Q&A: Security In The Spotlight At Interop

John Pironti , chair of Interops Risk Management and Security Track, talks risk management and what to expect at the upcoming conference

Security and networking professionals are gearing up for the Interop show in New York next month. So is Dark Reading, which caught up with John Pironti, chair of both the Risk Management and Security track as well as co-chair of the Applications and Collaboration track. Pironti is president of security consultancy IP Architects, and is also an active member of ISACA.
Dark Reading:
John, tell us a little bit about some of the security themes you have helped to develop with the programming in the Risk Management and Security track at Interop this year.
Pironti:
Not unlike at ISACA, at Interop weve really been trying to push the theme and kind of move the bar forward for security professionals to become more risk and security professionals, and to be more embracing of a threat- and vulnerability-based and risk-based approach, not a technology-based approach, to security. We want people to appreciate that, in some cases, its actually better to be the trusted adviser than it is to be the guy with the hammer.
Dark Reading:
Which kind of makes Interop the perfect audience to bring that message to, considering how many security professionals come from the networking world, right?
Pironti:
Yeah. The good news there is that we have a lot of maturity because of that. Network security is probably the area of security that is the most mature and has the most specialists available. But wed like to start pushing lots of data conversations.
Networking, and technology, generally, is really a vessel. We have all these other angles were working on and all these other requirements at the business level that we have to address. So were trying to help that professional broaden their horizons and try to understand what their customers and management teams are struggling with.
One theme were trying to move forward is visibility, because you cant protect what you dont know. And then really moving away from using the word risk too easily, and trying to appreciate what risk really means to the business person and what the security professional believes risk to be. These are usually two very different things.
Dark Reading:
So better business context for risk?
Pironti:
So a security professional can understand all the possibilities and probabilities of a threat and a vulnerability of a technology or of a concept. In order to factor in whats a risk to the business, you have to have consciousness of things like operational risk, strategy risk, financial considerations, HR considerations, and legal considerations. We need to work with them to understand how to get on the same language page so when I say somethings a risk, its couched in a way of saying its an information risk, but it has a potential impact on your business process
Dark Reading:
That ties into some conversations weve had with others about generally having risk rolled into enterprise risk management. What are you seeing there?
Pironti:
ISACA and I have been having that conversation for a while. Maybe we separate IT security operations from information risk management. But they are two things that are very heavily integrated, and they should talk to each other and deal with each other regularly. Let the technology group still maintain the controls and understand how were going to meet those controls. But let the risk group define what the control objectives need to be.
[Do you see the perimeter half empty or half full? See
Is The Perimeter Really Dead?
.]
Dark Reading:
Looking at general trends, what would you say security people should be paying attention to that will be on the Interop radar -- trends like software defined networking (SDN)?
Pironti:
I think SDN is great. I think were at the fun time talking about SDN. At Interop you have networkers, and we love this stuff. This is our bread and butter. I think that like other standards weve had, were high in the hype cycle right now. We still have to wait for the standards to play. It is a logical step forward, though, from a provisioning and maintenance and management perspective. But I dont think its going to replace overnight what we do for traditional networking, or traditional operations or application management, or things of that nature.
Every couple of years we come up with something new that is going to change the world. SOA, cloud -- this is the third time were trying cloud; we just keep calling it something different. Remember in 2001 and 2002 -- we were all going to do NAC? Now NAC is back. And it actually makes sense, finally. So I think the security professional needs to keep an eye on how data is becoming more pervasive, and how its being extended beyond their boundaries and what that means. [They also need to understand] what are the capabilities of some of these new trends that are coming online and how theyll impact not only their internal operations, but how theyll interact with other organizations.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Q&A: Security In The Spotlight At Interop