Home > Resources > Articles > Defense in Depth: User-Centric Security

Defense in Depth: User-Centric Security

October 10, 2019 | 112 views

It’s impossible to create a security system that removes the user from the equation. They are integral and they have to be part of your security program. Security is defined by the individual. The minimum expectation you can have of your users is that they’ll operate in good faith. Avoid complexity because as soon as it’s introduced it drives problems everywhere. Instead, keep asking yourself, how can I make security more usable?
Individuals are suffering from alert fatigue. If you’re going to send an alert to a user, make it relevant and actionable. And always be aware that your security alerts are not the only alert the user is seeing and deciding or not deciding to take action on. Think about all the alerts you completely ignore, like the confidentiality warning in a corporate email.

Spotlight

North Texas Chapter of ISACA

ISACA® is a not-for-profit professional association serving the Information Technology (IT) audit, security, and control community in North Texas. We sponsor numerous events each year to provide members and guests opportunities for professional development, continuing education, and networking with colleagues from a wide range of employers throughout the area.

OTHER ARTICLES
VIRTUAL DESKTOP TOOLS

Virtualization can transform your company’s IT infrastructure

Article | July 26, 2022

For many companies in today’s highly competitive, rapidly digitizing world, data center transformation is not merely a one-time project – it’s a constant challenge. No corporate IT leader should be content merely to revamp their data infrastructure once, then call it a day. Instead, they should always be looking for ways to make their approach to data more dynamic and easier to scale. Ideally, they’d do so in a way that maximizes resource utilization while minimizing costs. Luckily, that’s exactly the idea behind virtualization, which involves creating a new infrastructure that’s capable of rapidly scaling and facilitating workload development. IT leaders are quickly coming to realize that with virtualization in their toolbox, they’re able to make their operations more agile than ever, and without increasing costs. This is why over 80% of enterprise server workloads today are running on virtual machines, and the market for data center virtualization is expected to reach a total value of $10 billion by 2023.

Read More
SERVER VIRTUALIZATION

Best Practices for vSphere 6.7 Tagging

Article | June 9, 2022

vSphere Tags were introduced in version 5.1 as a way to organize inventory objects such as VMs, Hosts, Datastores, etc., a much-needed feature for helping search for or group objects within vSphere. A Tag is basically a label that can be applied to vSphere inventory objects. When an administrator creates a tag, it is then assigned to a tag category. Categories allow the grouping of related tags. When a Category is created, you can specify associations of object types (such as; VM or Datastore) as well as whether more than one tag in a category can be applied to an object (ex; One Tag or Many Tags).

Read More
VMWARE

How to automate the creation multiple routable VLANs on single L2 network using VyOS

Article | December 7, 2021

My personal homelab has a very simple network topology, everything is connected to a single flat network. This has served me well over the years, but sometimes it can prevent me from deploying more complex scenarios. Most recently while working with NSX-T and Project Pacific, I had a need for additional VLANs which my home router does not support. There are a number of software solutions that can be used including the popular pfSense, which I have used before. Over the Winter break, a colleague introduced me to VyOS, which is another popular software firewall and router solution. I had not heard of VyOS before but later realized it was derived from Vyatta, which I had heard of, but development of that solution had stopped and VyOS is now the open source version of that software. Having never played with VyoS before, I thought this might be a good learning opopournity and started to dabble with VyOS over the holiday.

Read More

Hyperconverged Infrastructure for Remote/Branch Offices & Edge Computing

Article | February 10, 2020

Hyperconverged infrastructure (HCI) is playing a significant role in building an enterprise multi-cloud environment. The benefits are well documented – you can learn more about them in a new white paper developed in collaboration with ViON, Fujitsu, and Nutanix, “Simplifying Multi-Cloud and Securing Mission Progress.” In addition to driving a cloud foundation, hyperconverged infrastructure is driving other use cases. In our first blog, we examined the impact that HCI can have in a disaster recovery solution. In this installment, we’ll discuss how HCI is changing the dynamics for remote offices and edge computing.

Read More
VIRTUAL DESKTOP TOOLS

Rising Importance of Network Virtualization

Article | July 26, 2022

For many companies in today’s highly competitive, rapidly digitizing world, data center transformation is not merely a one-time project – it’s a constant challenge. No corporate IT leader should be content merely to revamp their data infrastructure once, then call it a day. Instead, they should always be looking for ways to make their approach to data more dynamic and easier to scale. Ideally, they’d do so in a way that maximizes resource utilization while minimizing costs. Luckily, that’s exactly the idea behind virtualization, which involves creating a new infrastructure that’s capable of rapidly scaling and facilitating workload development. IT leaders are quickly coming to realize that with virtualization in their toolbox, they’re able to make their operations more agile than ever, and without increasing costs. This is why over 80% of enterprise server workloads today are running on virtual machines, and the market for data center virtualization is expected to reach a total value of $10 billion by 2023.

Read More
SERVER VIRTUALIZATION

How to Start Small and Grow Big with Data Virtualization

Article | June 9, 2022

vSphere Tags were introduced in version 5.1 as a way to organize inventory objects such as VMs, Hosts, Datastores, etc., a much-needed feature for helping search for or group objects within vSphere. A Tag is basically a label that can be applied to vSphere inventory objects. When an administrator creates a tag, it is then assigned to a tag category. Categories allow the grouping of related tags. When a Category is created, you can specify associations of object types (such as; VM or Datastore) as well as whether more than one tag in a category can be applied to an object (ex; One Tag or Many Tags).

Read More
VMWARE

VMware NSX 3.2 Delivers New, Advanced Security Capabilities

Article | December 7, 2021

My personal homelab has a very simple network topology, everything is connected to a single flat network. This has served me well over the years, but sometimes it can prevent me from deploying more complex scenarios. Most recently while working with NSX-T and Project Pacific, I had a need for additional VLANs which my home router does not support. There are a number of software solutions that can be used including the popular pfSense, which I have used before. Over the Winter break, a colleague introduced me to VyOS, which is another popular software firewall and router solution. I had not heard of VyOS before but later realized it was derived from Vyatta, which I had heard of, but development of that solution had stopped and VyOS is now the open source version of that software. Having never played with VyoS before, I thought this might be a good learning opopournity and started to dabble with VyOS over the holiday.

Read More

Hyperconverged Infrastructure for Remote/Branch Offices & Edge Computing

Article | February 10, 2020

Hyperconverged infrastructure (HCI) is playing a significant role in building an enterprise multi-cloud environment. The benefits are well documented – you can learn more about them in a new white paper developed in collaboration with ViON, Fujitsu, and Nutanix, “Simplifying Multi-Cloud and Securing Mission Progress.” In addition to driving a cloud foundation, hyperconverged infrastructure is driving other use cases. In our first blog, we examined the impact that HCI can have in a disaster recovery solution. In this installment, we’ll discuss how HCI is changing the dynamics for remote offices and edge computing.

Read More
MORE ARTICLES

Spotlight

North Texas Chapter of ISACA

ISACA® is a not-for-profit professional association serving the Information Technology (IT) audit, security, and control community in North Texas. We sponsor numerous events each year to provide members and guests opportunities for professional development, continuing education, and networking with colleagues from a wide range of employers throughout the area.

Related News

How to Get a Prospect to Test Your Security Product

Spark Media Solutions, LLC | February 21, 2018

I’ve never met a harder sale than cybersecurity to the IT team,” admitted a security vendor. The challenges are unique at each firm and they are reluctant to even take a call let alone share real concerns. ”In the security products market, cybersecurity vendors simply want to be considered, and that often requires compelling a prospect to test the darn product. But getting a response from a prospect, let alone a product test, is often a Herculean task. One vendor I spoke to said he would often have to initiate ten contacts with a prospect before he’d even get an acknowledgement. Companies whose primary objective is to test products can’t even keep up with the volume. As of last December, 451 Research was aware of more than 1,600 security vendors. “Those were only the ones we had time to write down,” said Wendy Nather (@WendyNather), formerly of 451 Research and now director, advisory CISOs at Duo Security. “That wasn’t even the total number of products!”

Read More

How to Uncover Security Concerns When Customers Won’t Tell You

Spark Media Solutions, LLC | February 06, 2018

“What are your security concerns?” It’s the one question all security vendors want to know from potential customers. It’s also the one question potential customers don’t want to divulge for obvious security, privacy, and “I don’t have the time” reasons. All is not lost! There is still a way, in fact multiple ways, security vendors can sleuth out a company’s security needs. I asked a few security professionals how they go about figuring out the answer to the “what keeps you up at night” concern. Here’s their advice (plus one tip from me!): “While everyone likes to say their problems are unique and challenging in a way no one has ever seen before, it’s really not true,” said Michael Farnum (@m1a1vet), SA manager, Set Solutions. You may not even need to dig that deep, or at all. If your product solves a rudimentary security need you will probably already be in sync with a company’s security concerns. Farnum believes many organizations are still struggling just dealing with the basics of security.

Read More

30 Security Vendor Behaviors That Set Off a CISO’s BS Detector

Spark Media Solutions, LLC | February 19, 2019

I had never seen such disdain and aggravation from a CISO. Richard Rushing (@SecRich), CISO of Motorola Mobility, sent me an email with a litany of vendor pitches. Each one punctuated with vitriolic commentary and frustration. It appears a lot of companies will fully protect his network and automatically detect threats. Rushing’s diatribe was so vicious that any security vendor would be horrified to know their marketing emails were eliciting this reaction. Now I’m telling you. ‘Tried and true’ marketing and sales techniques can often be irritants to very wise security buyers. They’re not fooled. Worse, they’re turned off. Read on for sales techniques and claims you should avoid when communicating to a security professional. For each item to avoid, I asked security professionals how they’d prefer to be engaged. This is a long article, but it’s jammed with gems. Take it slowly.

Read More

How to Get a Prospect to Test Your Security Product

Spark Media Solutions, LLC | February 21, 2018

I’ve never met a harder sale than cybersecurity to the IT team,” admitted a security vendor. The challenges are unique at each firm and they are reluctant to even take a call let alone share real concerns. ”In the security products market, cybersecurity vendors simply want to be considered, and that often requires compelling a prospect to test the darn product. But getting a response from a prospect, let alone a product test, is often a Herculean task. One vendor I spoke to said he would often have to initiate ten contacts with a prospect before he’d even get an acknowledgement. Companies whose primary objective is to test products can’t even keep up with the volume. As of last December, 451 Research was aware of more than 1,600 security vendors. “Those were only the ones we had time to write down,” said Wendy Nather (@WendyNather), formerly of 451 Research and now director, advisory CISOs at Duo Security. “That wasn’t even the total number of products!”

Read More

How to Uncover Security Concerns When Customers Won’t Tell You

Spark Media Solutions, LLC | February 06, 2018

“What are your security concerns?” It’s the one question all security vendors want to know from potential customers. It’s also the one question potential customers don’t want to divulge for obvious security, privacy, and “I don’t have the time” reasons. All is not lost! There is still a way, in fact multiple ways, security vendors can sleuth out a company’s security needs. I asked a few security professionals how they go about figuring out the answer to the “what keeps you up at night” concern. Here’s their advice (plus one tip from me!): “While everyone likes to say their problems are unique and challenging in a way no one has ever seen before, it’s really not true,” said Michael Farnum (@m1a1vet), SA manager, Set Solutions. You may not even need to dig that deep, or at all. If your product solves a rudimentary security need you will probably already be in sync with a company’s security concerns. Farnum believes many organizations are still struggling just dealing with the basics of security.

Read More

30 Security Vendor Behaviors That Set Off a CISO’s BS Detector

Spark Media Solutions, LLC | February 19, 2019

I had never seen such disdain and aggravation from a CISO. Richard Rushing (@SecRich), CISO of Motorola Mobility, sent me an email with a litany of vendor pitches. Each one punctuated with vitriolic commentary and frustration. It appears a lot of companies will fully protect his network and automatically detect threats. Rushing’s diatribe was so vicious that any security vendor would be horrified to know their marketing emails were eliciting this reaction. Now I’m telling you. ‘Tried and true’ marketing and sales techniques can often be irritants to very wise security buyers. They’re not fooled. Worse, they’re turned off. Read on for sales techniques and claims you should avoid when communicating to a security professional. For each item to avoid, I asked security professionals how they’d prefer to be engaged. This is a long article, but it’s jammed with gems. Take it slowly.

Read More

Events

.NEXT

Conference

.NEXT

Conference