Wendy Nather, of The 451 Group, has recently discussed “Living Below the Security Poverty Line,” which looks at what happens when your budget is below the cost to implement what common wisdom says are the “standard” security controls. I think that’s just another, albeit crowd-sourced, compliance regime. A more important area to consider is the mindset of professionals who believe they live below the security poverty line:
Security1 Subsistence Syndrome (SSS) is a mindset in an organization that believes it has no security choices, and is underfunded, so it minimally spends to meet perceived2 statutory and regulatory requirements.
Note that I’m defining this mindset with attitude, not money. I think that’s a key distinction – it’s possible to have a lot of money and still be in a bad place, just as it’s possible to operate a good security program on a shoestring budget. Security subsistence syndrome is about lowered expectations, and an attitude of doing “only what you have to.” If an enterprise suffering from security subsistence syndrome can reasonably expect no one to audit their controls, then they are unlikely to invest in meeting security requirements. If they can do minimal security work and reasonably expect to pass an “audit3“, they will do so.
The true danger of believing you live at (or below) the security poverty line isn’t that you aren’t investing enough; it’s that because you are generally spending time and money on templatized controls without really understanding the benefit they might provide, you aren’t generating security value, and you’re probably letting down those that rely on you. When you don’t suffer security subsistence syndrome, you start to think with discretion; implementing controls that might be qualitatively better than the minimum – and sometimes, with lower long-term cost.
Security subsistence syndrome means you tend to be reactive to industry trends, rather than proactively solving problems specific to your business. As an example, within a few years, many workforces will likely be significantly tabletized (and by tablets, I mean iPads). Regulatory requirements around tablets are either non-existent, or impossible to satisfy; so in security subsistence syndrome, tablets are either banned, or ignored (or banned, and the ban is then ignored). That’s a strategy that will wait to react to the existence of tablets and vendor-supplied industry “standards,” rather than proactively moving the business into using them safely, and sanely.
Security awareness training is an example of a control which can reflect security subsistence syndrome. To satisfy the need for “annual security training”, companies will often have a member of the security team stand up in front of employees with a canned presentation, and make them sign that they received the training. The signed pieces of paper go into someone’s desk drawer, who hopes an auditor never asks to look at them. Perhaps the business uses an online computer-based training system, which uses a canned presentation, forcing users to click through some links. Those are both ineffective controls, and worse, inefficient (90 minutes per employee means that in a 1500 person company, you’re spending over an FTE just to generate that piece of paper!).
Free of the subsistence mindset, companies get creative. Perhaps you put security awareness training on a single, click through webpage (we do!). That lets you drop the time requirement down (communicating to employees that you value their time), and lets you focus on other awareness efforts – small fora, executive education, or targeted social engineering defense training. Likely, you’ll spend less time and money on improving security awareness training, have a more effective program, and be able to demonstrate compliance trivially to an auditor.
Security subsistence syndrome is about your attitude, and the choices you make: at each step, do you choose to take the minimal, rote steps to satisfy your perceived viewers, or do you instead take strategic steps to improve your security? I’d argue that in many cases, the strategic steps are cheaper than the rote steps, and have a greater effect in the medium term.
1 Nothing restricts this to security; likely, enterprise IT organizations can fall into the same trap.
2 To the satisfaction of the reasonably expectable auditor, not the perfect auditor.
3 I’m loosely defining audit here, to include any survey of a company’s security practices; not just “a PCI audit.”