I’ll be the first to admit - security people are techno-junkies. When some new tool comes out that promises to make our lives easier, we want it. We crave it. And we think of justifications as to why we need it. In some cases, our reactions almost seem Pavlovian. I’ve seen cases where an organization bought a new spam appliance because… well, because it was cool. “This device can protect 30,000+ email accounts, and block thousands of spam messages an hour” - it didn’t matter that the whole company had less than 40 people, and the only person who had a spam problem was the CEO. What did matter is that a case was made that hours of employee time was lost dealing with spam every day, and if the problem could be solved, the company would save money.
That is the same type of justification I hear often - “if we buy <some shiny box> we can save the company gobs of money.” Considering most people are paid a salary, there is no return on investment - just because you take away something that occupies an employee’s time does not mean they will spend that time improving widgets or writing cleaner code. Any time I hear that something will “save money,” I cringe. If salary expenditures can’t be reduced because of the new appliance, or if there is no real connection between the appliance and production or quality improvement, it’s a loss, not a gain.
So, when should new “toys” be purchased? There are some appliances that are so ingrained in our minds as being useful, that their purchase is almost rote. For example, firewalls. No company should possibly think of doing business over the Internet without a firewall. Company’s also need a decent patch process, or else they become too mired in worms and viruses to be effective in their day-to-day business activities. The reason they are so embedded in most companies is not because they save money (some devices and designs can be very costly), but rather that they reduce actual threats to the company: hit by a worm - nobody works; don’t have a patch program - get hit by a worm and nobody works. But not all applications actually reduce a threat.
Back to our spam analysis, some would argue that spam often carries malicious code that could ravage a network if an employee negligently executes the code. This is true, but since we know nothing is fool-proof we have to assume this will happen regardless if there is a spam blocker on the network or not. It might happen less frequently if something filters all email looking for spam. However, an equally effective alternative could be a better training program for employees, explaining what malicious code might look like in an email. In other words, a new appliance should not take the place of educated employees, and spam is not the real threat to the company - lack of user awareness is.
Despite the techno-lust many security people have, it does not always make sense for managers to buy the latest and greatest gizmo suggested by security experts or vendors. Now, I know this is not some new revelation - managers have been dealing with this type of over-hype for many, many years. However, sometimes it is difficult to really know what is beneficial, and what is wasteful.
I had a discussion with someone who had been in the military, who had the responsibility for a broad swath of military network security at one point in his career. When he was placed into the role, one of the biggest problems was, that despite all the money being spent on applications to improve security, the amount of incidents within his area of responsibility increased. As a solution, his subordinates constantly made suggestions to acquire newer versions of old appliances along with new appliances. Instead, he put a moratorium on all new purchases for a year and instead funneled the money towards training. This quickly reversed the trend, and the incidents decreased.
Jan Killmeyer proposed five components within an Information Security Architecture (she has added three more, but the original five are sufficient for this discussion). They are:
- Security Organization / Infrastructure
- Security Policies, Standards, and Procedures
- Security Baselines / Risk Assessments
- Security Awareness & Training Programs
- Compliance
Overall, the appliances used to reduce threats are a minor component to an overall-successful information security program. An organization should not pour additional funds into infrastructure if training programs and compliance monitoring are lacking. A new shiny box will not make up for a lack of strong security policies, standards and procedures. And, unless the techno-junkies or vendors can demonstrate how their newest favorite appliance can “save money” that actually ends up in your pocket, perhaps the funds to purchase are better off untouched until all other areas of a security program are improved.
Security costs money. That is well known. It also does not “save money,” either. The sooner people within the security community accept that notion, the better. What security does is enable the organization to succeed. But to succeed, a security program must balance all components effectively, and not just focus on the shiny toys.
0:13
