This was first published on Linked in https://www.linkedin.com/pulse/hopes-2015-dinesh-o-bareja
My prescription is for awareness and common sense! Both practices need guts and will guarantee glory.
The experts, oracles, analysts, market-leaders, gurus have spoken - forecasts for 2015 have been made, published, read, publicized, devoured and digested by all across the world (and I am talking only in the Information Security and Technology space). These soothsayers have already told you how accurate they were in 2014, and I do not dispute anyone of their position as a cool guy or where he/she makes magic. My quadrant is nowhere near any so I am not worried.
As an aside - have you realized the only people in the world who really do not worry about opinions are the very rich and the very poor. The rich cares a F for what the world or people think about him and lives, dances, splurges in a cocoon - they set the opinion! The poor cares a F because if things are anyway shi* in life what more can go wrong. That's where I am with my opinion ;-)
I see some gaps (from my perspective) in all the forecasts and analyst opinion floating around that I decided to start the year by enlightening my small band of friends and followers. While this list of mine may not cover "everything" it will be inline with that of the big brand forecasters because none of them are complete
1. Awareness - The one thing missing in EVERY forecast is the highly critical need for user awareness and as an appendix to this is the need to use awareness content which is prepared by some good experts and not by a newbie sysadmin who is has skills to do 'blind-ctrl-c-v".
There is a lot of talk about malware, spear phishing, cloud insecurities and more.. but who is aware of the risks that these things carry? Has anyone told anyone using gmail carries a risk and that spear phishing is used to catch people and not fishes in the backwaters of Australia! Has anyone in your organization EVER explained that malicious code can be come into the organization embedded in a document or an image and can then steal stuff or wreak havoc?
I am sure even the CEO or Board has never been told the sh***y side of technology.
So this is the most important missing link - ensure regular awareness programs, demonstrate risks and threats, show videos, play games and relate everything to the life and work of the participants. Do not run a presentation and mark attendance for your compliance report but make sure you run awareness to actually achieve the objective of making your company users aware!
2. Common Sense: Don't laugh. This is the one item missing in most portfolios and plans and it is not easy to have. Everyone thinks he / she has it and this is the first gross error - it may be there but may not be in abundance and may be highly unused. In other words you have it or not and even if you have it, you need guts to use it and stand by your conviction.
CS is not applied in any security implementation or purchase. Corporations pay top dollars to consultants to devise the most convoluted RFPs designed to keep the beggars out. None of them provide the actual "sense" of using the product or service being purchased!
OK so you are implementing SIEM or DLP - you purchased it as per your RFP with 5 standard rules out-of-the-box. What did you get - a hahahah roll in the hay! One year or more later you realize you have been taken for a ride and you cannot tell your wife/husband/gf for fear of being kicked with an incompetent tag.
Or you are implementing ISO27001 or any of the other ISO flavors, and what did you do - make a full library of documents and templates but do you really need this? At the end of the day everyone is following the book but if you actually read the change management log you can make a funny movie. You are a 20 person organization and you have an encryption policy... hey hey can you spell encryption for me let alone use it in your day to day work.
I have been working in IS for a number of years and yet to happily use encrypted emails (who will I send these mails to!). And not to speak of the many password protected files which are on my machine and the password has passed away into the sands of time and memory!
The one thing that was not applied is common sense because the consultant never mentioned it. And the CEO or CISO did not speak the troubles in his / her mind because he/she was busy playing to the gallery (during sales pitch and PoC) trying to pick holes in the presentation and throwing his/her knowledge in the air!
Oh oh oh,, if only you had asked the silliest question that came to your mind because that was most relevant. For example - you asked about references and they connected you with their friendliest neighborhoodest buyer but after the spiel did you ask the reference about the time it took for the deployment, did you ask about the challenges and who sorted them, did you ask about the number of functional meetings in which the consultant participated, did you ask how was the feedback from the operations team... and much more.
So yes, it is simple common sense that if you are purchasing cloud services, you must check the infra, SLA, client history, uptime etc but did you ask about portability and ease of the same? What if you want a divorce - do you have a pre-nup in place?
There are many more scenarios which you can envision to apply this theory of CS and Awareness and take a lead over your peers.
These are two things I find missing in all the 2015 forecasts and I sincerely believe that if you dump all the advise given by every guru and soothsayer and just use your common sense you are bound to find awesome success. Add to this a highly aware user community in your organization and you have a strong mix of resilience and proactive security!
But, yes, you need to have the guts to drive this thought and if your management supports you, you are home with a tremendous amount of saving.
So, good luck and best wishes for 2015 - may the most sensible thought win!
Some Self Promotion: Information Strategy and Policy development or advisory services for states /national bodies and large enterprises is my forte. If you want practical, meaningful and usable advice, KPIs, etc connect with the author on twitter (@bizsprite) or Linked-IN or Facebook (dineshobareja).
