The Ashimmy Blog

The Case For Breach Insurance

For the last year or so at The CISO Group in addition to helping payment processors with their merchants PCI compliance needs we have been offering a low cost, no deductible breach insurance policy. 

For literally a few dollars a month, a small merchant can obtain a no questions asked breach insurance policy that will cover even the costs of a forensic audit in case of a suspected breach.

It amazes me how processors and merchants resist this no-brainer.  Of course the most common retort is that they don’t need it because a breach “would never happen to them”. Still others though try to claim that they already have insurance under their general liability insurance. I have told them repeatedly “go check the fine print” I don’t think it covers data breach.

Well now the Sony case is showing that indeed general liability insurance does not cover data breaches. My friend Ericka Chickowski had an article about this in Dark Reading the other day detailing how Sony’s insurers are stepping back from defending the various class action suits being filed against Sony.

In the case of processors and ISOs there is even more of a compelling reason. If any of their merchants can not meet the fines, losses and costs of a breach incident, they could be responsible. Spread that out over the thousands of merchants the represent and their exposure becomes pretty significant. Why would one not want to sleep well at night?

Anyway, anyone selling security knows what it is like to sell insurance. Even though it seems to be an easy decision, it is not always so easy.

Related articles

• Sony Insurer Disputes Breach Insurance Claims (informationweek.com)
• Sony's insurance company sues to deny data breach coverage (slashgear.com)
• Sony Insurer Says It's Not Liable for Breach-related Costs (pcworld.com)
• Sony insurer sues to deny data breach coverage (theglobeandmail.com)

A new blogger for the SBN and Security.exe

The final member of The CISO Group who up till now has not blogged, has joined the blogosphere.  My partner and friend, Bobby Dominguez has posted the first post on his own personal blog, DrekkinVorn. It is an Icelandic word having something to do with dragons, but you will have to google it to find out more.

Bobby is the CISO at The CISO Group. He has been a CISO at a few different companies that you have probably heard of. Bobby has also been a finalist for SC Magazine’s CSO of the year award for two years running. He has a lot to say and I think the blogosphere will be enriched with his voice added.

His first post is also cross-posted to the security.exe blog. In the future, he will be posting to both.

Welcome Bobby and be sure to follow his writings, I guarantee you will learn something.

Security.Exe podcast powered by The CISO Group

 Well we are at it again! Mitchell and I debut our old/new podcast under the Security.Exe brand. Of course it is powered by The CISO Group our new company. But it is the same old Mitchell and Alan. Besides talking a bit about The CISO Group (not enough in my opinion), Mitchell and I spend a bit of time going down an Alice in Wonderland rabbit hole. We talk about Google/China, APT, why we are not secure in general, what consumers want in security and a bunch of other things. I was about to break out some beers, as the two of us wax on (or is it wax off) poetically about things.

Anyway, now that we have that out of the way, Mitchell and I will be podcasting quite a bit. We hope to be joined by our fellow CISO Group partners, Parker, Josh and Bobby in future episodes. Of course we will have special guests as well. So stay tuned as we crank this baby up

Security.Exe powered by The CISO Group with Alan Shimel a...

Security.Exe powered by The CISO Group with Alan Shimel &...

In the cloud what's old is new again

I saw an article on C/Net tonight that caused me to have a deja vu moment. Dave Rosenberg wrote about IBM grabbing the largest cloud deployment to date. IBM will host for Panasonic at first up to 100k Lotus Notes live users “in the cloud” and moving up to 300k. Hosting Lotus Notes in the cloud. Wow, cutting edge! My CISO Group partner Parker Yates, will get a kick out of this one too.

It was just about 10 years ago that Parker and I were at Interliant. We had just gone public a few months before and neither of us knew that we were staring into the precipice of the dot com bubble bursting. Interliant was a pioneer in what was called ASP – application service provider for you kids out there. Our bread and butter hosted app?  Lotus Notes on Lotus Domino servers. Domino R5 was the hot stuff then. We were a major partner with IBM and probably the largest hosted Notes provider in the world.

Reading Dave’s article about what IBM was offering in this record shattering cloud deployment, I went to the wayback machine and had a look where Interliant was then. Here is what we were offering right before 9/11:

Customers access Notes mail and applications on Domino servers that reside at an Interliant data center. Users' Notes clients (or Web browser) access servers at Interliant over the Internet or via a direct connection such as Frame Relay. In addition to mail and application servers, customers' Internet Gateway (SMTP) and "hub" servers all reside at Interliant, thus fully leveraging Interliant's world class facilities.

Sounds pretty cloud like to me. What about you? Frame relay? Pretty cool, huh? I know, I know, you are saying, what about the security? How can you have a cloud without security?

Well here is an excerpt from the managed security solution listed on the same web site:

Our INIT SECURITY solutions are based on best-in-class firewall and Virtual Private Network (VPN) technologies, coupled with qualified security architecture design as well as monitoring and management services. INIT SECURITY solutions leverage state-of-the-art security products from industry leaders, such as Check Point^TM, Nokia^®, and other major vendors. We analyze your security requirements, and tailor a secure hosted solution, available 24x7.

We take away the overhead — you don’t need to buy the software and hardware, or manage the devices. This service-based, hosted approach accelerates your speed to functionality, and allows you to sidestep e-vulnerability concerns.

INIT Managed Firewall Service

This service provides full security consultation, configuration, and on-going maintenance and management of a client’s specific security requirements as they relate to a hosted environment. The service includes set up and installation, monitoring and management, logging and reporting, policy management, firewall updates, as well as quarterly performance audits and policy review.

INIT Remote Managed Firewall Service

This service enables customers to outsource the design, implementation, monitoring, management and maintenance of their on-site firewall hardware and software to professionally certified Interliant security engineers. INIT Remote MFS adds industrial-strength professional services to protect against malicious intruders and potential hackers. The offering includes an initial security assessment, design, implementation, 24x7 monitoring and management, logging and reporting, policy management, firewall updates, as well as quarterly performance audits and tuning.

Key advantages include:

Peace of Mind: INIT SECURITY solutions shield your organization from the anxiety of network and Internet vulnerability — our experts work 24x7 to ensure that your applications and data are always protected                 

Tailored, Best-in-Class: INIT SECURITY experts evaluate your environment to understand where and how you are vulnerable. This means analyzing your business practices and IT infrastructure. We leverage best-in-class technologies from security leaders to protect your environment, and design security solutions to provide tailored support and peace of mind                  

Relevance: INIT SECURITY experts rapidly update and reconfigure your security solution to address emerging threats and changes in your business operations                   
Simplicity: INIT SECURITY solutions allow your organization to sidestep IT complexity — such as deployment and management of your security solution                   
Reduced Cost of Ownership: INIT SECURITY solutions offer hosted access to best-in-class security solutions. You don’t have to extend funds to buy, install, and update the technologies                   
Investment Protection: INIT SECURITY solutions allow you to choose the best solutions today, without worrying about their ability to address tomorrow’s threats. We migrate your solution to harness state-of-the-art security technology. You’re never saddled with obsolete infrastructure

Interliant recognizes the business challenges in today’s competitive global environment — we’ll take total responsibility for your IT requirements, liberating you to focus on your core business.

Guys this was 10 years ago. It could just as easily be on today’s web sites.  Pretty weird right? Are you having a deja vu? So how the hell did we go bankrupt? Maybe we were just up in the cloud before it was cool?

I give you The CISO Group

Many of you have asked and I suppose just as many of you don’t really care. But ready or not, we are launching our new company today.  Take a deep breath, its a great day to launch. The name of the company is The CISO Group. I am one of 5 principals or managing partners in the company. We are starting off with a rather narrow focus, but like most I guess we have plans to expand in due time.

I will get into the who’s and why’s in a moment, but let me get this stuff out first. We have an excellent new blog/podcast we have started for the new company. It is called security.exe and the URL is http://www.securityexe.com. Here is the press release announcing The CISO Group.

My first post on security.exe is titled “Why the CISO Group”. I am going to paste it in here for you all to read. But before you do, I wanted to say thanks for all of the good wishes and support I have received from so many over the last few months. Making The CISO Group successful is going to take a lot of hard work on our part. But knowing that we have so many friends out there helps.  Thanks again!

Why The CISO Group?

A few people have asked me why I have decided to join with my fellow founding members bringing The CISO Group to market.  Excellent question. The economy is far from good right now, there are lots of security companies chasing limited dollars and the safe thing to do would be go look for a job and steady paycheck. But once an entrepreneur, always an entrepreneur. I have not taken a "job" in a very long time. For me work is about passion. If I can't be passionate about what I am doing, I can't be successful. Part of that passion is knowing that I am building something.  Other people build bridges and roads, I like to build companies.

Mitchell Ashley and I have spoke about doing another company ever since he left StillSecure 3 years or so ago. We work very well together and most of all we have fun together.  Working with Mitchell we usually have at least one good belly laugh a day.  Josh Karp is another fellow I have worked with and traveled around the country with. He is a great talent, but again most importantly someone that is fun to work with. Parker Yates is someone I worked with 10 years ago or more.  But Parker and I had such a good time, while being successful, that we always stayed in touch over the years.  Bobby Dominquez, my other fellow founding partner is actually someone who has been a customer of mine for years. I have known Bobby while he was CSO at several different companies.  Yes, he is a finalist for CSO of the year for two years running, but Bobby is someone I have fun working with.

The common theme here is that all of the folks at The CISO Group are people I enjoy working with. They are all incredibly talented in their own right as well.  We looked at the current state of the security market. Yes it is very competitive, but there are still lots of places that represent opportunity. We think our CISO on Demand is a great concept that has worked for the CIO and CFO role in the past and is high time it worked for the CSO role. In fact it is even better suited to the CISO role.  We also see a huge opportunity in the PCI market. There are lots of people in that field, but it is a big field that promises to grow bigger.

The bottom line is that I think this is a great time to start a new company. At this stage in my life I would trade the VC dollars and dreams of building the next big thing for a solid company, working with people I enjoy and respect and most of all having fun! If in doing so we can fill a need in the market, as we think we can, what more does one person need?  I am looking forward to making The CISO Group very successful and having fun working with my partners!

Is your CIO a Neanderthal?

I was talking to a friend tonight about his work situation. He is a very competent CSO. His most recent job is really getting to him though. He is there about a year now. He is the third CSO in the last three years at this organization. He knew about the other two before him, but he thought he would be different. I know you have heard that line before. Anyway here he is 12 months later. The CIO got the passing grade on the audit and now looks at my friend like he is the fifth wheel on a four wheel drive.

The company they work for is very successful and profitable. The attitude there about security from the top down is that it is a necessary evil. But only necessary enough to pass whatever minimum they have to for compliance sake and that is it.

My friend on the other hand is the eternal optimist. He is still trying to convince the CIO that security is important. That he needs to see the entire security plan through. Why privacy, risk management and security trump the compliance minimum.

I hate to be the one to burst a bubble. OK I like to pop a bubble. In any event I told my friend, forget it. He has a snowball’s chance in hell of changing the CIO’s attitude. At the end of the day the only thing that is going to change his mind is if they are unlucky enough to get bit. When they do, that CIO will get religion. Until then you are probably banging your head against a rock wall.  But that is fitting, because the CIO’s attitude is that of a caveman.

Big week ahead

For those who read my blog regularly, I have spoken about being very busy getting my next “big adventure” going. The last month and a half have been busy talking, planning and doing.  Finally this week we are going to take the wraps off of what I and my partners have been working on. 

We will probably make the opening announcement on Wednesday. On Friday I am speaking at the ISACA WOW! event here in South Florida. While my talk Friday is about Compliance for Compliance sake giving us a false sense of security, I will also be talking about the new company.

A life lesson I learned was that there is never a perfect time to have a kid. You can always point to something that is not optimum to having a child right now. Like having children, there is never a perfect time to launch a company. There is always more work to do before the launch. Can we do more planning? Can we make the website better? Do more research?

Eventually, like the commercial says, you “just do it”.  So ready or not we will do it this week.  Look for the announcement here on the blog and elsewhere. Also if you are in the South Florida area, come down to the WOW! event at the Four Seasons Hotel in Miami. It promises to be a great event.

PS – As I Tweeted over the weekend. If you are a security person in the Tampa area interested in a potential long term engagement please contact me!

 

Related articles by Zemanta

• WOW Event in South Florida Needs Sponsors (ashimmy.com)

Seizing management power, is not keeping it

This past weekend I received my hard copy of the 20th anniversary issue of SC Magazine.  Hate it or love it, 20 years covering information security is a statement.  Congrats to Ilena and the rest of the team there! One article by Dan Kaplan caught my eye (BTW, I had no idea that Dan checks my blog for ideas, as Joe Franscella says). “Seizing Management Power” chronicles the evolution of the CISO position “from introverted techie into slick businessperson”. Dan looks at Howard Schmidt’s career from police officer and Ham radio enthusiast to security pro today. He also looks at several other prominent people who have held the CISO position at large corporations.  Interesting in that each of these people came in and set up security programs and then moved on.

Today’s CISO’s are as likely to have an MBA as they are a CISSP says Kaplan.  I agree with Dan, they are as likely. But just as the mission has evolved from techie to business speak, the scope has also been narrowly defined. It is an architectural position, not a long term place at the table. As the article points out, the CISO needs to be proficient in “people, processes and technology”.

Ultimately though Kaplan states that “going forward, though, as the CISO position assures its foothold in the corporate boardroom, some observers wonder if the function has an infinite lifespan”. My theory is not an infinite lifespan in terms of function. There will always be the need to come in and set up or reshape a security program.  But once that is done, what is next? How long does the CFO and CEO want to keep paying big bucks for the architect? The CISO comes in with a mandate and and power, but can they keep it? That is the hole in the bottom of the CISO bucket.

I think the CISO’s architect role can be accomplished with a proven methodology, in a given time frame and within an agreed upon a budget and then handed off to a caretaker and not the architect. CISO’s are too highly compensated to be expensive cheerleaders. At the end of the day that is why I think CISO is a great place for a consultant.