Hi,
this week I gave a presentation together with Florian Barth from Stocard on Docker, DevOps/Microservices, and Security — a topic and collaboration that I will definitely cover in even more detail in the future!
The slides can be found here.
so long,
Matthias
Continue readingHi,
I’ve discussed the concept of evaluating the operational “feasibility” (or
“impact”, depending on your point of view) of security controls
before.
Some people approached me asking “which considerations should we take into
account when trying to understand or rate this for $SOME_SECURITY_CONTROL?”.
Therefore, in the following I’ll give an unordered list of factors to consider
to get an understanding of the “operational feasibility” of a given security
control. Two things should be noted in advance:
I can’t help myself. And I fully understand that some of you, dear readers, might get a bit annoyed by always hearing the same tune from our side. This post is, surprise!, about yesterday’s Microsoft Patch Tuesday which – as can be seen here and here – disclosed quite a number of vulnerabilities in various Microsoft components. To make the point evoked in this post’s title I’d like to draw your attention to two particular bulletins, both rated as critical.
Continue reading Continue readingWhen taking security decisions of whatever kind (e.g. for/against a certain
control) one should always consider two main parameters: the security benefit of
some action (“how much do we gain with regard to security/to risk reduction?”)
and the operational impact or effort (“how much does it cost us opex-wise?”).
While this may seem fairly obvious it is often overlooked. One reason is that
people think “doing more can’t hurt”. Which, unfortunately might be plain wrong
in many cases. There is _always_ an operational cost of an additional measure.
And the security benefit _must_ be worth this cost.
If it’s not, implementing a certain control might just be… waste.
Before giving two examples I’d like to note that this is one aspect I
particularly like in the ISECOM OSSTMM where
one of the main metrics, that is the “rav” can be higher than 100% which in turn
can be used “to prove when money is being overspent on the wrong types of
controls or redundant controls”.
[it should be noted that I’m in heavy disaccord with quite some other parts of
the OSSTMM; more on this in a post to follow in some days. still the “rav” as a
potential representation for showing waste is a really nice thing].