US DOJ Lays Out Cybersecurity Basics Every Company Should Practice 58
coondoggie writes "The mantra is old, grant you, but worth repeating since it's obvious from the amount of cybersecurity breaches that not everyone is listening. Speaking at the Georgetown Cybersecurity Law Institute this week, Deputy Attorney General of the United States James Cole said there are a ton of things companies can do to help government and vice-versa, to combat cyber threats through better prevention, preparedness, and incidence response."
Not working well? Do it EVEN MORE! (Score:5, Interesting)
The article advocates more passwords, and stronger passwords, saying it is less of a pain than having everything stolen by hackers.
But....
When your password rules are too onerous, people start rebelling against them out of practical necessity. People write them down on post-its or store them in files on the hard drive because there are too many to remember (and they are too hard to remember). The few people who don't do this suffer frequent lock-outs, costing the company time and money (over and over again) in password resets. And, invariably, your CEOs exclude themselves from the policies. These same CEOs tend to have way more access than they actually need, and as such are the primary targets for hackers.
So, rather than requiring a few more special characters in the min of 20 character passwords that lock out after the second failed attempt, must be changed every 10 days, have an infinite history to prevent re-use, and each of which grants you access to between five and ten percent of the subsystems you use on a daily basis...perhaps we should work smarter instead of harder.
Use two factor authentication for the core systems (everyone has a cell phone these days, and good systems can work on the employee's office landline anyway). Passwords lock out after 10 attempts (seriously, those extra 7 attempts are NOT what will give a dictionary attack its edge). Require long passwords with a minimum "variety factor" in the letters rather than specific number and special character minimums (the variety factor and length are far more cryptographically strong than adding a 123 at the end). Train employees to recognize phish. And, of course, don't give people access to stuff they don't need.
Re:Incentives (Score:4, Interesting)
There have been firms who have suffered breaches directly after audits demonstrating compliance that have been fined for non-compliance. Why? Because they were breached so they can't have been in compliance. Nice example of ex-post facto there. Then there have been firms undergoing and audit that have been breached and therefor fined, even when the breach was discovered after the audit was completed and compliance was assured. Pure and simple, if you are breached, you must not be in compliance.
If I were the only one dealing with security saying this, it might be personal. I'm not. It's just one of those meaningless standards that exist solely to provide butt-cover. As for government doing the job, I used to ensure compliance with all the various safety regulations (military, environmental, OSHA,... that list is almost endless) and I literally lost count. Counting is something I do real good. That and an eidetic memory. It was simply impossible to comply with them all, not from the standpoint of time and money; it was impossible as they often contradicted themselves. If you fed them all to an expert system it would have a seizure. Me? I used to laugh out loud, a lot, and everyone thought I was weird for laughing at the regs.
The only way to get things right is to vote with our wallets but that's damn hard to do when dealing with a duopoly. And impossible when you're dealing with government. Corps have much bigger wallets than ours. They ought to since any costs they incur come out of our wallet.