Improving information security with one simple question
by Brian Honan - Head of IRISSCERT - Monday, 17 December 2012.
Anyone who has children, or has had to deal with very young children, will understand how powerful the word “why” is and how it can drive their curiosity. Innocent-sounding questions such as “why is the sky blue?” can lead to the question “but why?” to each of the answers given. A cycle of never ending “whys” is quite commonplace until it seems all the answers have been exhausted, but still they will ask “why?”

This small and seemingly innocuous word can also be one of the most powerful tools in the vocabulary of the information security professional.

Those same three letters that drive many parents crazy were also the driving force for many of the early pioneers in information security. Their curiosity and wondering “why?” led these pioneers to experiment, to poke, to examine, and to learn as much as they could about the computer systems, the networks, and the applications they used. This knowledge was then used to further improve those systems and today our interconnected world is a result of those people asking that simple question.

I believe that an inherent curiosity is one of the key traits every successful information security professional should have. That sense of wonder and seeking to find out why things work in a certain way, many times by breaking them, is what makes this profession such an exciting and interesting one.

Unfortunately, I have noticed recently that many people are no longer seeking to find out why things work in a certain way. We seem to have moved to an industry that is too willing to accept how things are presented to us without challenging it. We focus on compliance issues, react to media stories, listen to speakers at conferences, or swallow all the material that vendors pitch our way.

Instead of asking why, we are now asking who, what, where or when. Instead of asking “why do I need to be compliant with a certain standard?” we are asking “what do I need to do in order to be compliant?” Instead of asking “whom should I allow to have their device access the network” we need to be asking “why am I allowing access?” When vendors pitch their solutions to us we need to stop asking “what is the solution? Or indeed what is the problem?” and instead ask “why do I need this product?” For each answer to these questions we should continue to ask “why?” until we have exhausted all avenues of questioning and have a fuller and better understanding of the issues we are trying to address.

While the “what?”, the “who?” and other such questions are important, they do not get to the core of how best to secure our systems and data. It is the “why?” that drives the curiosity of the 4 year old child, and the “why?” should drive our need to better understand, too. Asking this question not only leads us to discover the reasons we need to do things, but it also helps us to examine the motives behind the headlines and stories that we read.

We see an ever increasing number of news stories about the threat of cyber-war, the need for cyber-warriors and cyber-weapons, the rise of the Advanced Persistent Threat (APT), the risks that Bring Your Own Device raises, and the security issues with Cloud computing. If we simply consume these stories without asking “why?”, we may never learn to understand the motives of those behind the story.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Mon, Feb 8th