 |
Talking on a cell phone on a bike in traffic, and not wearing a helmet - is like really ignoring risk management. |
I don't get it.
How can you map a business process, record some plug numbers in an Excel and call it operational risk management?
A few years ago, I visited the Motorola factory in Israel that manufactures cell phones. They are Six-sigma certified - when a work station in the line discovers a defect in a sub-assembly, they have a pole with a black flag, they raise and the entire line stops- until the root cause of the defect is discovered and fixed.
Data security should work like that - but you need to monitor traffic and transactions first before you start buying some expensive security technology countermeasures from Symantec or McAfee.
1. Countermeasures cost and effectiveness in dollar values must come first
Both extrusion prevention and database firewalls can be expensive propositions. A product like Vontu starts at 300k (Fidelis XPS starts at 85k) + implementation cost can add another bundle. A client of mine installed Imperva last year and they're still struggling with implementation after spending 100k on the product. Imperva is being used to monitor access of a production Oracle db with the dba user/password - they would have been better off creating and segregating separate dev, test, stage and prod environments using a Linux box with iptables. The quantity of false positives that Imperva sets off is close to 100%. I would say that it is not a very cost-effective countermeasure
2. Extrusion prevention for mitigating data theft:
Extrusion prevention is best used in a monitoring role in my experience. I don't buy the story about how ILP/EPS/DLP technology can prevent credit cards from leaking out - the data classification and learning problem is too steep. We're using Fidelis Security Systems XPS in a monitoring role at a number of telecoms here and in Eastern Europe in a pragmatic operational approach that is part of the security officer work day.
You monitor, you see a problem and you fix it. You see a false positive, turn it off.
That's a far more effective strategy than trying to fingerprint all the files with all the credit card numbers and then put them into a work flow process. Geez - don't any of these vendors work in the real world?
By the way, Mike Rothman wrote a good article on pragmatic use PCI DSS compensating controls a few months ago over here:
PCI DSS compensating controls
