New Security Mindset: Focus On The Interior

Chief privacy officer Jason Straight shares his insights on why organizations are struggling to stop the breach wave -- and manage the aftermath.

Hackers keep on hacking, breaches keep on happening. The cycle continues, as major corporations now routinely get successfully compromised. A key element of the equation now is properly and efficiently responding to an attack as well as managing its aftermath.
The same old security missteps--falling for phishing attacks, not locking down sensitive data internally, giving users too much access, for instance--keep recurring. Thats because many organizations arent putting their security energy in the right places, according to Jason Straight, senior vice president and chief privacy officer at UnitedLex, which provides outsourcing services and support for the legal industry.
Legal typically isnt properly looped in, either. As we see with any big breach, it may start out as an IT problem, but very quickly it becomes, in some cases, an existential business crisis. And in almost every case, there are serious legal issues that arise, he says.
An attorney, Straight runs the cyber-risk solutions practice for UnitedLex as well as its internal risk management operation. We need to get lawyers more involved in cyber-risk, says Straight, who at next months
Interop conference in Las Vegas
will give a
presentation on insider threats
as well as participate as a
panelist debating the weakest links
in security.
Straight spoke with Dark Reading this week about these hot-button issues.

Dark Reading:
Hack upon hack, breach after breach, we cant seem to stop the wave of attacks out there today. Yet the security industry is exploding with employment opportunities, products, and new startups. What gives?
Straight:
[Organizations] are investing security resources in the wrong place. Theres a fundamental discrepancy here in that attackers out there for financial gain get paid every time they are right, collecting credit card numbers, SSNs, or whatever [they steal]. They are literally getting paid every time they are right. They have incentive to get better at this.
On the defense side, there are only negative incentives. Whether youre a CISO or security consultant, no one comes by your office at the end of the day and says Great work today--we didnt have any breaches. When something goes wrong, theres a line outside your door. There are mostly negative incentives. Thats an imbalance I dont see going away [soon].
Dark Reading:
What are organizations doing wrong in how theyre focusing their energies in security?
Straight:
Misallocation of security resources: we continue to be more focused on perimeter protection than on internal controls and monitoring. Its clear that attackers are already inside or could be anytime they want and theres nothing you can do about it on the perimeter. We continue to dump money in there, which is exactly what the security industry wants you to do. Theres a ton of money in selling all these tools.
The media is focused mostly on sexy, state-sponsored attacks. You would think external attacks cause all the damage. But study after study, two-thirds of attacks are mundane insider errors, lost equipment, technology failures, or lack of oversight over vendors. All of this is pushing people to continue to spend money in an area where its not the best use [the perimeter]. Im not saying forget the perimeter. Its got to be a balance, with a focus on the interior, too. DLP [data leakage prevention], for example, is still massively underutilized, and SIEM has a lot more room to grow.
The big reason people are not focused as much internally is that its hard. Its easy to gain support to build the castle walls higher; everybody can get behind that.
When you say lets start restricting access internally to sensitive documents, [someone asks], but wait, is that going to make it harder for me to do my job? The answer is yes. You have to use two-factor authentication every time you log in from the outside, more complex passwords, more frequent password changes. Internal controls are inconvenient, so it requires a cultural change … Its hard to get support inside.
[Everything you need to know about today’s IT security challenges – but were afraid to ask. Register with Discount Code DRBLOG to save $100 for this special one-day event,
Dark Readings Cyber Security Crash Course at Interop on Wednesday, April 29
.]
Dark Reading:
The insider threat or risk is huge, obviously. But theres so much debate over how to manage that. Whats the best way for an organization to get a handle on this?
Straight:
The human layer is definitely the most vulnerable, but I dont agree that it is an intractable problem. There are things you can do to turn this thing around, and if done right, you can transform what is your biggest vulnerability into one of the strongest parts of your security program. Human beings are the most sophisticated detection devices youve got.
You can have one of the greatest user training programs on the planet thats effective for six months, and then everyone forgets everything. Its not one and done. In terms of having a lasting impact, its better to do in-person [training] and not just online. You need to get everyone in a room to interact and ask questions. Potentially the most important part of creating effective [security] awareness training is you must have 100% support and buy-in from corporate leadership, the CEO, general counsel, CFO, and other business leaders. It needs to be driven by executives.
Dark Reading:
As an attorney and someone very close to trends in the legal world, how do you see legals role evolving in security, especially when it comes to handling things in the aftermath of a data breach?
Straight:
On the IR [incident response] side, theres a cottage industry thats grown up of a decent number of lawyers whove had trial by fire. They really know how to handle it, how to participate with regulators, and know what the media is asking. But theres still a lot of work to do.
Where were still having trouble is taking lessons learned in IR and … taking what weve learned from lawyers and applying to broader information risk programs. Lawyers are rarely involved in doing risk assessment. [They] need to be at the table and should be part of the process where we understand what the risks are.
You need to make sure Legal has a formal and well-defined role in IR before theres an incident.
Ideally, you want to make two announcements when you have a breach. The first is, weve had an incident and an investigation is underway. Keep it very simple. You cannot really start to characterize an incident until you have completed the investigation … and determined the scope of the breach. A lawyer will bring that perspective: How sure are we? If you say too much [publicly], it can and will be used against you. Lawyers have a critical role in not only [helping] manage the message, but in anticipating if were wrong, will it hurt the companys reputation? Theres a lot of emotion in a breach and people take it very personally. Thats a dangerous situation, and a decision can be driven more by emotion than logic. Thats where the lawyer comes in.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
New Security Mindset: Focus On The Interior