Slashdot Mirror
CIOs Spend a Third of Their Time On Security (enterprisersproject.com)
StewBeans writes: Much has been discussed about the potential security risks of an Internet of Things future in which billions of devices and machines are all talking to each other automatically. But the IoT market is exploding at a breakneck pace, leaving all companies scrambling to figure out the security piece of the puzzle now, before it's too late. In fact, some experts believe this issue will be what separates the winners from the losers, as security concerns either stop companies from getting into the IoT market, or delay existing IoT projects and leave the door open to swifter competition. That's likely why, according to CIO Magazine's annual survey, CIOs are spending a third of their time on security. Adam Dennison from CIO said, "If IT leaders want to embrace the sexy, new technologies they are hearing about today—the SMAC stack, third platform, Internet of Things, etc—security is going to be upfront and at the center of the discussion."
Is that more or less than the percentage spend on porn?
This issue is a bit more complicated than you think.
The company I work at, it seems the CIO spends less than a 10th of his time on that. Though, I found an XSS vulnerability on our site after trying manually for about 15 minutes. And I'm just a PM. (And here it is 2 months later and they still haven't fixed the issue)
I'm already using the most robust security model for the Internet of Things. I call it Things. My fridge doens't need an internet connection, nor does my light switch. My Smart TV thinks it does, but based on recent information I am in the process of removing that privelege.
I think the difference between the winners and losers will be the CIO's that don't feel the urge to jump onto flavour of the month hype and connect everything to the Internet.
The entire concept breaks the first rule of Engineering. Keep it fucking simple you fucking fucktards.
How is Alpha Centauri relevant to the modern CIO?
2/3 on anything else except security.
Where Im at they solved the problem by
1) Outsourcing security to a 3rd party vendor.
2) Giving everyone in security full admin rights on all the servers and network equipment.
When he was asked Why? He responded that by doing so, if anything happens, it is the 3rd party vendor who is to blame and not him.
So we have security through "It's not may fault"
More time for porn then, win-win
And we really, really mean it this time! Security all the way!
No. It won't be different. And they do NOT spend 1/3 of their time on security.
Most of them don't even know what security is. Or why you cannot buy it. It's just another item on a checklist for them.
If the CIO of an Internet of Things company is spending 1/3 of their time thinking about security, yet is still so incompetent... maybe they would be better off paying 1/3 of a CIO's salary to a random slashdotter for 5 minutes of their time.
Of course, no matter how long they take thinking about security, they're still going to sacrifice security for usability every time, so I don't know what purpose thinking about it has.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
If I was surveyed (and I have been), I'll report what I worry about the most. That may or may not be what I actually get to spend time on. If I was a politician (and I'm not), I'd strictly answer what the questioner wants me to worry about the most.
davecb@spamcop.net
Many CIOs will dive head-first into IoT, get a lot of good PR, stock prices will rise and they'll be rewarded. Then their companies will discover the IoT security nightmare, get lots of bad PR, stock prices will sink and the CIOs will blame it on someone else. Result: happy CIOs and IoT vendors and an absolute disaster for everybody else.
I believe in better security by cutting back on extra, unnecessary features; all they do is provide more surfaces for finding vulnerabilities. I recently bought an IoT washing machine and have stripped back the extra features, like wash, rinse, and spin cycles, so that all it does is send SPAM messages and participate in DDoS attacks.
If CIO's are only spending one third of the time, it's obvious why things are so insecure in general. Pffft.
"We got hacked? Talk to AWS (Microsoft, Google) then. We were the victims here. I'm just as upset about the whole thing as anyone."
Oh CIO - as the inexorable IoT takes over the intertoobz - you will fondly look back on the days when only 1/3rd of your time was spent on security. Just wait until the CEO calls because his Android penis pump won't shut off because a rival company hacked it.
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
And particularly those who said Windows is unsecurable. I remember the days when UNIX ruled the business landscape, was on the Internet, and generally a medium sized shop could use a large UNIX box and run all services with 99.9???% uptime. Was stunned people believed Microsoft and tried replacing the UNIX boxes with a single or a few Windows NT boxes. Laughed when I heard how NT apps would crash the whole OS and so all the other services/apps so they started putting one service/app on a Windows NT server. ROFLMAO hearing how they then doubled those numbers to try and get close to 99% reliability with these redundant servers. There is a _great_ snake oil salesman out there going by the initials Bill Gates.
"...leaving all companies scrambling to figure out the security piece of the puzzle now, before it's too late."
This statement is made as if companies themselves do not control the design and development of their own damn products. The simple fact is they do, and they'll either choose to do the right thing and prioritize security, or they'll choose to do the greedy thing and rush to market.
Of course, we all already know what they will choose. Otherwise we wouldn't be having this discussion.
"...security is going to be upfront and at the center of the discussion."
Might as well stop throwing this kind of bullshit around until you look back through consumer-throwaway-product history and try and find where the hell they ever brought security to the center of the discussion.
As I said before, we already know what greedy capitalists and their investors will choose.
No, he will leave the company for a better position. Then they will promote some top end IT guy into the CIO position just about the time the bad press hits.
That way the old CIO can look great on his CV while his replacement is left holding the bag.
Sure, CIOs (should) spend a lot of time on security. But it has almost nothing to do with the "Internet of Things." The refrigerators at the office may be a security risk, but it has more to do with food security, than network security!
I can't imagine a company where that would fly. The next question anyone is going to ask is: Whose decision was it to outsource to a 3rd party vendor, and who is responsible for choosing the incompetent baffoons who buggered things so badly?"
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Mine doesn't give a second thought to security ... and believes he is the most brilliant developer EVER. Every project can be finished in 2 weeks. Really.
A third if their time coming up with new corporate password rules, a third of their time architecting the Citrix solution that is going to propel the company into the brave future of 1998 and a third of their time requiring their employees to get training on whatever the bandwagon buzzword of the month is (This quarter it's Rally/Agile/Scrum.) You know, honestly, the company would be a lot better off if a freak software error caused that guy to fall down an elevator shaft.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
As much as it's proven orgs are overall lax on security, security concerns do complicate IT greatly. It used to be a lot easier to "hook things up": different servers and boxes all talking to each other doing a different part of the job.
Now it requires diddling with black boxes because nothing exposes helpful info about what it is in the name of security.
Perhaps if "they" designed systems right, things would be easier, but humans are imperfect and build imperfect things. An appeal to idealism falls flat.
These extra layers and precautions are "job security" such that perhaps I shouldn't complain, but I miss the days where it was easy to connect different things in an almost Lego and Tinkertoy way to get results fast. Now the Tinkertoys always ask, "Hark, who goes there?" I don't like red tape.
Kids even need a password to get OFF my lawn.
Table-ized A.I.
Companies don't controll other companies development, and therein lies the problem.
You speak as if security and time to market are mutually exclusive polar opposites, but they aren't. You furthermore speak in terms of a single company, rather than a hierarchical array of companies interacting, which is what we really have. The fact is that every company will make a trade off - time to market vs. security out the door (and how much will be added/improved with updates later.) Some will make better choices than others, and each companies choice may have an impact on other companies in the same market. The first to market will likely not be the one that wins in the long run if history is any guide. It will be something like the first (or second, or third) company to make the right choices with regard to trade-offs and learn from the mistakes made by the trailblazers.
In the case of IoT security I have no doubt that many, many will try and very few will succeed. This is basically the pattern for all software products in my experience, but it will be on a grander scale as security will be a much more real issue than it has been in the past once things are involved.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
nobody gives a fuck about the over-hyped IoT except for marketing vermin and other sub-human cunts who want to spy on people in their homes.
At least considering all the security breeches over the last couple of decades. Trust breeds trust.
Time is what keeps everything from happening all at once.
If you could provide a rest api for the host file, many would appreciate it. The same many of us don't have the time to download a Windows package (which we don't use) and extract it.
The effort to curate a hosts file is extraordinate. Thank you for your generous time, but it doesn't help us.
Remember, in security, Access Denied is success.
If they did, they would quit outsourcing. Seriously, when you outsource the code to another nation in which you are paying software engineers 8-10,000 / year, what do you think will happen which China or Russia offers one of them 100,000 to leave a back door in the code? Then once the black hats get on the system, they put in a new back door and remove the one that was put in the system so as to not point back to the original person.
If the CIOs at places like Target and Home Depot REALLY cared about Security, they would quit outsourcing to weak coders that make horrible money and are then easy targets for this.
I prefer the "u" in honour as it seems to be missing these days.
Correction: "An ol'..."
Table-ized A.I.
the public is reaching their limit of corps being violated at the public's expense without any regulation or recourse for the corp. Now corps are trying to put lipstick on a pig before the feds step in, and despite how much I distrust the feds, I'll gladly support them raiding everything from web developers to big pharma in order to teach capitalists a lesson not to abuse society.
A totally pointless article full of content-less quasi-technical sounding waffle ..
The next question anyone is going to ask is: Whose decision was it to outsource to a 3rd party vendor, and who is responsible for choosing the incompetent baffoons who buggered things so badly?"
If the company is large enough to outsource then they are large enough to have a legal department with too much time on their hands.
More likely the next question will be if they can sue the 3rd party vendor.
I've been there. The CIO golfs with the CEO. They fired everyone in the IT department except the CIO, and he repeated the mistake, but it hadn't blown up on him again by the time I'd left.
Learn to love Alaska
Where I work the CIO spends no time at all on IT Security.
Makes sense. That's why there is the CISO. .. Or is there?
You are all cows. Cows say moo. MOOOO! MOOOO! Moo cows MOOOO! Moo say the cows. YOU SUITED COWS!!
Of course they do, unless having a CISO is possible.
I don't know why IoT has been shoved into this article, these are essentially just new devices that will be included next time everything is reviewed from a cyber resilience perspective - which most CI(S)Os will ensure happens regularly as part of ISO27001/other compliance stuff that they need to ensure happens. If they don't do these reviews it is a massive failure of governance and the organisation in question needs a new CI(S)O.
Seriously, it's not even an afterthought. I have worked on a publicly funded research project covering smart home and living crap. While some of it may be interesting from a tinkering with stuff point of view, most of it is creepy surveillance type of shit, like smart metering. When I raised the question of security people stared blankly at me for a second or two and suggested that it wasn't a problem at all and if ever will be fixed later, maybe.
My point is, CIOs do not make relevant security decisions when it comes to product design. No one does. It's all about marketability and cost efficiency, security is neither because it is complex and costs a lot of money. And who care? Honestly, who cares about security? It's not the vendors and it's definitely not the consumers who constantly carry their rarely-if-ever-security-updated-listening-in-and-tracking-devices and provide the world with current information about the vacancy of their homes. So again, who cares? Eventually the insurance companies might care, when some cracker remotely burned down a kitchen or flooded a bathroom or two or ten thousand.
I feel so sig.
The CISO is a much more recent office and typically reports to the CIO. By default the duties of the CISO have fallen to the CIO and only more recently in relative terms been parted out to the CISO.
I never get used to these constant resurrections
Though I can easily enough (Android, MacOS X via Delphi's Object Pascal & Linux via FreePascal + Lazarus IDE) but hosts run on any system w/ a normal BSD derived IP stack - so the data itself is easily used on them (e.g. Android Debugging Bridge let's you PULL a new hosts onto one of those devices, iirc, it needs to be 'rooted' too on them).
APK
P.S.=> Maybe one day I will port it to them, or possibly "Open SORES" the code, but today's NOT that day - sorry, no real need (the data outputs are all that's needed for those I listed really is why)... apk
The motto of IT seems to be "Ironclad security is what we strive to deliver. If that reduces productivity to zero, it is not our problem."
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
I think they spend that much time on their job security.
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
See subject: I keep my source closed. It's not abusable to make malware as Chrome was http://it.slashdot.org/story/1...
* :)
(... & I don't give away my work to just ANYONE (only Malwarebytes' Mr. Steven Burn has my code which he audited & declared safe on its original builds & is in process as I write this on the latest ones - took him 9 days last time, shouldn't be long now as we're 2-3 days into it now...))
APK
P.S.=> Mr. Burn wouldn't have hosted my ware (much less recommend it as he does http://hosts-file.net/?s=Downl... above all others of its kind no less) if it didn't prove safe - this does the rest on that account:
It's safe proven by 57 antivirus programs recently in BOTH its 64-bit model https://www.virustotal.com/en/...
+
In its 32-bit model too https://www.virustotal.com/en/...
So is its installer -> http://f.virscan.org/APKHostsF...
... apk
"The entire concept breaks the first rule of Engineering. Keep it fucking simple you fucking fucktards" - by Jack Griffin (3459907) on Sunday November 22, 2015 @08:39PM (#50982859)
See subject: The very premise I designed APK Hosts File Engine 9.0++ SR-2 32/64-bit http://start64.com/index.php?o... on!
Using what you already have that's proven, works, & consumes less resources by FAR vs. stupidly & illogically "bolting on 'MoAr'" that does less & yet consumes far more!
---
FREE, not 'souled-out' to advertisers + adds speed, security & reliability. Does FAR more w/ FAR less more efficiently vs. redundant browser addons & locally installed DNS servers @ home + fixes DNS' many security issues & it stops tracking @ webpage + DNS levels combined from 1 file you NATIVELY have - firewalls do the rest (on less used IP address based tracking vs. host-domain names).
---
Obtains data vs. threats & for adbanner blocking from 10 reputable sites in the security community!
---
SPEEDS YOU UP 2 ways (adblocking + locally cached in RAM favorites placed @ TOP of hosts for fastest resolution speed vs. remote DNS (aids reliability)) vs. other "so-called security 'solutions'" SLOWING YOU!
---
Does all that via something you natively have vs. "bolting on browser addons 'MOAR'" that's usermode slower & increases messagepassing, cpu + ram overheads!
---
MalwareBytes' hpHosts Admin (MalwareBytes employee) hosts & recommends it -> http://hosts-file.net/?s=Downl... & MalwareBytes = BEST antivirus per this VERY recent testing of them all http://www.av-test.org/en/news...
&
Safe proven by 57 antivirus programs recently in its 64-bit model https://www.virustotal.com/en/...
+
Its 32-bit model https://www.virustotal.com/en/...
&
Its installer -> http://f.virscan.org/APKHostsF...
APK
P.S.=> "The premise is quite simple: Take something designed by nature & reprogram it to make it work for the body rather than against it..." - Dr. Alice Krippen: "I am legend".
Where I work the CIO spends no time at all on IT Security.
Makes sense. That's why there is the CISO. .. Or is there?
I first read that as "CISCO". And it made perfect sense.