Feeds

Too much infosec regulation undermines security, warns NAB

Encouraging compliance discourages responses

Internet Security Threat Report 2014

More prescriptive regulation of the security posture in industry sectors like banking could have the paradoxical impact of reducing security, according to Andrew Dell, head of IT security services at the National Australia Bank.

“We have to become much more agile and proactive – how we look at, how we react to cybercrime. Our posture is changing from 'observe and analyse' to 'detect and respond',” Dell told the 2013 Trend Micro Evolve Security Conference.

Banks themselves need to be agile enough to respond to new threats. However, worldwide, Dell says governments are taking an increasingly prescriptive attitude to how important infrastructure is secured. This, he suggested, creates the risk that a focus on regulatory compliance can reduce a company's ability to respond to security threats. Dell said too much focus on defining the detail of the security a bank has to implement can detract from its ability to respond to new threats.

“Regulation is increasing in its complexity each year, and keeps becoming increasingly prescriptive,” he said. “Government and regulators are getting more interested not only in how secure we are, but how we secure”.

As is so often the case, where prescriptions concentrate too much on what is known, they leave insufficient flexibility and encourage a compliance-based mentality. Dell cited a conversation with a colleague in an American utility, in which an Aladdin's cave of security kit and software, implemented for compliance reasons, was so understaffed that it was ill-maintained and almost completely unmonitored.

At the same time, Dell said, user desires are increasingly at odds with good security practice.

Banks, he reiterated, have created rules such as “no links in e-mails” and “offer call-back” so as to help protect their customers from having their credentials stolen hijackers sending phishing e-mails. The problem is, this is starting to create friction with customers of the social era who expect to be able to get what they need in a Tweet or from Facebook.

In that context, he emphasised, customer education is a challenge, perhaps even more important than the persistent attention on how nation-state involvement in cybercrime is changing the threats. Dell says NAB is more concerned to know what is going on rather than trying to probe the attacker's motivations, or work out whether the attack comes from individuals or a state.

“We're seeing a definite shift in the threat that's posed to our industry. The DDoS, phishing, malware compromises are still there – but the sophistication, ubiquity and agility are changing.

“Nation-state based activity – there has been a lot of discussion of nation-state attacks. I'm not concerned about whether it's state-sponsored, I'm concerned about what the attack is.”

The malware itself may be sophisticated, Dell emphasised, but how it's dropped into corporate networks is still simple: “through an e-mail, or a USB left in the carpark from someone to find”. ®

Beginner's guide to SSL certificates

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Internet Security Threat Report 2014
An overview and analysis of the year in global threat activity: identify, analyze, and provide commentary on emerging trends in the dynamic threat landscape.