full-disclosure - Re: Could InfoSec be Worse than Death?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Mon, 25 Sep 2006 15:14:12 -0400 (EDT)
From: "Kenneth F. Belva" <ken@...security.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: Could InfoSec be Worse than Death?

Paul,

>> Thanks for your comments.
>>
>>> Unless you can demonstrate concrete revenue generationg directly
>>> attributable to security, I don't think you can overcome that perception
>>> (and loss avoidance through trust building does not generate revenue.)
>>
>> I believe the purpose of the paper is to move away from the loss avoidance
>> model and describe information security in fashion that demonstrates how
>> security mechanisms have a direct role to play in the creation of assets
>> and business relationships.
>>
>I understand that, but I think your trust model is merely a euphemism for
>loss avoidance.  And I don't see how you can avoid being seen as loss
>avoidance - unless you can show the ability to generate revenue.

I understand your concern and it is perfectly valid. I would be skeptical
too initially. But I do not think it is a euphemism. It seems to me there
are real world examples of revenue generating assets based on information
security mechanisms.

iTunes, Unbox, Speedpass/Easypass/Paypass. Do these not create cash flows?
Could they create cash flows (or even exist) if the security mechanisms
(DRM/authentication) were not present?

The information security mechanisms are a necessary but not sufficient
condition to create these new assets. The loss prevention model shows how
this necessary condition breaks down and what we can do to stop the
breakdown. The virtual trust model says that once we have this necessary
condition, here are the things we may do with it. The focus is different.

I am very well aware of the loss prevention model. It seems to me there is
an addition way to describe how security mechanisms function other than
loss prevention. The virtual trust perspective is coherent, logical and
accurately describes the world. It does not exclude the loss prevention
model but can incorporate loss prevention into it.

Thanks for your continued feedback on the paper:
http://www.ftusecurity.com/pub/VT-belva-dekay-final.pdf

Sincerely,
Ken

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/