Why protect $500 worth of data with a $5,000 firewall?

Security risk management means surrounding the highest-value assets with the best security, and according less protection to less-valuable assets. With unlimited resources, security spending wouldn?t matter. This being the real world, however, security experts recommend better protecting what attackers actually want to steal.

One way to assess the effectiveness of a risk management program is by using the Open Source Security Testing Methodology Manual (OSSTMM), released by the Institute for Security and Open Methodologies (ISECOM). In a nutshell, the OSSTMM is the only open-source tool available for bias-free security testing. Its users range from U.S. government agencies to large enterprises, including the Volkswagen Group?s Spanish IT subsidiary, Gedas Iberia.

Conducting an OSSTMM test ?takes four to eight hours and you do some security measurements, and you get some answers, and the answers are factual?the machine responded or didn?t respond, the port was open or not. There?s no risk assessment, because there?s no opinion to it,? says Pete Herzog, managing director of ISECOM.

Instead of just making a list of which security tools are in place, the OSSTMM requires auditors to test security tool effectiveness. ?We don?t care if you have a firewall. What we care is what?s accessible,? says Herzog. So the test first measures operational security. ?If you?re doing business, you have to have certain things open, such as Web ports,? notes Herzog. Auditors simply count every potential risk vector, from accessible databases to Web applications.

Then there?s testing of actual security, which takes into consideration loss controls. ?For example, a Web port could be open, but you have authentication or encryption. [Well] they aren?t actually secured, but there are loss controls, so data can?t be stolen or modified along the way.? In other words, someone might steal a database, but if it?s encrypted, ?loss control says it would cost you more money and resources than the value of what you stole.?

The end result is a bias-free assessment of an organization?s security, as well as guidance on how to adjust it. ?In the end, you not only have accurate benchmarks, but you can also verify if the percentage of what you spend on new security measures actually can be justified by increasing security or loss controls to the right assets at the right cost,? he says. The OSSTMM test is also a snapshot of an organization?s security, useful for measuring future progress.

While version three of the OSSTMM, which refines the testing process, is due for release shortly, with ISECOM?s blessing, a company called CIOview has already implemented it into a recently released tool for conducting security audits called SecurityNOW.

Click HERE to read the whole story online or Click on Read More... below to read it locally?