Posts tagged business

What Does a Security Product Manager Do?

image

It’s unusual for information security professionals to work in a group that directly generates revenue instead of being a cost center. Many find working within a cost center hard, in part because when it is time to cut costs, infosec budgets are among the first to go. Product management provides an opportunity for infosec pros to work in a profit center for a change. (There are others, such as consulting and sales.)

From my perspective, the primary goal of product management is to define product capabilities and drive product adoption. Sometimes this view on product management is called product development.

  • Defining product capabilities entails working closely with customers to understand and anticipate their needs. It also requires understanding the company’s strengths and weaknesses related to the market as well as the competitive landscape.
  • Driving product adoption involves those steps that help the product find its way to its consumers. This usually requires the need to understand the company’s channel and partnerships, unless the product is sold directly. It also involves regular customer interactions and some aspects of marketing.

In the world of information security, a product might be a hardware gadget, such as a network tap, a piece of software such as an anti-malware tool, or a service, such as a managed security offering. Sometimes it is a combination of these categories.

Here are the type of tasks a product manager might be asked to perform to support the objectives outlined above:

  • Define a strategy for the product’s evolution to support business and customer needs.
  • Create specifications, prioritize requirements and maintain a roadmap of the features being developed.
  • Manage the process of making the product available to customers.
  • Act as a subject matter expert for the product’s capabilities in pre and post-sales discussions.
  • Collaborate with the engineering team building the product to clarify requirements and specifications.

— Lenny Zeltser

Balancing Brevity and Verbosity in Business Communications

“The most valuable of all talents is that of never using two words when one will do,” proclaimed Thomas Jefferson a few centuries ago. Succinctness seems more valuable in the 21st century, where we’re bombarded by words in spoken and written forms. However, knowing how to be brief is no less critical as knowing when to be brief.

I generally recommend assuming that the audience lacks the time or the inclination to pay full attention to your communication. Some rules of thumb for being brief:

While the advice above might apply to many situations, there are certainly cases where being verbose is preferred:

  • Provide details when responding to a person who explicitly asked for more information
  • Include the necessary supporting figures and data in an appendix to a report
  • Keep the public appraised of the situation when handling an incident, such as a data breach
  • Offer detailed feedback when seeking to change the behavior of colleagues or other people around you
  • Include lots of superfluous, unnecessary or otherwise redundant words when trying to reach the minimum length requirement for your article

The biggest culprit in long-winded communications are, perhaps, presentations that last an hour but feel much longer. I was interested to learn about an approach to presentations that caps the presenter’s time at just a few minutes. If you’ll be in DC this December, you can attend a 1-hour event comprised of such “lightning talks” while watching some top minds in digital forensics and incident response present for just 360 seconds. There will also be an opportunity to tune in remotely.

Hand-picked related posts:

— Lenny Zeltser

What InfoSec Can Learn from NYC Restaurant Inspections

Information security isn’t the only field dealing with safeguards and related compliance challenges. Restaurants are expected to implement measures for safely handling food. Yet, economic realities and other priorities may cause them to priorities other aspects of the business over food safety. Since customers rarely have the visibility into food-handling practices, municipalities often take it upon themselves to enforce compliance with sanitation requirements.

Might the less mature InfoSec industry learn from the practices of overseeing compliance with food safety rules? There’s lots to explore here, but I’ll limit myself to the recent practice of the New York City Health Department to issue public letter grades to restaurants as part of its sanitation inspections.

Grading Restaurants’ Food Safety

Starting July 2010, the New York City began requiring “certain types of food service establishments to prominently post letter grades that correspond to their sanitary inspection scores.” In addition to seeing the grades, restaurant patrons can obtain inspection details on the department’s website.

When assessing compliance with NYC’s food safety regulations, the inspectors assign points for the observed violations, as outlined in the scoring guide. The restaurant receives a letter grade based on the number of points. Passing the inspection requires grades A, B or C. Restaurants that earned a non-A grade can contest the sited violations; during this period, the restaurant can either post the initial grade or the “Grade Pending” sign.

According to the NYC Health Department, those who receive A “will be inspected annually, but those receiving lower marks will get more frequent visits.” The resulting system pays the most attention to low-scoring businesses, which warrant the closest monitoring.

Food Safety Compliance Incentives for Restaurants

The public display of sanitation inspection grades is meant to provide the restaurants with the incentive to improve their food-handling practices. The assumption is that customers will prefer to eat in an “A” establishment, rather than the one that received the “C” grade.

To motivate restaurants to improve their sanitation posture, NYC only issues a non-A grade after a second inspection, which occurs announced about a month after the initial inspection. According to the initial data published by the NYC Health Department, the incentive to improve sanitation might actually work:

“Just 27% of restaurants received A grades (0 to 13 violation points) on initial inspection… But among those scoring in the B range (14 to 27 violation points) on initial inspection, nearly 44% improved to earn an A grade on second inspection. Of restaurants that scored in the C range (28 or more violation points) on their first inspection, 72% improved enough to earn an A or B on the second.”

Letter Grades for Information Security

Like restaurants, consumer-oriented services on the web have a customer base that lacks the the visibility and skills to assess the risks of patronizing the website. As the result, the users have to rely on some third-party signal that the desired service may be “secure.”

Presently, the security signals are weak and rarely adequate, as they merely include the presence of SSL or a security seal indicating that the site was scanned for vulnerabilities. PCI Data Security Standard (DSS) offers some help in this regard, yet it only applies to card payment-processing sites and lacks the awareness among non-technical consumers. Moreover, PCI DSS is binary—the site either passed or failed—which encourages some business to fudge facts to achieve compliance, diluting the value of the PCI DSS effort.

We would benefit from having a clear set of bare minimum security requirements that systems processing information need to abide by. In fact, the Twenty Critical Security Controls project comes pretty close to defining such measures. I’d love to see a program that assigns letter grades to consumer sites on the Internet based on the number of such controls that were lacking. Yet, who would assess and enforce compliance? And who would pay for the cost of such a program? It’s not going to happen on the Internet any time soon.

I know I’m asking more questions than I’m answering, yet I think there’s something to the approach of motivating businesses to improve safety through a public display of grades. What do you think?

Update: For more on this topic, take a look at Mike Rothman’s post Incomplete Thought: The Scarlet (Security) Letter.

— Lenny Zeltser

11 Recommendations for Coming Up to Speed on Bitcoin

If you don’t know about Bitcoin yet, you will soon. Just like Friendster was the precursor to today’s on-line social networks and Napster foreshadowed modern online music distribution models, so too BitCoins might be a sign of upcoming approaches to distributed online financial transactions.

Bitcoin has been getting some attention lately in part due to the increasing value of this peer-to-peer currency. Here are a few articles for coming up to speed on Bitcoin and the recent incidents associated with it.

Getting Started With Bitcoin

Bitcoin Mining

  • Understand the notion of Bitcoin mining—generating new Bitcoins by solving cryptographic problems. Consider the likely scenario of compromised computers being used for Bitcoin mining—a malicious practice that is not yet widespread, yet will inevitably rise in popularity.
  • Consider the Bitcoin mining tool written in JavaScript. It solves cryptographic problems to generate new Bitcoins while running in the browser of visitors to the miner’s website. Could this approach provide a new way for legitimate websites to generate revenue without displaying traditional ads? Might such code running inside malicious Flash ads provide a new revenue stream for online attackers?

Recent Bitcoin Incidents

Potential Bitcoin Implications

The notion of Bitcoin as a distributed and anonymous form of currency is capturing the world’s attention. The readers of this blog will find it particularly interesting to consider the implications of the role that such currency can play in the criminal marketplace and online attack activities.

Perhaps Bitcoin might be ahead of its time and maybe its design and implementation is flawed—we will know soon enough. Regardless, it is an idea that will inspire creative thinking in the space of online payments. In the words of Edward Z. Yang, “The future of Bitcoin depends on those who will design its successor. If you are investing substantially in Bitcoin, you should at the very least be thinking about who has the keys to the next kingdom.”

— Lenny Zeltser

Information Security Implications of the New Tech Bubble

It’s exciting to read about the numerous Internet companies popping up, getting VC funding or preparing for an IPO. Many observers are quick to point out that these dynamics are reminiscent of the dot-com bubble of late nineties. As more companies rush to take advantage of the entrepreneur-friendly market, can we expect the new market entrants to pay attention to information security? I doubt it.

The New Tech Bubble

A recent article in The Economist notes that “irrational exuberance has returned to the internet world,” making Silicon Valley feel like a boomtown:

“Corporate chefs are in demand again, office rents are soaring and the pay being offered to talented folk in fashionable fields like data science is reaching Hollywood levels. And no wonder, given the prices now being put on web companies.”

The latest crop of hot start-up seems to incorporate buzzwords such as personalization, mobile, cloud, geolocation, cloud and social media. Many of the new companies fuel growth through private investments; some have sights set on IPOs.

Information Security and Tech Startups

A startup derives its energy from the desire to manifest its founders’ ideas into reality. The culture associated with such activities is about creating the product as quickly as possible. It focuses on features that will drive growth. None of these attributes encourage a proactive approach to information security.

Furthermore, information security is a luxury that few startups may be able to afford. When a company is short on cash, the available money needs to flow towards paying software developers, acquiring customers, looking for more funding and covering the essential expenses to keep systems and applications running.

Even if the company recognizes the need to protect sensitive customer data, it will likely do the bare minimum just to get its product off the ground. It will also look for ways to minimize the need to implement its own security, perhaps by adopting cloud-based services that include some element of security or outsourcing sensitive transactions such as payment processing.

This is not irrational. There might be a chance that a data breach will put the startup out of business or will otherwise derail the company from its pass. Yet, there is a chance that this won’t happen. In contrast, spending money on security has a much higher certainty that a crash-strapped startup won’t have the money for other critical expense.

A Ray of Hope?

Fortunately, information security is more accessible to today’s startups than it was to the participants in the original dot-com bubble. In part, this is because cloud makes security more affordable to small companies. Also, security is easier to incorporate into products now than ten years ago, because many programming frameworks include modules security modules.

Information security not outside of the startups’ reach. However, whether they will have the incentives, money, time and  knowledge to take advantage of security products and features is another question.

— Lenny Zeltser

Market Segmentation in Computer Attacks

The notion of market segmentation emphasizes the importance of viewing one’s customers as belonging to different groups. The grouping can be based on the organization’s size, budget, locale or other factors that result in one market segment being meaningfully different from the other. Computer attackers are paying attention to this concept, too.

Market Segmentation by Legitimate Businesses

Market segmentation is regularly used by legitimate businesses. For instance, airlines price tickets differently for leisure and business travelers, due to the differences in these customers’ priorities and willingness to pay. Similarly, Starbucks sells a number of beverages to suit the preferences across the spectrum of its clientele.

By understanding the differences between the segments, the company may be able to develop slightly different products or services for each type of customer, and may be able to price its products in a way that extracts the most surplus from the market.

Market Segmentation by Computer Attackers

Market segmentation also increasingly employed by computer attackers. They do this in several ways—the most common involving grouping potential victims by organization size. I wrote about this trend in an earlier post Evolving Threats: The Long Tail of Potential Data Breach Victims, where I outlined 2 distinct market segments:

  • Focused Targets: A portion of the total population of potential victims—perhaps 20%—are large enterprises that can serve as high-value, focused targets. These are targeted attacks, a portion of which fall into the category of Advanced Persistent Threat. (Some of these might still be attacks of opportunity.)
  • Mass-Scale Targets: Some attackers pursue a larger number of smaller companies and individuals. Executing and deriving “value” from such attacks involves a high degree of automation for infection campaigns and data processing.

Other ways in which computer attackers segment the “market” is by the geographic location of the victims. For instance, malware distribution (e.g., pay-per-install) services pay the affiliates more for infecting a system in North American than the one in Asia. Industry (e.g., the type of data processed) is yet another way that attackers can perform market segmentation.

Data from the 2011 Verizon Data Breach Investigations Report

Among the many observations in the the 2011 Verizon Data Breach Investigations Report, is the increased number of breaches that occurred in small businesses:

“Typically, such organizations represent smaller, softer, and less reactive targets than, for instance, financial institutions. Criminals may be making a classic risk vs. reward decision and opting to ‘play it safe’ in light of recent arrests and prosecutions following large-scale intrusions into Financial Services firms. Numerous smaller strikes on hotels, restaurants, and retailers represent a lower-risk alternative, and cybercriminals may be taking greater advantage of that option.”

Commenting upon this trend, Rich Mogull pointed out, “Using automated systems against weak targets and riding the associated economies of scale can be very lucrative, and it’s not surprising to see these targets multiply.”

The Internet Threat Hierarchy

[Update to the original post.] Dan Guido discussed the different types of computer attacks in his SOURCE Boston talk The Exploit Intelligence Project. I especially liked his illustration of the threat hierarchy:

Implications for Computer and Data Defenders

Information security professionals need to better understand the way computer attackers view market segmentation. This will help us understand the differences in threats across various industries, organization sizes and other potential victim groupings. In turn, having this view will lead to defenses being more in line with the actual threats and, perhaps, to security products that are better aligned with the corresponding market segments. (For more on this, see my earlier post Security Products and Services: The Long Tail of Customers.)

— Lenny Zeltser

Antivirus Products Are Like Cold Medicine - Not A Rant

The maturing antivirus industry exhibits several dynamics reminiscent of the cold medicine sector. This isn’t a criticism of antivirus products, but rather an observation that AV vendors can refine their business practices by learning from the more experienced pharmaceutical companies.

Consider the following similarities between cold medicines and antivirus products:

  • Cold medicine options are very similar in their ability to deal with colds (research 1, research 2). Established antivirus products have few meaningful characteristics that differentiate one tool from the other.
  • Cold medicines ease the symptoms of the infection, rather than attacking the underlying infection (research). Antivirus tools tackle individual malware cases, but underlying security problems remain to be resolved through other means.
  • The active ingredients used in cold medicines haven’t changed for many years (listing). Antivirus technologies still incorporate malware detection approaches developed a while back (though new technologies are evolving).
  • Consumers’ understanding of cold medicine effectiveness is based on limited personal experience and brand perception, rather than objective research. Antivirus product selection tends to follow similar subjective and brand-based criteria.

A paper by Zahra Ladh points out that during the 1980’s and 1990’s, “the pharma industry enjoyed success over an extended period achieving double-digit growth consistently. The success of the industry depended on strong R & D, the use of patents and a powerful sales force.” With the growth rate slowing down, the industry increased its investment into marketing and branding strategies.

Similarly, with the antivirus industry becoming crowded with vendors and with the standard AV products exhibiting commodity-like characteristics, the antivirus vendors are focusing on stronger branding for their products. Marketing for the mass-market is expensive, which is why large AV companies have an edge in this respect over the smaller vendors.

Understanding the similarities between antivirus products and cold medicine (and pharma) industries can help AV vendors learn from the business development and marketing approaches utilized by pharmaceutical companies. At the same time, users of antivirus products should look more closely at the effectiveness of the tools they are purchasing and should demand that the vendors provide more details about the products’ capabilities than talking using general terms like “cloud antivirus” or “most powerful solution.”

— Lenny Zeltser

Hidden Costs of Information Security Projects

When organizations undertake IT projects, including those related to information security, they often underestimate the effort of getting the work done. This might occur because we don’t understand the complexities of completing projects or because we underestimate the time and money needed complete tasks. We also tend to exhibit wishful thinking, fooling ourselves regarding the risks of projects going awry and the cost of mitigating such risks.

Reminder: Total Cost of Ownership

Gartner’s Bill Kirwin popularized—and probably coined—the term Total Cost of Ownership (TCO) to highlight the need to account for 2 types of costs associated with owning and managing IT infrastructure. One of the cost categories is direct costs,which are often comprised of labor and capital costs. The other category is indirect costs, which are harder to perceive; as the result, they are often underestimated.

Gartner provided the following TCO example:

“It might seem like a sensible ‘direct costs’ decision to reduce costs by spending less on contract negotiations, or hardware purchases or staff development and retention programs. However, if the result of such action is to deliver services with inappropriate service level agreements, or less reliable hardware that fails more often or longer waits for less effective support, the ultimate outcome might be to shift the comparatively meager savings from the direct side into comparatively significant increased costs in the indirect side.”

We can learn from the concept of TCO to look for “hidden” costs in not only IT components that organizations lease, but also in the services it purchases and in the work it conducts internally.

Often-Forgotten Security Project Costs

Here are the costs that I frequently see underestimated and unaccounted for in the realm of information security. These costs might take the form of actual money being spent on products or services, and might also be less direct, such as the work effort exerted by employees that are already on payroll:

  • Requirements gathering: It takes time and expertise to formulate the organization’s requirements for a security solution, especially when it’s comprised of multiple components. For instance, consider the complexity of an enterprise-wide vulnerability management deployment, complete with new tools and a process overhaul. Business users and technologists may need to be interviewed; specs may need to be written and—sometimes—the skills to define the requirements may need to be hired from the outside.
  • Transition effort: When organizations commit to a new security product or service, they often don’t account for the cost of transitioning from the current solution to the new one. Deploying a new tool or service can take a substantial effort, depending on the solution’s complexity. For instance, network architecture may need to be modified to accommodate a Web Application Firewall (WAF); an old anti-virus product will need to be carefully uninstalled across the enterprise to make use for the new endpoint security system. This can be costly.
  • Project oversight: Organizations often underestimate the effort involved in overseeing the project to make sure it moves forward at the expected pace and that the proper objectives are achieved. This is a problem for internal projects—say, a Data Leakage Prevention (DLP) deployment, as well as for the projects that the company outsources—such as security assessments. If there is no dedicated project manager or coordinator, than someone else on the team will bear that cost.
  • Validation of completion: In the the excitement of thinking about the completed project, it’s easy to forget about the cost of time and skills necessary to confirm that the work was performed according to spec. This effort could be as routine as checking whether a firewall change was made properly and as complex as validating whether security of the newly-outsourced environment was implemented according to the design.
  • Personnel training: An organization might allocate funds to purchase or build a new security system—say an Intrusion Prevention System (IPS), yet not account for the time and effort to train its employees to get the most out of the tool. Training may need to be product-specific—e.g., how to deploy Snort, as well as account for the applicable fundamental skills—for instance, how to read network packets.

Be sure to consider both obvious and “hidden” costs when preparing to undertake a security project, be it an internal effort or a purchasing decision. Putting on the TCO hat might help in the process, because the concept acts as the reminder that some costs are hard to perceive until you experience them yourself.

If you found this post useful, you might like my take on using Return on Investment (ROI) for justifying information security expenses.

— Lenny Zeltser

6 Tips for Hiring and Working With Security Consultants

Sometimes organizations need outside help for getting their arms around information security challenges. That’s where security consultants come in. Here are a few tips for making sure that engaging a consultant—often in the form of a consulting company—brings the necessary benefits to justify the expense.

This advice isn’t specific to security consulting, but I present it on the basis of providing security consulting services for a fair bit of time:

  • Understand your requirements for security assistance. I’ve encountered many organizations, for example, that request a security assessment, but aren’t sure what type of an assessment they need. Good consultants will help you figure this out, but the more prepared you are, the more in control you will be.
  • Reach out to multiple security consultancies, so that you benefit from multiple perspectives on potential approaches to the project and to validate that the price estimates you receive are reasonable. Consider issuing an RFP to attract several qualified companies and to explain your needs.
  • Make it personal.  Treating the company as a generic entity may be fine from a contract’s perspective. However, establishing rapport with the individuals working on the project will help achieve results not only to the letter of the contract, but also in the spirit of your requirements.
  • Assess who will work on the project and what tasks they’ll be assigned to confirm that their expertise matches your needs. Look at their certifications and past project experiences. The consulting company might have a strong brand as a whole, but make sure that it extents to the consultants who will support your endeavor.
  • Request a high-level project plan that contains milestones for the expected deliverables. Organizations sometimes focus too much on the desired start date, forgetting to state their end date expectations and to incorporate intermediate check points into the project’s time line.
  • Understand the full cost of the project, rather than focusing on the hourly rate. Fixed-fee projects are least likely to have unexpected expenses. Pricing on Time & Material basis is may be necessary when the scope of work is unclear, but could be risky from a budgetary perspective. Also, don’t forget to account for travel expenses.
  • Dedicate time to oversight of the project’s delivery. The consulting company should offer such oversight, but you should also keep an eye on the project to make sure it is progressing according to your expectations and original commitments. This will help you identify and correct potential problems early before they escalate into major issues.

If you’d like to share additional tips, either from a security consultant’s or a client’s perspective, please leave a comment.

— Lenny Zeltser