Protect your data: everything else is just plumbing

re: Protect your data: everything else is just plumbing

JJ — Tue, 03 Jul 2007 09:00:45 GMT

Good posting. I have tried to demonstrate this since year 2000 by using a slide listing fw, routers, etc and asking what is most important entity to protect, and then animated cross over everything and telling that it is information/data and requirements from there sets requirement for others.

Another issue is; will there be protection mechanisms on operating system level which put more into securing data rather than operating system? e.g Ten Immutable Laws is outdated. It solely focus on exploits, overwrite, incidents and e.g does not take into account that when attacker gets in, then the protection should still prevent attacker to access the data.

re: Protect your data: everything else is just plumbing

chris — Tue, 03 Jul 2007 19:25:12 GMT

Steve,

Great post I couldn't agree with you more. Our company is currently moving through that transition of Focusing on the network to focusing on the data. But I have to disagree with the previous comment. The Ten Immutable Laws of security are not outdated and will not be outdated because they are based on the basic principles that are time tested and proven. How and where you apply them is changing.

re: Protect your data: everything else is just plumbing

Kevin Rowney — Tue, 03 Jul 2007 20:21:30 GMT

Very true, this change is now underway. Standard textbook training in security doesn't really address these concerns, but the primary threat models security teams *should* be worrying about are now in flux. It really is all about the data.

I'm surprised you chose DRM and full-disk encryption as the two primary technologies to profile though. If it's about the data, shouldn't you also talk about content-aware security technologies that discover the flow of that data (i.e. Data Loss Prevention), govern access to that data (i.e. Data Governance Software), or help classify the data (i.e. Information Classification Systems.)

These content aware approaches appear to be (at least to me) at the forefront of this data-centric security model.

re: Protect your data: everything else is just plumbing

Adam — Wed, 04 Jul 2007 08:42:29 GMT

Loved the article! You're spot-on in saying that the data is what we need to focus on protecting. Even the terminology we use puts too much focus on protecting the "network" and I think this distracts so many people working in the field of IT into focusing on the physical bits and pieces rather than the data.

Protecting the data

Tales from the Crypto — Wed, 04 Jul 2007 19:50:24 GMT

Steve Riley posts on a topic he discussed at Tech-Ed - protecting the data, because everything else is

re: Protect your data: everything else is just plumbing

John — Tue, 10 Jul 2007 23:09:48 GMT

Yes, the data (read information) is probably your prime asset. But in addition to confidentiality and integrity (addressed in this article) it is important that the data are available where you need it when you need it. Hence, you need a secure network as well.

Also, for defence in depth, i would move some of the defence mechanisms away from the client (which you can't really control) to a device physically separated from the user. For instance, traffic filtering performed by a network firewall.

re: Protect your data: everything else is just plumbing

Karl Levinson — Fri, 27 Jul 2007 22:43:21 GMT

Steve is right that too often backups and encryption are forgotten. And it's true that the FILES on the computer that aren't data are plumbing.

But the other part of the plumbing, e.g. the free disk space and network bandwidth that can be used to sell DoS zombie attacks, spam relays and pubstro FTP servers, are I think still attacked as much as the user data is.

Also, drive encryption and backups only protect the data at rest. I understand that recent attacks have monitored running processes and/or memory to glean useful user data being sent out through Internet Explorer. So I hope it's clear to all the readers that Steve isn't advocating that they can start spending less time on the other traditional countermeasures.