Service Matters! ITSM & IT Management

1. 83% percent of breaches were caused by attacks not considered to be highly difficult. 85% were opportunistic.
2. Only 4% of data breaches were discovered by existing event monitoring and log analysis tools. This percentage is nearly same as breaches that were discovered by routine internal audit (3%).
3. No breaches were noted for systems which were patched within one month of vulnerability identification.

It’s easy to deduce that all of the above are related to IT security and control environment but the common thread which relates the first two is lack of the ‘essential’ elements either in control design or operation. Third one establishes that if you maintain at the least the ‘essential’ (without rushing for deploying the patch as soon as it’s released) you are good. Now like any research document the report has its shortcomings but still it gives everyone of us who is interested in IT controls some food for thought.

So ‘essential’ is adequate to prevent most security breaches if the philosophy is applied uniformly to all the required risk areas. What it means is that implementation of an essential set of effective controls to all identified risk elements is far better then applying excellent set to some and ignoring others totally. I use the word effective with a control always, as having a control means nothing unless it’s effective in design as well as operation.

Quest for excellence also sometimes make people overlook effectiveness and sustainability of control operation. You can adopt and deploy an expensive, top in line event analysis and monitoring tool (which the vendor promised will bring the desired excellence in security) but if its not supported by a regular and efficient process of analysis and monitoring you will end up having a fake sense of security which a script kiddie can quickly bring to its knees.

To wrap it up it’s always a good strategy to apply essential controls, ensure they work well and then target the excellence part. Not only you have a peace of mind that you have a comfortable control environment while you are pursuing excellence but also it’s better to handle the advance pieces of security in a gradual (also different) way then the essentials piece.