Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Dojo Con 09

My presentation for DojoCon 2009 talking about compliance, where it fails, and how to make life better.

  • Be the first to comment

  • Be the first to like this

Dojo Con 09

  1. 1. Compliancy, Why Me? Living with the Compliance Staff, a BSOFH Guide Michael Smith
  2. 2. Who is Michael Smith? <ul><li>8 years active duty army </li></ul><ul><li>Graduate of Russian basic course, Defense Language Institute, Monterey, CA </li></ul><ul><li>DotCom survivor </li></ul><ul><li>Infantryman, deployed to Afghanistan (2004) </li></ul><ul><li>CISSP #50247 (2003), ISSEP (2005) </li></ul><ul><li>Former CISO, Unisys Federal Service Delivery Center </li></ul><ul><li>Currently a Manager in a Big Four Firm </li></ul>
  3. 3. Compliance is the arsenic and cyanide of the information security world! Source: Wikimedia Commons
  4. 4. Since it’s Election Week <ul><li>How many of you hate compliance? </li></ul><ul><li>How many of you love compliance? </li></ul><ul><li>How many of you think “meh” ? </li></ul><ul><li>How many of you are out in the lobby ? </li></ul>
  5. 5. But First, a Dramatization… Hi, I’m from the Compliance Team, I’m here to help!
  6. 6. But First, a Dramatization… And the Security Engineering Team is glad to have you here!
  7. 7. But First, a Dramatization… Here’s a report for you too look at on our current compliance status.
  8. 8. But First, a Dramatization… Wow, it’s big.
  9. 9. But First, a Dramatization… Your project is out of compliance with Section 15 of the FROBITZ Act of 1994. This is troublesome!
  10. 10. But First, a Dramatization… First of all, what the hell does that mean? And secondly…why should I care?
  11. 11. But First, a Dramatization… It means you have to fix it.
  12. 12. But First, a Dramatization… I can't do it—the YoyoDyne Frobulator is the only product that fits our needs.
  13. 13. But First, a Dramatization… But the rulebook says...
  14. 14. But First, a Dramatization… I’m not going to do it. Besides, the rulebook was made by a bunch of old men who have no idea what technology is.
  15. 15. But First, a Dramatization… You suck and are a rogue cowboy
  16. 16. But First, a Dramatization… You suck and are a wannnabe data center lawyer.
  17. 17. But First, a Dramatization… This guy is brain-damaged and I can’t work with him. We’ll never be secure now. This guy is brain-damaged and I can’t work with him. We’ll never be secure now.
  18. 18. Questions <ul><li>Who’s right? </li></ul><ul><li>Who’s wrong? </li></ul><ul><li>Are we doomed to forever live out this tragedy? </li></ul><ul><li>Why can’t we all just *sniff* get along? </li></ul>
  19. 19. With compliance, you can strong-arm people into doing your bidding. Source: Wikimedia Commons
  20. 20. The Problems with Compliance <ul><li>Cost </li></ul><ul><li>Effectiveness </li></ul><ul><li>Complexity </li></ul><ul><li>Scope </li></ul><ul><li>Skillset Issues </li></ul><ul><li>Decision-makers are removed from the consequences of their decisions </li></ul>
  21. 21. My View of the World* <ul><li>Each layer only knows the one above and below it </li></ul><ul><li>Traditional IT security focuses on the Enterprise and Project layers </li></ul><ul><li>Everything meets in the midddddddle!!! </li></ul>*There will be a test later on this.
  22. 22. The Gap in the Security Workforce <ul><li>Compliance </li></ul><ul><li>Top-down </li></ul><ul><li>Focus on controls </li></ul><ul><li>Risk is many-leveled: “How much is enough?” </li></ul><ul><li>Tools focus on reporting/dashboards </li></ul><ul><li>Not Sexy </li></ul><ul><li>Technical/Operational </li></ul><ul><li>Bottoms-up </li></ul><ul><li>Focus on threat </li></ul><ul><li>Risk is binary: “did/will we get pwned or not?” </li></ul><ul><li>Tools focus on automation </li></ul><ul><li>Very Sexy </li></ul>$8B Question: How do we bridge this gap?
  23. 23. Professor Rybolov Says <ul><li>I need more public-policy wonks who have technical and operational skills to understand their own framework and strategy </li></ul><ul><li>and </li></ul><ul><li>I need more techies who understand how to build viable regulatory schemes for sustainability of their tactical successes </li></ul>
  24. 24. Phrase of the Minute <ul><li>Direct and Indirect Costs </li></ul>
  25. 25. Phrase of the Hour <ul><li>Audit Burden </li></ul>
  26. 26. Phrase of the Day <ul><li>Commodity Service </li></ul>
  27. 27. Phrase of the Week <ul><li>Opportunity Costs </li></ul>
  28. 28. Phrase of the Month <ul><li>Leveling Effect </li></ul>
  29. 29. Phrase of the Year <ul><li>Regulatory Capture* </li></ul>*There will be a test later on this.
  30. 30. Regulatory Capture Examples <ul><li>Cyberwar, Cyber-Katrina, Cybergeddon, Cyberpocalypse, Cyberdouchery </li></ul><ul><li>SANS 20 Critical Security Controls </li></ul><ul><li>WAFs and Automated Code Review </li></ul>
  31. 31. And a Quote for Free <ul><li>Compliance is a Self-Licking Ice Cream Cone </li></ul><ul><li>--One of my favorite BSOFHs </li></ul>
  32. 32. Source: Wikimedia Commons So there isn’t any magic where we become ultra-compliant?
  33. 33. Compliance Exercise: Requirement <ul><li>SC-21: SECURE NAME / ADDRESS RESOLUTION SERVICE (RECURSIVE OR CACHING RESOLVER) </li></ul><ul><li>Control: The information system performs data origin authentication and data integrity verification on the name/address resolution responses the system receives from authoritative sources when requested by client systems. </li></ul>Source: SP 800-53
  34. 34. Compliance Exercise: BSOFH Answer <ul><li>Just use DNSSEC you n00blette! </li></ul>
  35. 35. WTF People? <ul><li>Why is this disconnect there? </li></ul>
  36. 36. Rybolov’s Law <ul><li>My solution is only as good as my auditor’s ability to understand it. </li></ul>
  37. 37. Compliance Truthiness <ul><li>One Framework does not rule them all </li></ul><ul><li>You can’t anticipate every single scenario </li></ul><ul><li>The rules don’t always apply </li></ul><ul><li>If you deviate from the rules, audit burden will kill you </li></ul><ul><li>You have to interpret what the regulatory framework says </li></ul>
  38. 38. And More Importantly <ul><li>Compliance is awesome if it’s your rules! </li></ul>
  39. 39. The more non-compliant you are, the more we can forgive you for! Source: Wikimedia Commons
  40. 40. Revisiting an Issue <ul><li>The key problem with compliance as a concept is that the decision-makers are removed from the consequences of their decisions. </li></ul>
  41. 41. What my First Sergeant Told Me <ul><li>“ There are only 3 leaders in the Army: Team Leader, Squad Leader, and Platoon Leader. Everybody else is just support.” </li></ul>
  42. 42. UR Doing it Wrong <ul><li>When it comes to security, who is the customer here and who is support? </li></ul><ul><li>Where is the groundswell from the bottom looking for support? </li></ul>
  43. 43. Protip: Self-Regulation is the Shizzle! <ul><li>Be careful what you ask for in regulation and laws, you just might get it. </li></ul><ul><li>PCI-DSS sucks, but would you rather have the Government telling you how to do it? </li></ul><ul><li>Committees suck, but at least the output is somewhat palatable. </li></ul><ul><li>Having a small voice sucks, but it’s better than no voice at all. </li></ul><ul><li>If you don’t participate, you become bound by other peoples’ rules. </li></ul>
  44. 44. Remember This One? <ul><li>Regulatory Capture </li></ul>
  45. 45. The Road Ahead <ul><li>Bridge the 2 worlds and heal the rift </li></ul><ul><li>Fix what you can at your level </li></ul><ul><li>Bring the smart people together </li></ul><ul><li>Build community standards that give you the support that you need </li></ul><ul><li>Tell the higher layers that you have the situation under control </li></ul><ul><li>??? </li></ul><ul><li>Profit! </li></ul>
  46. 46. Source: Wikimedia Commons Compliancy: it’s not so bad after all as long as you’re driving the oxcart!
  47. 47. <ul><li>Questions, Comments, or War Stories? </li></ul><ul><li> </li></ul><ul><li>rybolov(a) </li></ul>