we must be safe. This directly impacts our ability to protect our nation and our businesses because as you seek to justify the investments in security that you know must be made, you will encounter skepticism of the threats. And for the investments that have already been made, your judgment will be called into question.

CSO recently completed its fourth annual E-Crime Watch Survey in cooperation with the United States Secret Service, the Carnegie Mellon University Software Engineering Institutes CERT Program and Microsoft. This years study had some interesting findings:

58% of e-crimes were committed by outsiders, 26% by insiders and for 17%, the source was unknown.

22% of security events were targeted specifically at the company that was attacked, and that number is growing, as are financial losses resulting from those targeted attacks.

Information security budgets fell 5%. Effective policies and procedures, like using background exams on new employees and contractors, fell to 57% from 73%, while employee security awareness training fell by more than half.

The study also found a continuing focus on the use of traditional perimeter technologies (firewalls, IDS/IPS, etc.) even though the increasingly targeted attacks being perpetrated are designed to bypass those defenses. So are security executives being smarter about how to defend their enterprises? I hope so. Does it mean they are truly more secure? I doubt it. Hear that rumbling in the distance? It may be senior management beginning to question the value of your security investment. When they ask, Were we not attacked because our security was so good, or was it because we werent going to be attacked in the first place? it may be too late.

If the answer is because security is so good, and senior management realizes it, then you have done your job well and it is recognized. If the answer is the latter, then you better start getting your résumé in order.

• Email
• Print
• Comments
• Digg This
• SlashDot