BeyondTrust

Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

Black Swans and Tough Trade-offs For Privilege Identity Management

Post by Peter McCalister February 10, 2011

Recently we talked about the difficult trade-off between security and productivity in regard to designing effective password policies.  Managing these difficult exchanges is a major challenge for many IT decision makers. Security is time consuming and complicated, which almost always means extra work for someone. So IT must decide: is reduced security risk worth the extra work?

In analyzing these trade-offs, it’s generally easy to measure the impact reduced security will have on productivity. It’s much harder to assess the risks (and benefits of lowering those risks) at different levels of security. The textbook answer is to look at the impact of different security threats, and then asses the probability of them occurring. Unfortunately, we are generally bad at assessing high-impact, hard to predict, and rare events, also known as Black Swans (not to be confused with the movie of the same name). As much as we analyze past events that make the press, like the breach at Mozilla and Wikileaks, there are very real and well-documented psychological biases that make people underestimate these events.

Those biases (for example- my company isn’t at risk for a security breach) then distort the results of our trade-off analyses for privilege identity management and whether or not to implement least privilege. IT organizations fall back on gut feelings, rules of thumb, past practices and most often just follow the rules and regulations so they remain in compliance. That’s a good thing to do, though hardly optimal,and raises a bigger question for IT: Does Compliance = Security?  More on that next week.

Leave a Reply

Additional articles

BI-Qualys-Connector-IMG1

Getting More Value from QualysGuard Vulnerability Data with BeyondInsight v5.1

If your vulnerability assessment scans can’t produce meaningful and actionable reports, performing a scan does no good for anyone. If you’ve read my other blog posts, you know I have no qualms about stating that BeyondTrust provides the best vulnerability reporting in the industry. Ask your favorite analyst and they’ll tend to agree. Of course,…

Post by Morey Haber April 18, 2014
Tags:
, , , , , , , ,
insider-threat-fed

Mitigating Inside Threats to U.S. Federal IT Environments

Recent high-profile cases have increased the perceived risks that go along with disclosure and usage of confidential information. One of the most difficult security threats to mitigate is an attack from the inside. When an over-privileged user, such as an unhappy current or former employee, contractor, or consultant, begins navigating your network, how will you…

Post by BeyondTrust Software April 17, 2014
Tags:
, , , , ,

Are you a Target? Investigating Security Breaches with Kevin Johnson

Last week, over 1,000 IT security professionals watched as Kevin Johnson, CEO of Secure Ideas, presented his expert opinion on lessons learned from recent, high-profile retail breaches. Here’s a summary of key takeaways from the webcast plus an on-demand recording of the full, 60-minute presentation. Understanding the “why” behind attacks According to Kevin, the primary…

Post by Chris Burd April 17, 2014
Tags:
, , , , ,