SecurityMetrics Podcast | 19
The Language of Security
“If we think we’re fluent in security because we’re using the same words we’ve always used, we’re in danger.”
With over 30 years in the FinTech industry, Dale Laszig has a long-range view of trends and technology that she has turned into a busy tech journalism career.
Dale Laszig sits down with Host and Principal Security Analyst Jen Stone (MCIS, CISSP, CISA, QSA) about the language of security: how the way we talk about it affects the way we approach it. Dale and Jen wax poetic to uncover the meta “matrix” that supports commerce and makes the world go around.
Listen in to learn:
- How payments security attitudes have changed and why it matters today
- The concept of zero trust and the practical application of a security perimeter
- Jen’s quick take as a security analyst on industry trends and myths
Connect with Dale:
@DSLDirect on Twitter
Resources:
Download our Guide to PCI Compliance! - https://www.securitymetrics.com/lp/pci/pci-guide
Download our Guide to HIPAA Compliance! - https://www.securitymetrics.com/lp/hipaa/hipaa-guide
[Disclaimer] Before implementing any policies or procedures you hear about on this or any other episodes, make sure to talk to your legal department, IT department, and any other department assisting with your data security and compliance efforts.
The Language of Security Transcript
Hello, and welcome back to the Security Metrics podcast. My name is Jen Stone. I'm one of the principal security analysts here at Security Metrics. Super excited today because I have Dale Lassig with me. Dale, welcome to the podcast.
Would you please tell people about yourself?
Thank you, Jen, and thank you so much for having me on your show.
I've been in the payments industry for thirty years.
I started out as an independent agent selling processing.
And then I moved over to the technology side, managing territories and teams for major equipment manufacturers.
And I always did a lot of writing for the brands I represented.
Both internally and also as a contributing writer for the Green Sheet and mobile marketing and technology magazines.
And in two thousand and seven, I started my own company, DSL Direct.
And I've been mostly focusing on journalism and content marketing.
Oh, wow. So, you've been in and around tech for quite a long time.
How did switching to journalism change your perspective on technology?
You know, that's an interesting question.
I think that the biggest change from selling technology to writing about technology is really all about point of view.
As a journalist, my focus has shifted from trying to find a good business fit, to trying to find a good story.
And as someone who spent so many years as a brand champion, I love interviewing people who are in that role currently.
Not only because they have skin in the game, but also, because of all the ways they're helping people and solving big problems.
And, especially now, the way that they're helping business owners during COVID nineteen.
Yeah. This is definitely a a tricky time for everyone. I love what you said about, talking to people because in the past, you and I have talked. I think, three different times just in the last year.
And and I've really gotten to enjoy, talking to you because sometimes the questions you ask spur ideas in me about technology and security.
And I'm really excited about our topic today because, words are important to you. Words are important to me as well. And and, exploring kind of the idea of, how words affect how we think about things, is very compelling to me. So you you told me a story earlier about, accounting being the language of business and then how that understanding kind of developed your your view on the the language of of security.
Would you please kind of share that story with with our listeners today?
Oh, absolutely.
So, when I was in graduate school, we were taught that accounting is the language of business.
And being a poet, that really struck a nerve. And I was very excited about that. And I turned in a paper that probably cost me my four point zero. My, my professor was not amused.
But I was extremely proud. So if you can imagine, I began the paper. This is my opening statement for the paper. If accounting is the language of business, then ratios must be the pocket guides we use to make sense of it all.
And your professor didn't like that? There's something wrong with them. I thought it was brilliant.
And, and you know, I that's kind of how I think. So, following along that line of thought and thinking about our podcast coming up, I just thought, wow, security is the language of commerce.
And that just absolutely sent a lightning bolt through me because I started making these empirical linkages.
And I started thinking, wow, you know, security goes all the way back. Before even digital transactions, before electronic transactions.
If you go all the way back to the origin of our physical currency, it's steeped in these protections, these layers of protections, by government agencies and financial institutions.
And I just find it fascinating. And it's also fascinating to me that as we've evolved, our technologies have completely changed. But the words that we're using to describe them are the same. And we're still throwing words around like security, compliance, perimeter protection. But when you think about perimeter protection in the digital world, that's a very different concept than patching a wall or or, you know, putting up a physical barrier.
Right.
It has to be different.
I love that story that you told about about the poem. The okay. So my undergraduate degree was in animal science. And what is it with hard science teachers asking us to do poetry to describe I don't know.
Maybe it's so that it does spark these ideas. But, also, my professor hated my poem. We were supposed to write we were supposed to write a poem on the, the moment of conception in cows. Right?
So you're breeding cows. Right? And some I guess he wanted something romantic and lofty. And I wrote something haiku haiku and humorous, which was not what he thought was I got a terrible grade on it.
And I was like, look. You need to be more clear on what you wanted because I thought it was pretty bomb. But I still got a bad grade on it.
Blake said is is also as someone who, has raised beefers with my husband.
Yeah.
You know? You're hitting you're hitting close to home on that one too.
Look, if you've ever raised cows, you know that the whole act is hilarious. Right? The entire if you can't find humor in all that's involved in breeding and raising cows, then you should probably not be involved in that.
I totally agree.
So okay. And I and I almost derailed our conversation because we started talking about cows. And I think, people know who have listened to the podcast for a while, if you get me started on chickens or dogs or cows, I mean, we're just we're gonna go off for a minute. It's just It's just dogs. Is that the way it goes? But to bring us back to the language of security, you you were talking about perimeters. You're talking about perimeter perimeter protection in the digital world.
And I would love it if you would kind of expand on that to help me get back on track for where we were.
I would love to. So, you know, when I think back on, you know, perimeter protection became real for me as a concept.
In my early days, in my career, when, I basically put everything I owned in an eight by ten van And high tailed it to a new city where I knew absolutely no one.
Sounds like something my daughters would do. And it's crazy. Good shop.
Alright. So, let me set it up for you. So, this was Tucson.
And this was July. Oh.
Okay. And, and I arrive.
Then I unpack.
And I look around. And lo and behold, there's nothing happening.
Right. Yeah. Because it's Tucson in July.
Yeah, I know.
The local museum was offering a walking tour. And I signed up immediately, thinking this would be a great way to get to know the city. Sure. And we walked around and our guide led us to, the downtown area where we looked at these skyscrapers and she told us, this was the original site of a vibrant village that has been bulldozed into oblivion and replaced by these skyscrapers.
And then she led us to the edge of town.
To the old Tucson.
And she began tracing the air with her hands.
And she said, before this town was called Tucson, it was called El Presidio.
And this is where the old wall stood that protected our city.
And in that moment, I had no idea that I would go on to sign almost every merchant in town. And two years later move on and do it all over again in Denver.
I just knew that everything was going to be okay.
And now in my writing, whenever I face a blank page and I have to write about security, I go back to that moment.
And I think about how can we find our own El Presidio in the digital world?
Interesting.
A lot of times when I'm talking to customers, they kind of bring that up.
What is our our perimeter protect protections do these things? And yet, especially in in cloud situations, and and even in on prem, more and more, the the whole concept is shifting so that we don't have a perimeter that protects everything inside.
We have the belief that nothing is protected by a perimeter, which gets into the concept of a of a zero trust model. And people are like, what does zero trust mean?
It just means that before, when we had a perimeter, protection on our environment, we would assume that everything inside that perimeter and and the perimeter would be set up by, like, firewalls to protect outside traffic from coming inside the environment. So right. So that's what what perimeter meant in that case. And so because the belief that the perimeter kept out unwanted traffic, you could have fewer security controls on the inside because everything, was protected by that outside perimeter.
Right? We don't believe that anymore. We don't believe that you can't get inside an environment. And so there are a lot of protections that are set up that your perimeter might be good for understanding what's traversing your environment.
It it's a good stop point for, things like your intrusion protection, intrusion detection, not because you don't believe you should protect everything inside as well, but because it provides a place for assessing traffic flows and and maybe picking up on some some patterns that that would be denote malicious behavior. Right?
So this whole idea of, does a perimeter protect us anymore?
Well, it's one of the things.
Right? But we don't have these we don't have these outside walls on our cities to keep the barbarians for coming in, and we don't have perimeters on our environment that assumes everything inside is safe.
So, that is a really good description of of or a a story that kinda helps us understand how does this language help us or hurt us as we're talking about security. Right? So we have language, and it applies to something we know. And we think we know it because in the solid world, we can hang on to it. But in the digital world, does it do you think it helps us or hurts us in in applying language we know and understand to something that is new?
I totally think it might hurt us because if we think that we're fluent in security, because we're using the same words that we've always used, I think that we, we're in danger of having a false sense of confidence about it. Because if you think about the approach to security that we used to have in the hardware centric world that I come from, where, you know, our approach to security was bolt everything down.
And I mean, I'm talking about physically attaching POS to a countertop. Right. And we didn't even leave it at that. We actually went inside the terminal and locked the software so that our competitors couldn't reprogram it.
And we used proprietary code.
And we everything that we did was cloaked in mystery to try to protect us. And we kind of acted like the Wizard of Oz, you know, behind the curtain. You know, with all the thunder and lightning and drama.
But, you know, none of that has any place in today's digital world, where we really rely on interoperability.
And you have so many players coming in from everywhere.
Bringing added layers of value and authentication.
And layering that on top of core technologies.
And, you know, we just can't bring that frame of mind and that type of security to the digital world.
And I believe that hardware will always have a place in our ecosystem. But it's going to as we move on and we become more digital, it's going to share a very crowded stage with mobile technology, digital technology, at marketplaces, and what some people refer to as the Internet of everything.
Right.
And in this internet of everything, merchants want to see their transaction flows in real time. They don't want to have to wait until the end of the month to look at a merchant statement.
And, and they want to use advanced technologies. And in many cases, they rely on their managed service providers to help them monitor transactions continuously around the clock.
And react immediately if they see anything anomalous.
And in this multidimensional environment that we're in, security metrics is providing the tools that are a lot like the pocket guides I mentioned earlier.
They help us make sense of it all.
Yeah. Yeah. It it's, what what I find interesting about how assessments have changed is what just what you just spoke to, that interoperability.
So the number of security providers or or, technology providers, service providers that, are involved in every single organization that I work with. Where in the past, it might be very, limited to one organization with maybe one service provider. Now it's you have one service provider, setting up your, website hosting and another one that is creating the code for your website and another one that provides the drop in APIs that, send credit card information from your customer to your processor. Right? These are layers of interconnectedness that are are, they don't follow the old patterns. Right? And so when we try and look for language to describe that, sometimes, even in filling out the report on compliance, it's written in because of the the history of it and because of how solid this standard has been over the years for technologies that are known and and used, sometimes that language infers things that are simply not true anymore in the digital world.
And so you have to use language to address the concerns of the of the requirement and make sure that you you know how it's being addressed that maybe are different from how we looked at it before. I think that causes maybe some some struggles with with some of our customers as they try to prepare for the compliance end of things, but also they're trying to use that compliance base to understand their security as they should. Right? So, I I believe that the PCI DSS provides a great, outline for understanding security. But then there are those gaps of how do we how do we speak to this clearly when we have different models for addressing security than we've had in the past. And so, I I don't know, as you've talked to different people about this, what what kind of shifts in language or shifts in focus on language are you seeing as you as you get these stories from the payment card industry?
Well, you know, it's interesting.
I think the best stories I hear are from security experts and technology startups.
And, and I believe that QSAs and fintechs are the true poets of our age.
And they say things that no one else sees.
And they're bridging the gap between analog and digital.
And, and one thing that I've noticed in recent years, when PCI first came out, a lot of people had a real disconnect understanding it because their reaction was, how can you make me go through all of this and then I could still get a security breach?
And I think that over the years, I think that, most people in the business community have become acclimated to the fact that PCI delivers coordinates. It doesn't give you a silver bullet.
And it's not a once and done. It's not an exercise that you perform every year and then say, I'm fine now.
You know, and I think people are getting better about understanding that. Just because of the digital world that we're living in. And we're all becoming so much more adapted to it. I think, you know, COVID really accelerated that shift for us.
Right.
But that's one thing that I've noticed. And, yeah. I I just think that in some ways, we're bringing an analog mindset to a digital game. But it is getting better. I agree with you.
Right. And it's hard because we live in an analog world.
But we also the digital world is, a communications framework that that cannot be denied. Right? That's that's how everything flows. And yet here I sit hands on a solid thing. Right? So that that, dichotomy between the analog and the digital is fascinating for me. Alright.
I don't know if I'm dreading this part of our conversation or not, but our producers thought that it would be thanks a lot, Hunter. Thought it would be super fun if you asked me some questions. Now it feels a little bit like a pop quiz, but I'm here for it. I'm ready.
We'll see how it goes.
Just give it your best shot.
What you got?
Yeah. No. This will this will be fine. You'll you'll nail it, Jen.
No. I'll you know, certain things that as I interview people, you know, you start to see certain trends. And these are things that just come up a lot.
And I think the most frequent, the most frequent question that I get when I'm interviewing business owners.
And I talk about multilayered security.
They just want to know, you know, that sounds really great. But how do I actually implement multilayered security?
Yeah. That's a big one. And it especially with small and medium businesses, implementing multilayered security can be a real challenge for a single organization, and here's why.
It's a sometimes the IT group and IT slash security and sometimes IT is supposed to be security.
So the business side is like, yeah. I got a computer guy. And they just do that. Or this computer group, the IT group.
Right? And so it's it black boxes it a little bit for the the business because they don't understand, these the defense in-depth concept, and they don't understand all of the elements that go into it. If you ever wanna blow your mind, and maybe we can get this linked in the show notes, the Northrop Grumman, the fan defense in-depth is something that when you say, alright. What are you talking about with defense in-depth?
It talks about all of these things, all of the security controls that go into those layers. And and when you first look at it, it's like, wow. My brain hurts because there's so much there. Right?
And so if you think, alright. I've got a guy who knows how to set up a computer and put a user on it and connect it to the apps that we use. That is a great person to have. But does that person know networking?
Probably not. That's a that's a different expertise. Does that person also know how to use a SIM, a security information event management system, so they understand potential events that are maybe indicators of compromise?
They might never have used that tool. So they might not know how to tune that tool. And, also, that's a tool that requires some, time and energy behind it to make it useful. And so you've got one person who's like, my password needs to be reset. And, also, this is this connectivity to this, system over here is not so great. Our Wi Fi went down. And, oh, by the way, can you assure me right now that we are not being breached?
That's a lot on a single individual or group. And yet, the business thinks, oh, it's related to computers, so surely this person or group has that. Right? And so so I think, you know, your original quest question was how do I implement it?
It starts with knowing what the extent of defense in-depth means. And if you don't have that under solid, understanding inside the organization, kinda gotta bite the bullet and ask somebody, come on in. Help us know where our gaps are. Here's the second thing about that. Oh, it's gonna be a long answer. I'm so sorry. But the second reason it's really hard is you're talking about understanding the scope of your organization.
And and there's kind of a joke in the the pen testing world of, hackers don't care about your scope, which is kind of a funny way of saying, if you don't know what's actually connected, what can what can speak to other one things, just saying, hey. Our PCI scope is this. Declaring its scope does not mean that you've got it right.
Okay? So knowing what are the systems that contain or, receive, transmit, store cardholder data, or the really cool one could affect the security of cardholder data. That's my favorite one because that's the one people miss all the time. The radius that could affect the security of well, so people say, let's let's talk about, a customer that I've been working with recently.
I was up all night writing their report because I got a little behind. Sorry, guys.
So but they have information that goes from cardholder data goes from the customer browser to the processor directly, does not transverse their systems. I hear a lot of times from customers, well, that means I don't have scope. Not true.
You have your website that presents the code that has the API that sends that to there. If something happens here, what's going to happen to that information?
Right? So so understanding that scope means anything that you need to protect to make sure you are protecting the security, privacy, availability of your your information that matters, that's scope. Not just what you wanna talk about. Right?
Okay. I got a little excited there. Sorry.
What's Oh, my goodness.
I got really mesmerized by that because I'll tell you why.
As you were describing all of the intranet, intricate connectivities and how you really have to map that data across your entire enterprise. And it requires knowing a lot. Yeah. But, you know, and also, I love what you said.
You said, I got a guy. In New York, we love to say that. And we say it all, like, all day long. You'll always hear us say, I got a guy.
Yeah. But you know, the funny thing about having is that that indicates to me that there's some kind of a handoff going on.
Yeah. Yeah.
And some of the biggest vulnerabilities in technology are in that handoff.
Right. It's also willful ignorance about what they're doing for you.
Exactly.
Exactly.
And so you've got the technology layer and you have the handoffs that you have to really pay very close attention to.
Right.
And maybe you have a guy who does that for you.
But, I think the inherent danger and the vulnerability is in that handoff. Whether it's a handoff that's happening on the technology level, or if it's a handoff that's happening between somebody on your staff and a third party service provider.
Sure.
And also, you know, the business side of things, like you said, if it's a handoff and you're kind of like, this is not my problem anymore, then whose problem is it? But also, if you say to your IT guy, hey. Take care of the security.
What do they know about your business? What do they know about your business processes? How are they supposed to know where you send, sensitive information?
Right? If you don't, as a business, tell them here are the flows that we have as a business so that that they can equate them to the technical, security flows, then then again, you've got a gap there. Right? If the if the got a guy doesn't know, hey.
This is the information that is critical for us to for our business to run. And by the way, do you take care of disaster recovery for us?
Because if you think backups are the same thing as disaster recovery, it's not. Right? So so understanding exactly what that handoff if you do a handoff, it's fine. Third parties are great.
There are people who are so good at their job that if you can leverage somebody else's core competency so that you can do your core competency, that's good business. Right? But making sure that you're involved in that process and that you don't allow gaps or that you're not just handing it off so you can not think about it anymore. Right?
Then then you get some real juice out of that relationship.
I agree. And, you know, in this world that we're all in together, there no one company can do it all. True. You know, handoffs are just a reality of the of the world that we're living in and the world that we're working in. And I just think that we we need to be more aware of it.
Yes. We can't hand off dismissively, for sure.
Right. Right. We can't just you know, as as I've heard you say before, you, you know, you can't just check it off.
It's not a checkbox thing. Yeah. That is not. If you check that box, man, without knowing what you're checking, then what then don't check it.
Okay. So here's another one I hear all the time that just it's cringeworthy, but I'll share it.
I hear sometimes people will say, I'm small.
The bad guys won't bother with me.
Whenever somebody tells me they're small, I don't know if you watch, shoot, what is the name of this comedian that's gonna bug me because I'm gonna forget, but I'm small. I have no money.
You can only imagine the stress that I am under. Being small doesn't mean you don't have stress. Being small doesn't mean that you're not going to experience the kinds of, attacks that the big guys are going to experience. And sometimes being small means you are less prepared. So back in the day, not to make myself sound old, but back in the day, of course, there were the indiscriminate viruses that came out.
But also, in order to be really affected by some of the more serious hacks, you had to be a target. You had to be big. You had to have someone who was manually dedicated to getting into your systems.
That's because they didn't have the tools then that we have now. Now any, script kitty as as they as they call them, anybody who wants to use all of the tools to to hack a system, they're gonna go and hack it. But also, you don't even need the manual piece anymore. Right?
So there's so much good good I don't know if good's the right word. Effective? There we go. So much effective malware out there that small organizations don't have to be a target.
They can be, just there and still get affected. Let's look at, some specifics. The NHS, over in in, in Great Britain really got hit by a specific, ransomware attack. And, if I'd had coffee this morning, I would remember the name of that too.
But But but it was a Yeah. I've got I'm sure there are people listening that are just yelling the name of it right now. Thanks. Sorry, guys.
That's right.
But, it it affected a lot of systems, and it affected, systems that were not prepared because they had not been fully patched, because they were not updated, because they didn't have a lot of security controls on them. So the larger organizations have the funds behind them to be able to make sure all of these things in place. Right? Smaller organizations don't always have the money or the time or the personnel in order to make sure those things are in place. And so in in a lot of ways, the I'm small defense means you should be more stressed out about what's out there than than the bigger guys.
That's true. And, you know, some of it actually feels a little bit like bacteria.
Yeah.
You know, because I I I think about, you know, WannaCry.
That's the one. It's WannaCry. Thank you.
Ding, ding, ding, ding. But, you know, WannaCry almost immediately began to morph into all of these other iterations of itself.
Almost like a virus does. You know, they just develop immunities to certain kinds of, of defenses and, you know, and attacks. And it's scary. It really is.
And, and, you know, I think there's a lot of, you know, sort of, you know, people will cast a wide net. And if you just happen to be in the path, it doesn't matter if you're big or small. Yeah.
If you don't have right security protections, You're gonna get directly in the path.
Yep. Exactly. So Exactly.
Oh, and Mike Birbiglia was the name of that comic. Whew. He's firing on all cylinders now.
Oh, that's good. I'm gonna have to look that up. Yeah.
So I think we have time for one more question if you have one.
Okay. Alright.
Well, I only have one left. So it's perfect. Oh, great.
The the the hacker hoodie myth. I think a lot of people are very they they they have a misconception of what the hacking community looks like these days.
And Sure.
I'd love for you to to help address that.
Sure. Well, you know, and hacker has a lot of meaning. So we won't dive into too many of that. Just let's just just assume that right now we're talking about someone who is maliciously going after your information.
I personally wear hoodies all the time. They're very comfortable. I imagine a lot of hackers do.
But it's shifted from the lone individual in a dark room going after a specific target. Today, it's more, criminal enterprises and, government funded enterprises. So, there's a lot of money to be made in hacking. So, of course, people are setting up these vast businesses of people who, of various levels of ability are going in and and basically doing all the functions that a pen test would do.
Right? That the tools are out there. It's what they're using them for, what they're using the information they get to for is is what's changing. And so, really, I think the myth is is, you know, well, I'm not a target because I don't have any individual person who'd wanna go after me.
Well, now if you have something that's worth money, they can sell it. And that includes cardholder data. It includes, electronic, protected health information. It includes all manner of, valuable proprietary or private information can be sold for money.
And so if you can make money off it, the bad guys are gonna come after and they're gonna set up entire businesses to do that. And I think that's what makes it more serious now. Then, of course, we've got the the government funded agencies, and those are those are the bad guys. But, we also have our government funded agencies out there doing good work, protecting us from a lot of that.
So, I I think the the long story short on that one is regardless of the size of organization that you have, you have to know what is the information I have that is of value. What do I not want to get out there? Because somebody is going to try and get it either directly through a a a manual attack or indirectly through one of these many, many malware iterations that's out there.
Perfect. Thank you, Jean.
Well, this has been a lot of fun, and I would love to talk to you for another hour. But we're out of time. So before we wrap up, did we miss anything? Is there anything you wanted to to add there?
No. I, I think we covered the waterfront, but I would love to do this again.
Love it. So, if people wanted to get in touch with you, how do they how would they connect with you?
Oh, absolutely. I'm on LinkedIn, and I'm on Twitter at at DSL Direct.
And you can also reach me at Dale at DSL Direct LLC dot com.
Great. Thank you so much, Dale.
Thank you, Jen. It's really been fun.
Alright. Well, hope to talk to you again soon. You take care.
Me too. Take care. Bye bye.
Thanks for watching. To watch more episodes of Security Metrics podcast, click on the box on the right. If you prefer to listen to this podcast, it's available on all your favorite podcast platforms. See you on the slopes.
.svg)