7
June 2014
Industry One on One
Can a business owner be confident that the company’s network and its clients are safe from
hackers?
Question:
Response:
Although there is no such thing as a completely bulletproof system, companies who take
security seriously and also take the right steps can have a reasonably high level of
confidence in their security posture. However, most companies don’t do both of those
things, and many do neither. For those companies, security can be the company’s Achilles
Heel. Every company must develop a clearly defined threat model, which includes elements
specific to their business such as asset value and adversary characteristics. Once assets
and adversaries are considered, defenses can be built accordingly.
Security has evolved from an IT issue to a central business issue, as most companies today
are responsible for protecting some form of digital asset, such as credit cards, customer
data, business strategy, and intellectual property. As with all business concerns, cost
management is important. With security, however, the true cost does not lie in a typical
budget line item expenditure, but rather stems from asset compromise, which costs range
from litigation, to fines, to lost revenue, to incident response. By contrast, however, proper
hardening techniques are minimal expenditures in comparison, and are effective in
dramatically reducing exposure to attack.
The McLean Group
Ted Harrington
Ted Harrington, Independent Security Evaluators
