Skip to content ↓ | Skip to navigation ↓

With apologies to the ghost of Hunter S. Thompson, I write this as one of Hunter’s favorite words for a person who was fresh meat in battle, “Rube.”  Thompson’s battle theaters were politics, war, corporate malfeasance, sports culture and media as infotainment.

Personal and Professional Data Deluge

My new battlefield is IT security and compliance automation. My first tour of duty was the Gartner Security & Risk Management Summit 2010 (Participant threads on Twitter here: http://bit.ly/9EmuJB ). I prepped for this  summit by carnivorously cutting my teeth on data breach stories past and present, IT security spending trends, and leaching off the minds of Infosec’s (Information security) indentured servants,  on the battles between “white hats” and “black hats” on the Wild Wild Web, and discovering other ominous terms out of Sci-fi novels like“Cybersecurity,” “Bots,” “APTs,”  and “Widening Attack Surfaces”

Jerry Bruckheimerwould have blushed, to be sure.

What washed up on the beach

A few observations after wringing out the jet lag and the PowerPoint deluge from my brain:

  • A random sampling of attendees at sessions and lunch tables revealed that at the end of the day “Security” centered on protecting personally identifiable and critical business data and infrastructure from being taken, taken over, lost or peppered with unauthorized access.
  • Security, IT or otherwise, is measured day-by-day, hour-by-hour and is a life-long journey, not a destination
  • “Absolute security” is not only impossible – it can be as harmful, if not more harmful, to a organization than a full-blown breach
  • Fear, Uncertainty, Doubt and Dread (FUDD) is the prevailing mood
  • John Ashcroft being self-deprecating was uncomfortable for both of us
  • I left more insecure than when I got there
(Big John Banters with Summit Audience)

Audit Fatigue, Breach Fatigue & the “Red Bull” of Knowledge

When I say insecure, I mean to say that once you dive into the vernacular of threat vectors, the data that points you toward the fact that great harm can come from something as seemingly as innocuous as a worm and that organized crime prefers data theft over illegal drugs as its most profitable illicit enterprise – human nature dictates that you’ll feel more than a little spooked.

And yet…despite evidence to the contrary…the more I talked to people on the front lines of protecting personal and business critical information and IT infrastructure from Black Hats, well-intentioned white hats and IT admins with baseball caps or no hats at all, the more I came to realize that they want to put FUDD out to pasture with knowledge.

A survey of people whose names I’ve forgotten, but faces I might recall, resoundingly said they were not only experiencing audit fatigue from having to pore over data logs until they were blind from seeking out suspicious needles in a stack of less suspicious needles–but  were also well worn of data breach horror stories (3.4 million search results on Google as of this writing).

One woman from a well-known insurance company told me flat out: “I don’t need to be scared into taking action. I just need to know what I can do to stop it,” pausing briefly, then continuing, “and how to convince my boss that we need to do it.”

So, for her and the others I listened to, spoke with or spied on, I’m going to hunker down in my IT Security foxhole to find the “HOW?”and continue my battle to neutralize the FUDD
>.

I heard over and over that Goal #1 was to protect data with the visibility to find threats before the breach, the intelligence to take decisive action and the automation to both keep operations up and running and securely use data through automated security controls to get business done. Find out more on how Tripwire does this here.

Hacking Point of Sale
  • Mark, that's the most entertaining piece about IT security I've ever read. You'll do the industry some good! But I sure wish the font on this page wasn't so small. Was this blog designed by 20-somethings? I suspect that's not your target audience. And when I increase the font size, it just bleeds off the left column.Keep neutralizing, my friend. Just don't make me squint.@CarriBugbee

    • Carri,
      Thanks for reading and particularly for your comment. Exhilarating subject matter that changes with the wind, that much is for sure. I haven't seen any 20-somethings in my neck of the woods, but I'll be sure to surface the need/desire for a squint-free user experience.
      Keep reading and sharing!
      Best,
      Mark http://www.twitter.com/MarkAEvertz

    • markevertz

      Carri,Thanks for reading and particularly for your comment. Exhilarating subject matter that changes with the wind, that much is for sure. I haven’t seen any 20-somethings in my neck of the woods, but I’ll be sure to surface the need/desire for a squint-free user experience.Keep reading and sharing!Best,Mark@MarkAEvertz

  • Scott Anderson

    Praise for any posting that weaves together Hunter S. Thompson and former AG John Ashcroft — not to mention FUDD. Gents Yin and Yang make good bookends for the broad issue of IT security. And, though I wish it weren't the case, it's likely that Fear of the economic consequences of IT insecurity will rule the day, despite the fatigue and thousand yard stares. Fear is a good motivator, always has been. It's about channeling it and transforming the FUDD…

    • Scott,
      Thanks for the praise. Surprisingly easier to weave that thread than I thought. Point well taken on fear being a good motivator. I'll admit, fear always shakes me into action. That said, I always end up having to course correct or recognizing way too late the opportunities I left on the table to prepare for future heartache by being too haphazard and reactionary at the outset of any attempt quell immediate insecurities. I suspect the human beings that make up the IT Security Panopolis are in much the same spin cycle. I encourage deep breathing exercises and then leaning on the people, processes and technologies that have fought a similar battle before and survived or thrived.
      Thanks for reading and your comment. Keep it coming!
      Mark

    • markevertz

      Scott,Thanks for the praise. Surprisingly easier to weave that thread than I thought. Point well taken on fear being a good motivator. I’ll admit, fear always shakes me into action. That said, I always end up having to course correct or recognizing way too late the opportunities I left on the table to prepare for future heartache by being too haphazard and reactionary at the outset of any attempt quell immediate insecurities. I suspect the human beings that make up the IT Security Panopolis are in much the same spin cycle. I encourage deep breathing exercises and then leaning on the people, processes and technologies that have fought a similar battle before and survived or thrived.Thanks for reading and your comment. Keep it coming!Mark

  • Corvinaaron25

    Anyone who wants to know how to effectively communicate why IT security matters should read this blog. A Hunter S. Thompson reference? Breaking out Bruckheimer? The take on Ashcroft was beautiful. It also, perhaps unwittingly, broke the news to me that he's still alive. I've interviewed IT officials about what they do and have often found that they struggle to explain it. It's not that it's not important. It's extremely important given the New Media world we inhabit. But you've got to be able to break it down with a little humor and passion and some muscular writing … just like Mark does with this blog. Bravo.