Let’s Start At The Very Beginning
Last week Jeremiah “Purple Belt” Grossman posted the following question:
“You’re hired on at a new company placed in charge of securing their online business (websites). You know next to nothing about the technical details of the infrastructure other than they have no existing web/software security program and a significant portion of the organizations revenues are generated through their websites.
What is the very first thing do on day 1?”
Day one is going to be a long day, that’s for certain. Like several commentators on the original post, I’d start with talking with the people who own the application both at a business and technology level. Basically, this is a prime opportunity to not only understand what the goals of the business are but also get everyone’s perceptions of their needs, and equally important their perceptions of the cost of their systems being unavailable. The next few weeks would be used to determine where reality diverged from perception. But day one is when I get to make my first impression and if I can successfully convince people that I really am on their side, it will make the rest of my tenure much easier. I’ve found that I can do so by demonstrating that my prime concern is enabling the business to accomplish its goals with a minimum of hassle from me. One of the key ways of doing this is spending my time listening, and limiting my talking to asking questions that lead my interviewee to the necessary logical conclusions rather than being a dictator….
…not that I don’t reserve the right to hit things with a hammer later to protect the business, but day 1 sets the tone for the future, and that’s far more important than putting in X fix or blocking Y vulnerability.
windexh8er Jun 27
Very well said. It’s definitely a fine line to walk between trying to come off as buddy-buddy and security-nazi. If you’re too lax with your technical liaisons you may never get any information out of them — that’s not always the case, but I’ve seen plenty of examples of that happening. At that point you end up on the slippery slope of the BU starting to push on you for answers (obviously they want results quickly if you’re a contractor) and then you start to become the nasty guy on the other side.
I agree though, make friends, but make sure not to take everyone out to dinner the first night and let your guard completely down after 5 bottle of wine and shots you don’t remember drinking.
Day one is definitely all questions as you point out Rich… Off the cuff insight on infrastructure you know nothing about usually ends up digging yourself a nice big hole and lots of back pedaling.
–windexh8er