Thursday, August 13, 2009

Incident Detection Mindset

Often you will read or hear about a "security mindset," but this is frequently an "offensive security mindset." This attitude is also called a "breaker" mindset, described in my old post On Breakership. The offensive security mindset means looking at features of the physical or digital worlds and reflexively figuring out ways to circumvent their security or lack of security. Johnny Long is one example of a person with this mindset -- pretty much every place he looks he is figuring out a way to profile or subvert what he sees! To a certain extent this mindset can be taught, although one could argue that truly exceptional offensive security pros have this mindset embedded in their DNA.

It occurred to me today, after writing Build Visibility In, that I have a different mindset. I have an incident detection mindset. Often when I interact with the physical or digital worlds, I reflexively wonder how can I tell if this feature is trustworthy? For example, when I first received my Corporate laptop, I wondered "how can I tell if this box is owned?" When I received my Blackberry, I wondered "how can I tell when this device is owned?" In other words, if the device is compromised, it is not trustworthy. How can I tell?

The prevailing security mindset is a "defensive security mindset," where security people are taught to plan for and resist incidents. This attitude is necessary but not sufficient. We need people who plan for and resist incidents, people who can detect and respond to incidents, and people who can think offensively to assist those who work defensively.

I believe all three of these mindsets can be taught, but of the three I think the incident detection mindset is the rarest. Working to develop an incident detection mindset is one of the goals of this blog, and of posts like this one and the last.

3 comments:

Oedipus McGillicuddy said...

Sorry, dude. No self-respecting professional organization would use the StarCraft font. Looks like the security biz is still smoking its own hype.

MegL said...

Anything can be taught, but what CAN'T be taught is the passion for security which I think is a pre-requisite for the incident detection mindset to really be ingrained. We need more people who think that way to win within security.

Anonymous said...

Incident detection is something I've been focusing on lately and I'm disappointed I couldn't make the Summit.

How can you tell if your corporate laptop or Blackberry is owned? NSM is required. If you see the device communicating with hosts in the .cn, that's pretty suspicious for many organizations.

But what if your BES is owned and your Blackberry only communicates with the BES? You need visibility into the BES. You need to monitor more than just the end point, you need to monitor the infrastructure.

What if your BES has to regularly check in with RIM and RIM is owned? How can you know your company's data isn't trickling out a few bytes at a time over a period of months?

How well does this scale when you're dealing with an enterprise as large as yours?