UD Prof Says IT Threat Landscape Scary, But Hope Remains
When it comes to tech, it's scary out there.
The next big terror attack on the United States could turn off the lights for six months.
Up to a quarter of all PCs are part of botnets, slaves that unknowingly send out spam under remote control.
The maximum safe time for any targeted system is 20 minutes.
Richard Clarke, the former national security adviser to Presidents Clinton and George W. Bush, says he now writes high-tech thrillers because people won't believe the true stuff he writes unless it's couched as science fiction.
And if your identity hasn't been stolen yet, it's only because the bad guys haven't gotten around to you.
Still, Daniel Shoemaker, director of the Center for Assurance Studies at the University of Detroit Mercy, told a keynote crowd at Thursday's ITEC conference that there are ways to protect yourself.
Unfortunately, for the chief information security officer, it means making a big nuisance of yourself, and probably ticking off upper management.
Salvation, Shoemaker said, lies in making security systematic. There's no such thing as partial security, he said, and all safeguards have to be in place and operating properly at all times.
The effective security solution, he said, addresses all known security exposures. Most only address those that are interesting or convenient to get to, he added.
One way to get upper management attention, Shoemaker said, is to point out that plaintiff's lawyers are beginning to convince juries and judges that leaving holes in IT security plans is a tort, just like leaving a dangerous hole for people to fall into.
Shoemaker left the crowd with the Five Commandments of security:
* Identify all information assets
* Know the value of all information assets, so you don't spend $10 to protect a 10-cent asset
* Know what threatens each asset, since the threat picture changes all the time
* Assign responsibility for all threats, and
* Manage the process -- it must be coordinated.
Shoemaker said the ISO 27000 standard is emerging as the industry standard for IT security, although the Department of Homeland Security's Essential Body of Knowledge and the FIPS 200 federal standard for computing have a shot, too.
WWJ Newsradio 950 is Detroit's only all-news radio station and is the leader in Detroit radio news. Listen online to WWJ-AM 950 for live, local Detroit news, up-to-the-minute Detroit traffic, Detroit sports, Detroit business and Detroit community information. WWJ Newsradio 950 is an award winning radio station and you can listen online and podcast on demand Detroit news, Detroit Construction Alerts, Detroit School Closings, Winter Survival Guide and learn more about our Business Breakfasts. www.wwj.com.
