Chasm! Security Dr. Anton Chuvakin Security Warrior Consulting www.securitywarriorconsulting.com Hack in The Box Amsterdam, The Netherlands July 2010 Why Are We Here? Risk of DEATH vs Risk of $60 fine? Security Warrior Consulting www.securitywarriorconsulting.com Dr. Anton Chuvakin Outline • WTH is “security”? • How we got here? • Security and/or/=/vs Compliance? • Security vs security? – Does what we do for security actually … improve security? • Where it is all going? • What can YOU do today? Security Warrior Consulting www.securitywarriorconsulting.com Dr. Anton Chuvakin For ADD Folks: Main Theme 1. There are “two security” realities: one conceptual and fuzzy + another painfully real. And a chasm between them! 2. This is not good – for security and for businesses! 3. What can we do about it? Security Warrior Consulting www.securitywarriorconsulting.com Dr. Anton Chuvakin Brief History First…. 1950-1985 Stick Age: Security = door lock 1985-1990 Stone Age: Security = anti-virus 1990-2000 Bronze Age: Security = firewall 2000-2005 Iron Age: Security = IDS/IPS 2005-2010 Modern Age: Security = appsec 2010+ Cloud Age: Security = But this is technology only…? Security Warrior Consulting www.securitywarriorconsulting.com Dr. Anton Chuvakin OK, How About This View? 1950-1985 Stick Age: Local risks 1985-1990 Stone Age: Computer risks 1990-2000 Bronze Age: Network risks 2000-2010 Iron Age: Regulatory risks 2005-2010 Modern Age: Cybercrime risks 2010+ Cloud Age: All-of-the-above risks?  Gross oversimplifcation, of course  Security Warrior Consulting www.securitywarriorconsulting.com Dr. Anton Chuvakin So, what are we doing? Aka “What is Security?” • Protecting the data • Defending the network • Guarding the IT environment • Reducing “risk” (what risk?) Yes, but really … We ensure that organization runs and wins! Security Warrior Consulting www.securitywarriorconsulting.com Dr. Anton Chuvakin Leaders vs Losers Security Warrior Consulting www.securitywarriorconsulting.com Dr. Anton Chuvakin …and what if they still don’t? Then some regulatory body would come and beat them up …. … and they’d continue to stay 0wned, of course  Security Warrior Consulting www.securitywarriorconsulting.com Dr. Anton Chuvakin Drilldown into “Compliancy” Security Warrior Consulting www.securitywarriorconsulting.com Dr. Anton Chuvakin