Too much infosec regulation undermines security, warns NAB
Encouraging compliance discourages responses
More prescriptive regulation of the security posture in industry sectors like banking could have the paradoxical impact of reducing security, according to Andrew Dell, head of IT security services at the National Australia Bank.
“We have to become much more agile and proactive – how we look at, how we react to cybercrime. Our posture is changing from 'observe and analyse' to 'detect and respond',” Dell told the 2013 Trend Micro Evolve Security Conference.
Banks themselves need to be agile enough to respond to new threats. However, worldwide, Dell says governments are taking an increasingly prescriptive attitude to how important infrastructure is secured. This, he suggested, creates the risk that a focus on regulatory compliance can reduce a company's ability to respond to security threats. Dell said too much focus on defining the detail of the security a bank has to implement can detract from its ability to respond to new threats.
“Regulation is increasing in its complexity each year, and keeps becoming increasingly prescriptive,” he said. “Government and regulators are getting more interested not only in how secure we are, but how we secure”.
As is so often the case, where prescriptions concentrate too much on what is known, they leave insufficient flexibility and encourage a compliance-based mentality. Dell cited a conversation with a colleague in an American utility, in which an Aladdin's cave of security kit and software, implemented for compliance reasons, was so understaffed that it was ill-maintained and almost completely unmonitored.
At the same time, Dell said, user desires are increasingly at odds with good security practice.
Banks, he reiterated, have created rules such as “no links in e-mails” and “offer call-back” so as to help protect their customers from having their credentials stolen hijackers sending phishing e-mails. The problem is, this is starting to create friction with customers of the social era who expect to be able to get what they need in a Tweet or from Facebook.
In that context, he emphasised, customer education is a challenge, perhaps even more important than the persistent attention on how nation-state involvement in cybercrime is changing the threats. Dell says NAB is more concerned to know what is going on rather than trying to probe the attacker's motivations, or work out whether the attack comes from individuals or a state.
“We're seeing a definite shift in the threat that's posed to our industry. The DDoS, phishing, malware compromises are still there – but the sophistication, ubiquity and agility are changing.
“Nation-state based activity – there has been a lot of discussion of nation-state attacks. I'm not concerned about whether it's state-sponsored, I'm concerned about what the attack is.”
The malware itself may be sophisticated, Dell emphasised, but how it's dropped into corporate networks is still simple: “through an e-mail, or a USB left in the carpark from someone to find”. ®