The brain trust over at ComputerWorld came up with
nine questions to ask when evaluating a security threat. I dare say some of these questions were thrown in for hype. Here is their list:
- Does the new threat affect software we use?
- Is this exploit an insider threat or from the outside?
- How difficult is this exploit?
- What is the impact of a successful attack?
- When was my last backup?
- Have we prepared a response to this kind of threat?
- What's the state of my network today?
- Is this threat personal?
- Is the cure worse than the disease?
I would offer up a different set of questions, based on my experience.
- Does the new threat affect the system (hardware and software) we use? The key here is covering both hardware and software, not just software.
- What are the possible avenues that the threat could manifest itself? A threat is a threat. There should be no distinction between internal and external threats.
- Does publicly available source code for this exploit exist? The level of difficulty of the exploit is meaningless if the source code is publicly available.
- What is the impact of a successful attack? This is the hardest and most important question to answer. The answer should be in terms of costs; time, expenses, and capital costs.
- How fast can we be back up if attacked? Knowing when your last backup was is meaningless if can't perform a restore and affected systems can't resume normal operations.
- Have you prepared a response to this kind of threat? Your response to an attack will determine the outcome.
- Are all systems (network, servers, software, etc.) up to scratch? This means that all devices and software have been brought up to the latest patch levels provided by the vendor and your policies along with all system functioning within normal operating boundaries.
- Does the proposed mitigation plan compromise operations? Once you have put protective measures in place you should still be functioning within normal operation boundaries.
This sounds great but building out the capabilities required to deliver a readiness analysis to answer these questions is a difficult, expensive, and laborious endeavor. The act of building out these capabilities develops a ton of proprietary knowledge that will require documentation and sharing. If you decide to have a consultancy develop these capabilities for you keep in mind that, by the end of the project, they will have thoroughly integrated themselves into your business. Make sure you develop an exit strategy with them.
