More from the "Great Thinkers" series

OK, so I don't have a great thinkers series but I think I'm gonna start one. One of my soap boxes is the need for IT and especially Information Security Professionals to quit thinking alike and start thinking about your specific needs and the best way to protect your company. That is key to really being successful. If you just follow best practices and the crowd you probably will be secure but you will never move beyond average. If that is what floats your boat then that's fine, but if you want to really make a difference and have the best chance to advance your career then you have to change the way you think. You have to keep on top of your game.

Rebecca Herold has a good post on her blog where she give advice on "elevator speeches". In essence she is telling us that we need to be prepared to sell our program, ideas, plans and such at a moments notice. We need to be prepared for the unexpected opportunities that sometimes come our way. It may be a ride in the elevator w/ the CEO when they ask you about your program. It may be that you get a call from your boss or your bosses boss. They want you to brief them on the status of your security program and they want it now or very shortly. What will you do? Have you thought about that possibility? Are you going to give them stats, charts and figures? Are you going to tell them about all the technology, policies, and such that you have in place? What about using this opportunity to give them a quick overview and at the same time sell them on the importance of the program and keeping it fresh and moving forward. If we tell them that we haven't had a breach and all is well then they may say "Great, Your doing a wonderful job. Keep up the good work!" Then they go on about their business and forget all about you. You don't get the funding you need for future projects and upgrades. You don't get the support you need to keep things going well. Then you get hit and it's your fault for letting it slip off their radar.

I'm not saying that you need to use FUD (Fear, Uncertainty, and Doubt) to keep them "afraid", but you need to know not only the status of your program but also what you need to keep it in good order. You need to think about how to best sell your program or at least keep it on the radar of management.

PCI and your network

Many of us work for companies that have to comply with various regulations. HIPAA, SOX, GLBA, FISMA, PCI, and on and on. For me in my current position it it PCI. I am familiar with the basics of most of the above mentioned regulations and know enough about them to tell you that many of them are vague (which may or may not be good) and difficult to interpret and understand. PCI is NOT one of those that falls under that category. PCI is pretty clear and does pretty much everything except tell you what brand of equipment to use and what vendor to buy it from.

I read a couple of articles today by Rebecca Herold and Ben Rothke at CIO.com that got me to thinking a little about my own PCI woes today. Both of these articles assert that PCI is not a complex monster like some would lead you to believe. It is fairly clear and straightforward. Yet lots of people complain about it and talk about how much it costs to comply and how much work is involved and how long it takes. Which is true to some degree. It can be long, costly and time consuming, but it is still just basic information security sense.

Between the stuff that you can find at the PCI Security Standards web site and a little ask.com searching (still not using Google unless I have to) you can find just about everything that you need to put together a plan to be compliant in short order. That doesn't mean that there will be some areas that you need clarification and direction on. There will be questions that you have no clue how to answer. But it's not rocket science. I think Ben Rothke nails it on the head when he says.

The issue really is that these merchants have created their networks with little to no thought to security and privacy. They have placed minimal controls on their users, given no direction to their application developers, nor documented required procedures for their administrators on how the network should be managed. Merchants are not noncompliant due to PCI DSS; they are noncompliant because they never developed their security programs in the first place.

These Tier 1 and 2 merchants and many of the smaller merchants have large complex networks that are old and were designed with ease of use and administration in mind and not security focused. They put in the basics to keep the passive snooper out but not the aggressive hacker. They are complaining because they did not do a good job and now they have to go back and clean it up. That is why it is expensive, time consuming and complex. I know this first hand because that is what I'm up against. I'm having to retro fit security into some areas that should have had it in the first place. I'm just lucky that I'm working with a standard that is cut and dry or I'd really have something to complain about.