Author: David Froud

I’ve heard similar phrases to the blog title my whole life, most of which are part of some sickly sweet – and more than a little trite – life-confirming, motivational poster. The kind that usually have kids hugging, or a kitten, or kids hugging kittens.

For some reason, hearing it again during the movie “Her” made a much deeper impact, probably because the movie itself addresses human emotions in a way that is different to anything I’d ever seen before, but perfectly captures something that I have contemplated at many times in my life; emotions are not tied to reality.

It’s not a spoiler, but the main character falls in love with an operating system. Yes it helps that it’s the voice of Scarlet Johansson (the visual certainly does anyway), but nevertheless, she is an artificial intelligence that achieves a simulacrum of humanity, including emotions, and even attempts a more physical demonstration of her feelings.

The point of this blog is not the movie (which is absolutely stunning), it’s that we do something very similar every day. Not to the same extent clearly, but how many times do we invent intricate stories behind some perceived slight that makes the offending party out to be some kind of jerk?

“How DARE they drive slowly in the overtaking lane, they KNOW I’m behind them and are doing it on purpose!?”

“They didn’t return my call, obviously they don’t respect me.”

“The team did not invite me out to lunch, they are probably talking about me!”

On the other hand, how many times have we confronted the offending party/ies about this just to find that they have no idea what we are talking about, and either have a perfectly reasonable explanation for the assumed slight, or are genuinely sorry to have caused us pain unintentionally?

Yet the pain is still there, isn’t it? And we still judge them harshly, sometimes for a significant time after the event, don’t we?

And some of us never forgive.

It does not matter to us humans whether or not the cause of the emotion (love, fear, hate etc.) is real or not, the brain reacts the EXACT same way. From initial reaction to the stimulus, to the retention of the long term memory, real and unreal are identical. WE create the story of every aspect of our lives, and unfortunately we also tend to defend those stories even in the face of all evidence to the contrary. Some call aspects of this ‘faith’, I call it excuse to stop thinking, regardless of the subject.

Anyone who has fallen in love with you for whom they WANTED you to be is no less hurt than someone you intentionally fooled. The responsibility shifts, but the results are the same; they get hurt.

Add to this that most people will naturally assume the worst, not the best, and you have the recipe for a long line of stressful encounters. For example, when was the last time someone was late for a meeting and you assumed they had just won the lottery? Each of these negative stories we invent just reinforces the previous ones, and before long, we are looking at all situations and people through sh!t-coloured glasses.

People who tend towards the judgemental are constantly comparing others actions to their own, and as a result of those actions failing to meet the required standard, create negative stories about people they barely know. Combine judgment with an unforgiving nature and you have a person surrounded by enemies. All in their own minds.

I have no solution for this, I do it myself constantly, but being AWARE of my tendencies has allowed me to be far more flexible, and that can only be a good thing.

[If you liked this article, please share! Want more like it, subscribe!]

The physical security requirements of the PCI DSS are by far the easiest to meet to the letter, but even these cause an inordinate amount of pain. This pain is rarely caused by the requirements themselves, but by the interpretation of them.

For example, if you were in-scope for the physical aspects, and I was to ask you if you HAD to have cameras to achieve PCI compliance, what would you say?

I you said something like “Not necessarily.”, “That depends.” or even a simple “No.”, you are correct. And if you don’t agree with that, just read the DSS;

“9.1.1 Use video cameras and/or access control mechanisms to monitor individual physical access to sensitive areas.”

I’ve used the word ‘intent’ many times in my blogs about PCI, because the intent of a requirement is always more important than the words written. Unfortunately, a lot of my clients, or even their QSAs, don’t even read the words, let alone interpret the language into something the business side can understand.

The intent of the physical requirements is that you restrict access to only those who need it, and that you keep record of who was where, when. That’s it, and if THIS is too much, you have more problems than PCI.

Above and beyond is very simple, but there are too many options to go into here. Decide via your risk assessment process what is appropriate, get the relevant guidance if you don’t have it in-house and stick with that.

For back-ups, this is just as simple, and the requirements are written down for you. However, there are some gotchas that I will address here;

1. “9.6.1 Classify media so the sensitivity of the data can be determined.” does NOT mean that you have to LABEL the media AS sensitive, it just means that you have to have a way of distinguishing the media that may contain sensitive data so that you can protect it accordingly.

2. If you do have physical media that contains cardholder data, the decryption keys are not included, and the offsite facility has no means to GET access to the decrypt function, this media can be reasonably classified as out-of-scope for the same reasons P2PE is a de-scoping option for retail.

3.  Far more prevalent these days is some form of network access storage (NAS) where the data is ‘striped’ across many disks. From my perspective, because the theft of any one (or even several) disks does not constitute the theft of reconstitutable cardholder data, only the management station used to control the access to the data and NAS functions is relevant. Here all PCI controls relevant to a server would apply.

4. You must make sure you have a well defined Data Classification Policy or the data retention and destruction requirements have no context, and cannot be properly validated. You will probably end with a ton of data you don’t need and your overall risk will steadily increase over time.

5. Go back over all of your business processes that could have ever resulted in the retention of cardholder data and deal with the resulting media accordingly. This includes paper.

Finally, the new-to-v3.0 requirements for the protection of “devices that capture payment card data” (DSS Reqs. 9.9.X). Bottom line; if you don’t have this stuff in place already, I can’t help you, and you may want to consider alternate employment options.

Not much more to say here, but I don’t want to underplay this too much and make the mistake of the curse of knowledge.  knowing where your sensitive data is in ALL it’s forms is critical, and both your physical access to it, and the protection / destruction of it, are extremely important concepts.

To accept anything I’m going to say in this post, we need to agree on the definition of ‘investment’. The OED has 3 definitions;

  1. The action or process of investing money for profit;
  2. A thing that is worth buying because it may be profitable or useful in the future; and
  3. An act of devoting time, effort, or energy to a particular undertaking with the expectation of a worthwhile result.

For the purposes of this blog, I’m taking the word ‘useful’ in definition 2. and the entirety of definition 3. I’m not that biased toward my chosen profession that I believe spending money on security will actually make you money, but I do believe that any effort to stay competitive in this day and age requires the current perception of security to be completely overhauled.

In my career I have compared security to insurance, the law, and to chewing tinfoil; you only do it because you have to, it’s too complicated, and it’s very irritating, respectively.  It’s no wonder that it gets the short-shrift that it does, especially when one or all of these comparisons come from the CEO him/herself.

If you can also accept that not LOSING money is also a ROI, then we can begin.

I was recently told that unless we security experts can put security into terms the business side of an organisation can understand, we’re wasting our time. I’ve done that my whole career I thought, but I missed the trick of putting security into a financial CONTROL perspective, mostly because finance is not my background. So thank you Jeff Hall for that.

These are my Top 5 reasons that security provides an ROI well above that of almost all other individual departments, including sales:

  1. Competitive Advantage
    I have touched upon this in several blogs, but the basic premise is that in the information age, the majority of businesses are almost entirely based on the manipulation of some form of data. Data in context is information, information in context is knowledge, and knowledge applied correctly is wisdom, and so on. It follows therefore that the ages old concept of Confidentiality, Integrity, and Availability (C.I.A.) very much applies. So if your data is the foundation of all of your businesses services, why is it not treated accordingly?
    o
  2. Business Transformation
    Similar, but different enough from Competitive Advantage to warrant its own section. Again, seeing as data is central to all things, the ability of an organisation to order, compile and retrieve their accurate data faster gives them the ability to adjust their processes in the face of customer needs, or competitive threat. If you don’t know what you have, or in detail how you do what you do WITH what you have, you cannot make change fast enough. Competitive advantages in the Information Age last weeks / months, you simply don’t have years to  catch up.
    o
  3. Financial Control
    All finance these days is just data in context, and while security will never be able to provide that context, access TO, and the integrity OF the data can provide a much welcome check and balance for the control of an organisation’s financial data assets. Regulations like SoX have security as part of their requirements, but it goes no-where near far enough to provide much benefit. A security program done well would cover this and a whole lot more.
    o
  4. Avoidance of Fines / Loss of Reputation
    Globally, more and more regulations are in the works that can have significant negative monetary implications. PCI is probably the best known, but the Information Commissioners Office (ICO) here in the UK can fine up to £500K per event for the loss of personal data. The EU General Data Protection Regulation (GDPR) can impose fine of up to 2% of GLOBAL revenue for a similar loss. These fines are monetary, but the loss of reputation can potentially be far worse.
    o
  5. Cheaper IT Infrastructure and Maintenance
    This may seem strange, even counterintuitive, but you only get real security when all the processes are simple, and you can only achieve simple if everything you have is a known-good, or baseline. These baselines are hard to achieve, and can be expensive in the short-term, but the long term costs are significantly lower than trying to either constantly work with too much (technology, data, people etc.), or fix what’s broken because you couldn’t detect a problem in time to prevent it from becoming a disaster.

Security is simple, and done well provides benefits way beyond what most business people can possibly envision, but ignorance of this has always been, and will always be, the CEO’s fault;

“Let’s be very clear; The CEO sets the tone for the entire company: its vision, its values, its direction, and its priorities.  If the organisation fails to achieve [enter goal here], it’s the CEOs fault, and no-one else’s.”

Just ask Target’s or Equifax’s outgoing CEOs if they wished they had paid more attention to security.

[If you liked this article, please share! Want more like it, subscribe!]

There is no going above and beyond the PCI standard in this one, as every definition of Role Based Access Control (RBAC) is what is required. i.e. You must reduce the access to any system / location / data to only that required, based on the job responsibilities of the individual accessing it. Period / full stop.

So why doesn’t the PCI DSS just come out and SAY it must be RBAC? Because there are other ways of doing this that fall outside of the pure definition (a combination of Mandatory Access Control (MAC) and Discretionary Access Control (DAC) for example), and the SSC can never insist on something that may not be appropriate for all sizes of merchant and service provider alike. Just look at logging; you don’t HAVE to have a centralised logging mechanism (e.g. SIEM), but try performing the 10.5.X and 10.6 requirements without it.

The fact that there are not separate PCI standards for merchants and service providers, as well as separate standards for types of business (retail, e-comm, micro-merchant etc.) is why there is so much confusion, and why almost every self-assessment is BS. Yes, there are Self Assessment Questionnaires (SAQs), but these are reporting mechanisms only. Regardless of which SAQ you are asked to complete, you are still responsible for compliance to all DSS requirements. Combining all requirements, regardless of business, into one standard is like trying to describe an average human being. It’s the nuances that matter.

But I digress.

In practice, access control is almost universally performed badly, as it is seen as inefficient in terms of work product, too complicated to set-up, too labour intensive to maintain, or a combination of those three. Then there are the organisations who consider themselves too small to bother, or the ones for whom this is an alien concept. Yes, there are still some of those out there.

While you cannot go above and beyond this ultimate in security baselining, you can perform the function in a way that ensures that it automates much of the enforcement of RBAC, as well as produces the management information required to measure the appropriateness of the implementation.

Step 1 – Paperwork: Un-surprisingly enough, good access control starts with a Policy, is included in all relevant procedures, and is appropriately defined in relevant standards. Other than the Access Control policy itself, the most important paperwork foundation is the Data Classification Policy. RBAC should be tied to the level of the data involved, and without an understanding of data classification, this determination cannot be made. For example; a DBA who manages all financial or intellectual property, should have far more restricted access, and exponentially more applied oversight, than should the guy in charge of your public data.

Note: Steps 2 and 3 should be performed in parallel, and combined into an overarching management process that is managed though an Asset Management System (AMS);

Step 2 – Human Resources (or equiv.): Whatever unit in your organisation manages what has – until fairly recently anyway – been called HR, should have a complete understanding of the on-boarding procedures for every role within the organisation. While every employee begins with the exact same core procedures (paperwork, corporate training, assign email / domain access etc.), well defined roles will then continue along functional on-boarding road-maps. Depending on the organisation, there can be few or many of these, but either way, this needs to be generic enough to manage, but detailed enough to reduce the burden of requesting the remaining individual privileges required. For example; a Windows admin may be granted access to all Windows desktops on joining, but will have to earn the right to access critical Windows servers, and make a separate request through channels.

Step 3 – Asset Management: Asset Management is a critical aspect of access control. Well, asset management done correctly, gives you the ability to effect proper change control, because nowhere else in your organisation does the mapping of data / application / system to data classification occur to such an extent. Seeing as access control is enormously impacted by data classification, the only place where system / data / process ownership is fully defined is the asset register / database.

Step 4 – Enforcement: For every asset type, you need an enforcement mechanism around it. This will ideally be centralised (Active Directory, TACACS, RADIUS etc.), but sometimes local access lists are appropriate. 2 factor authentication (2FA) and/or separation of duties may be appropriate for critical systems, but not for guest wireless access, but whatever is chosen must be [yet again] appropriate in terms of sustainability, and security level.

Step 5 – Ongoing Management & Review: Over 90% of all processes fail because the necessary mechanisms were not put in place to sustain them. From management buy-in, to process definition, to initial implementation, to employee training, to culture shift, unless the process is part of an ongoing and enforceable life cycle it will die on the vine.

There are as many ways of effecting appropriate access control as there are organisations requiring it, so the above is as specific as I can get. How you implement this is your organisation WILL require a significant expertise, so if you don’t have that in-house, go find it.

If you don’t know what questions to ask, ask someone who does.

Preposition aside, this is one of those phrases that invoked a flood of thoughts in a direction VERY different from the original context. I heard this one on True Detective, the phenomenal HBO series, when Matthew McConaughey used the phrase to explain his own rather dark abilities. Wayyyyyyy different from anything I could, or would, want to write about, but inspiration is rarely linear.

Also not a new phrase obviously (it’s based on Gabrielle Hamilton’s quote), but one I was hearing for the first time, and it instantly struck a chord with me. My whole life I have tried to put myself into a position where I can negate the …ummm, less-than-optimal things about myself that I cannot seem to change. And if I’m honest, I don’t want to change some of them. We all have these character ‘flaws’, but that’s no reason they should either define us, or get in the way of our careers.

I don’t work on my weaknesses, I avoid them by focusing on my strengths.

The lucky few, the ones who knew from a very early age what they were going to be, will find the subject quote amusing or irrelevant, but for way too many us it hits close to the mark. Can you truly say that you are doing what you had intended all along, and are absolutely doing what you are on this Earth to do? No, neither can I.

A while back I postulated a theory that it’s actually OK not to have a passion in life, a true calling (nurse, fireman, teacher and so on), as long as you enjoy the things you ARE doing. These things are generally what I would call your talents. Skills can be learned, but you will only ever be REALLY good at something you have natural affinity toward. Nine times out of ten you will also enjoy doing the things at which you’re best, and avoid those you don’t do well.

Unfortunately, we rarely have the opportunity at work to completely ignore the things we don’t like, and may even end up being very good at something because a combination of our OTHER talents gives us an advantage.

For example, no-one who’s ever met me would accuse me of being a people-person, but my combined talents for simplification and strategic planning make me a very good consultant. Luckily I actually enjoy consulting, but even if I didn’t, I could very easily end up doing nothing BUT consulting for the rest my life because it provides an excellent living. Would I KEEP doing what I’m doing if I didn’t actually like it?

Probably, and that’s the point of this blog.

Now be honest with yourself, are you a) doing something you really, I mean REALLY enjoy, or are you b) doing something you found yourself fairly good at? If the answer is a), you’re in the second highest group of people in terms of living a good life. The only group slightly better off in my opinion are those making a living from their life-long passion. If the answer was b), and you only find your job tolerable, what makes you good at it? Do you know?

These are pretty much the only options open to you if you have to work, and this has nothing to do with how much/little you earn;

  • Your work is your passion
  • You make a living doing what you enjoy
  • You make a living doing what you’re good at
  • You make a living, don’t hate your job, but don’t enjoy it much either
  • You make a living and hate your job

As a complete guess, I would say that 90% of us are in the last 2, and probably because we assumed early on in our lives that without a passion there’s no point in trying. A total cop-out in my opinion, as doing what you enjoy AND what you are good at, is a VERY close second. This does not even involve a title, or a field of expertise, and you are not looking for a job as a something, you are looking for a job that entails the use of as many of your talents / skills as possible, regardless of what field you end up in.

I ended up in security, not because I have any particular interest in security itself (I don’t), but security just happens to provide the perfect environment for me to fully explore the things at which I excel (relatively :).

Anyone can do this, you just have to know what you’re good at. Like ending sentences on prepositions for example.