Feeds

Too much infosec regulation undermines security, warns NAB

Encouraging compliance discourages responses

High performance access to file storage

More prescriptive regulation of the security posture in industry sectors like banking could have the paradoxical impact of reducing security, according to Andrew Dell, head of IT security services at the National Australia Bank.

“We have to become much more agile and proactive – how we look at, how we react to cybercrime. Our posture is changing from 'observe and analyse' to 'detect and respond',” Dell told the 2013 Trend Micro Evolve Security Conference.

Banks themselves need to be agile enough to respond to new threats. However, worldwide, Dell says governments are taking an increasingly prescriptive attitude to how important infrastructure is secured. This, he suggested, creates the risk that a focus on regulatory compliance can reduce a company's ability to respond to security threats. Dell said too much focus on defining the detail of the security a bank has to implement can detract from its ability to respond to new threats.

“Regulation is increasing in its complexity each year, and keeps becoming increasingly prescriptive,” he said. “Government and regulators are getting more interested not only in how secure we are, but how we secure”.

As is so often the case, where prescriptions concentrate too much on what is known, they leave insufficient flexibility and encourage a compliance-based mentality. Dell cited a conversation with a colleague in an American utility, in which an Aladdin's cave of security kit and software, implemented for compliance reasons, was so understaffed that it was ill-maintained and almost completely unmonitored.

At the same time, Dell said, user desires are increasingly at odds with good security practice.

Banks, he reiterated, have created rules such as “no links in e-mails” and “offer call-back” so as to help protect their customers from having their credentials stolen hijackers sending phishing e-mails. The problem is, this is starting to create friction with customers of the social era who expect to be able to get what they need in a Tweet or from Facebook.

In that context, he emphasised, customer education is a challenge, perhaps even more important than the persistent attention on how nation-state involvement in cybercrime is changing the threats. Dell says NAB is more concerned to know what is going on rather than trying to probe the attacker's motivations, or work out whether the attack comes from individuals or a state.

“We're seeing a definite shift in the threat that's posed to our industry. The DDoS, phishing, malware compromises are still there – but the sophistication, ubiquity and agility are changing.

“Nation-state based activity – there has been a lot of discussion of nation-state attacks. I'm not concerned about whether it's state-sponsored, I'm concerned about what the attack is.”

The malware itself may be sophisticated, Dell emphasised, but how it's dropped into corporate networks is still simple: “through an e-mail, or a USB left in the carpark from someone to find”. ®

High performance access to file storage

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
OpenSSL Heartbleed: Bloody nose for open-source bleeding hearts
Bloke behind the cockup says not enough people are helping crucial crypto project
Web data BLEEDOUT: Users to feel the pain as Heartbleed bug revealed
Vendors and ISPs have work to do updating firmware - if it's possible to fix this
One year on: diplomatic fail as Chinese APT gangs get back to work
Mandiant says past 12 months shows Beijing won't call off its hackers
Call of Duty 'fragged using OpenSSL's Heartbleed exploit'
So it begins ... or maybe not, says one analyst
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Experian subsidiary faces MEGA-PROBE for 'selling consumer data to fraudster'
US attorneys general roll up sleeves, snap on gloves
Bad PUPPY: Undead Windows XP deposits fresh scamware on lawn
Installing random interwebs shiz will bork your zombie box
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Five 3D headsets to be won!
We were so impressed by the Durovis Dive headset we’ve asked the company to give some away to Reg readers.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Mobile application security study
Download this report to see the alarming realities regarding the sheer number of applications vulnerable to attack, as well as the most common and easily addressable vulnerability errors.