Login  |  Register  |  Contact

My Personal Security Guiding Principles

Fall of 2009 marks the 20th anniversary of the start of my professional security career. That was the first day someone stuck a yellow shirt on my back and sent me into a crowd of drunk college football fans at the University of Colorado (later famous for its student riots). I’m pretty sure someone screwed up, since it was my first day on the job and I was assigned a rover position – which normally goes to someone who knows what the f&%$ they are doing, not some 18 year old, 135-lb kid right out of high school. And yes, I was breaking up fights on my first day (the stadium wasn’t dry until a few years later).

If you asked me then, I never would have guessed I’d spend the next couple decades working through the security ranks, eventually letting my teenage geek/hacker side take over. Over that time I’ve come to rely on the following guiding principles in everything from designing my personal security to giving advice to clients:

  1. Don’t expect human behavior to change. Ever.
  2. You cannot survive with defense alone.
  3. Not all threats are equal, and all checklists are wrong.
  4. You cannot eliminate all vulnerabilities.
  5. You will be breached.

There’s a positive side to each of these negative principles:

  1. Design security controls that account for human behavior. Study cognitive science and practical psychology to support your decisions. This is also critical for gaining support for security initiatives, not just design of individual controls.
  2. Engage in intelligence and counter-threat operations to the best of your ability. Once an attack has started, your first line of security has already failed.
  3. Use checklists to remember the simple stuff, but any real security must be designed using a risk-based approach. As a corollary, you can’t implement risk-based security if you don’t really understand the risks; and most people don’t understand the risks. Be the expert.
  4. Adopt anti-exploitation wherever possible. Vulnerability-driven security is always behind the threat.
  5. React faster and better. Incident response is more important than any other single security control.

With one final piece of advice – keep it simple and pragmatic.

And after 20 years, that’s all I’ve got…

—Rich

No Related Posts
Previous entry: Hosting Providers and Log Security | | Next entry: Prison Computer ‘Hacker’ Sentenced

Comments:

If you like to leave comments, and aren't a spammer, register for the site and email us at info@securosis.com and we'll turn off moderation for your account.

By Tyler Hannan  on  12/30  at  10:41 AM

That’s “all” you’ve got?  Those 5 principles are sufficient to cover the vast majority of situations I’ve happened upon (in payments, in government sector, in enterprise, in consulting).  The distillation into the list is excellent…I think it deserves printing and hanging on the wall in my office.

By Jeff Pettorino  on  12/30  at  11:46 AM

I agree with Tyler…that’s all you’ve got?!? Quit slacking! Haha, excellent piece, those principles should be taught to every InfoSec practitioner or student everywhere. Well done!

By David J. Meier  on  12/30  at  03:34 PM

#5 should be #1 on giving advice.  I think that’s going to be my statement of choice for 2010.  I can see it now…

Me: You will be breached.
Them: But I haven’t been yet.
Me: How can you be so sure?
Them. ...
Me: You will be breached, if you haven’t been already.

By Lucas Gregson  on  07/12  at  11:23 AM

Excellent Post!

My personal favorite is #2. Why do people always stop at defense? What do they think will happen when they are breached?

Keep up the good work,

Lucas Gregson

By Achim Muellers  on  12/11  at  05:14 AM

That

By ashad hosain  on  11/28  at  09:29 PM

Engage in intelligence and counter-threat operations to the best of your ability. Once an attack has started, your first line of security has already failed.

By ashad hossain  on  01/18  at  09:08 PM

Use checklists to remember the simple stuff, but any real security must be designed using a risk-based approach. As a corollary, you can’t implement risk-based security if you don’t really understand the risks; and most people don’t understand the risks. Be the expert.

Name:

Email:

Remember my personal information

Notify me of follow-up comments?