Skip to main content

The one question to ask a security team that will tell you if their company is secure

Well, okay, it won't actually tell you whether they are secure or not and there are other questions you could ask, but the point is you can tell a lot about a company's security by how they answer security questions. I was recently at a security round table and the conversation turned to third parties and how you can assure yourself of their security. Some advocated scoring companies or certifications, while others advocated sending questionnaires. The argument against questionnaires is that they are a point in time view of the organisation. However, you can ask process and policy based questions and you can tell a lot from how they answer.

So, what is the question that will reveal all? Well, as I said it's not one question as such, more a type of question. It should be about something basic, some security control you're sure they have because everyone does. For example:

Why do you have a firewall?

Probable answers:
  • "because everyone has one"/"because the course I went on said I should have one"/"because my last organisation has one and they are very secure" - bad answer, you're not thinking about controls or security, but instead just buying popular products or whatever the vendor sells you and undoubtedly have a false sense of security
  • "because our PCI/ISO/HIPAA/Other certification says we have to" - bad answer, you're ticking boxes and chasing compliance rather than actually trying to be secure
  • "well, a firewall is part of a secure layered architecture and enables segregation at the network level, restricting the ingress and egress... etc." - okay answer, at least you know what it does and may understand its limitations
  • "our threat modelling has identified threat actors and attack scenarios that can be mitigated, in part, by introducing a firewall at this location in our network" - good answer, you understand the technology, you are thinking how to deploy it, what technologies could help you secure your assets and what are the best projects/controls you can spend your limited budget on to reduce risk

I have done (and still do) many third party assessments and I do advocate asking them questions rather than just trusting someone else's word or a rating/certification of some sort, but I'm mostly interested in how they answer questions. I've seen too many 'compliant' companies say "We're secure, the U.S. Government uses us!" or "All the high street banks use our service!", yet fail close inspection and have glaring weaknesses or vulnerabilities.

Trust your own judgement; ask them a question. And if you're a third party, ask yourself the question... with all your controls.

Comments

Popular Posts

Coventry Building Society Grid Card

Coventry Building Society have recently introduced the Grid Card as a simple form of 2-factor authentication. It replaces memorable words in the login process. Now the idea is that you require something you know (i.e. your password) and something you have (i.e. the Grid Card) to log in - 2 things = 2 factors. For more about authentication see this post . How does it work? Very simply is the answer. During the log in process, you will be asked to enter the digits at 3 co-ordinates. For example: c3, d2 and j5 would mean that you enter 5, 6 and 3 (this is the example Coventry give). Is this better than a secret word? Yes, is the short answer. How many people will choose a memorable word that someone close to them could guess? Remember, that this isn't a password as such, it is expected to be a word and a word that means something to the user. The problem is that users cannot remember lots of passwords, so remembering two would be difficult. Also, having two passwords isn't real

How Reliable is RAID?

We all know that when we want a highly available and reliable server we install a RAID solution, but how reliable actually is that? Well, obviously, you can work it out quite simply as we will see below, but before you do, you have to know what sort of RAID are you talking about, as some can be less reliable than a single disk. The most common types are RAID 0, 1 and 5. We will look at the reliability of each using real disks for the calculations, but before we do, let's recap on what the most common RAID types are. Common Types of RAID RAID 0 is the Stripe set, which consists of 2 or more disks with data written in equal sized blocks to each of the disks. This is a fast way of reading and writing data to disk, but it gives you no redundancy at all. In fact, RAID 0 is actually less reliable than a single disk, as all the disks are in series from a reliability point of view. If you lose one disk in the array, you've lost the whole thing. RAID 0 is used purely to speed up dis

Trusteer or no trust 'ere...

...that is the question. Well, I've had more of a look into Trusteer's Rapport, and it seems that my fears were justified. There are many security professionals out there who are claiming that this is 'snake oil' - marketing hype for something that isn't possible. Trusteer's Rapport gives security 'guaranteed' even if your machine is infected with malware according to their marketing department. Now any security professional worth his salt will tell you that this is rubbish and you should run a mile from claims like this. Anyway, I will try to address a few questions I raised in my last post about this. Firstly, I was correct in my assumption that Rapport requires a list of the servers that you wish to communicate with; it contacts a secure DNS server, which has a list already in it. This is how it switches from a phishing site to the legitimate site silently in the background. I have yet to fully investigate the security of this DNS, however, as most