Feeds

Too much infosec regulation undermines security, warns NAB

Encouraging compliance discourages responses

The Power of One eBook: Top reasons to choose HP BladeSystem

More prescriptive regulation of the security posture in industry sectors like banking could have the paradoxical impact of reducing security, according to Andrew Dell, head of IT security services at the National Australia Bank.

“We have to become much more agile and proactive – how we look at, how we react to cybercrime. Our posture is changing from 'observe and analyse' to 'detect and respond',” Dell told the 2013 Trend Micro Evolve Security Conference.

Banks themselves need to be agile enough to respond to new threats. However, worldwide, Dell says governments are taking an increasingly prescriptive attitude to how important infrastructure is secured. This, he suggested, creates the risk that a focus on regulatory compliance can reduce a company's ability to respond to security threats. Dell said too much focus on defining the detail of the security a bank has to implement can detract from its ability to respond to new threats.

“Regulation is increasing in its complexity each year, and keeps becoming increasingly prescriptive,” he said. “Government and regulators are getting more interested not only in how secure we are, but how we secure”.

As is so often the case, where prescriptions concentrate too much on what is known, they leave insufficient flexibility and encourage a compliance-based mentality. Dell cited a conversation with a colleague in an American utility, in which an Aladdin's cave of security kit and software, implemented for compliance reasons, was so understaffed that it was ill-maintained and almost completely unmonitored.

At the same time, Dell said, user desires are increasingly at odds with good security practice.

Banks, he reiterated, have created rules such as “no links in e-mails” and “offer call-back” so as to help protect their customers from having their credentials stolen hijackers sending phishing e-mails. The problem is, this is starting to create friction with customers of the social era who expect to be able to get what they need in a Tweet or from Facebook.

In that context, he emphasised, customer education is a challenge, perhaps even more important than the persistent attention on how nation-state involvement in cybercrime is changing the threats. Dell says NAB is more concerned to know what is going on rather than trying to probe the attacker's motivations, or work out whether the attack comes from individuals or a state.

“We're seeing a definite shift in the threat that's posed to our industry. The DDoS, phishing, malware compromises are still there – but the sophistication, ubiquity and agility are changing.

“Nation-state based activity – there has been a lot of discussion of nation-state attacks. I'm not concerned about whether it's state-sponsored, I'm concerned about what the attack is.”

The malware itself may be sophisticated, Dell emphasised, but how it's dropped into corporate networks is still simple: “through an e-mail, or a USB left in the carpark from someone to find”. ®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
BMW's ConnectedDrive falls over, bosses blame upgrade snafu
Traffic flows up 20% as motorway middle lanes miraculously unclog
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Putin: Crack Tor for me and I'll make you a MILLIONAIRE
Russian Interior Ministry offers big pile o' roubles for busting pro-privacy browser
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.