Improving information security with one simple question

Anyone who has children, or has had to deal with very young children, will understand how powerful the word “why” is and how it can drive their curiosity. Innocent-sounding questions such as “why is the sky blue?” can lead to the question “but why?” to each of the answers given. A cycle of never ending “whys” is quite commonplace until it seems all the answers have been exhausted, but still they will ask “why?”

This small and seemingly innocuous word can also be one of the most powerful tools in the vocabulary of the information security professional.

Those same three letters that drive many parents crazy were also the driving force for many of the early pioneers in information security. Their curiosity and wondering “why?” led these pioneers to experiment, to poke, to examine, and to learn as much as they could about the computer systems, the networks, and the applications they used. This knowledge was then used to further improve those systems and today our interconnected world is a result of those people asking that simple question.

I believe that an inherent curiosity is one of the key traits every successful information security professional should have. That sense of wonder and seeking to find out why things work in a certain way, many times by breaking them, is what makes this profession such an exciting and interesting one.

Unfortunately, I have noticed recently that many people are no longer seeking to find out why things work in a certain way. We seem to have moved to an industry that is too willing to accept how things are presented to us without challenging it. We focus on compliance issues, react to media stories, listen to speakers at conferences, or swallow all the material that vendors pitch our way.

Instead of asking why, we are now asking who, what, where or when. Instead of asking “why do I need to be compliant with a certain standard?” we are asking “what do I need to do in order to be compliant?” Instead of asking “whom should I allow to have their device access the network” we need to be asking “why am I allowing access?” When vendors pitch their solutions to us we need to stop asking “what is the solution? Or indeed what is the problem?” and instead ask “why do I need this product?” For each answer to these questions we should continue to ask “why?” until we have exhausted all avenues of questioning and have a fuller and better understanding of the issues we are trying to address.

While the “what?”, the “who?” and other such questions are important, they do not get to the core of how best to secure our systems and data. It is the “why?” that drives the curiosity of the 4 year old child, and the “why?” should drive our need to better understand, too. Asking this question not only leads us to discover the reasons we need to do things, but it also helps us to examine the motives behind the headlines and stories that we read.

We see an ever increasing number of news stories about the threat of cyber-war, the need for cyber-warriors and cyber-weapons, the rise of the Advanced Persistent Threat (APT), the risks that Bring Your Own Device raises, and the security issues with Cloud computing. If we simply consume these stories without asking “why?”, we may never learn to understand the motives of those behind the story.

Why are vendors pitching story after story about the above issues? Is there a genuine concern that we should be aware of, or is it simply a way for vendors to make companies more nervous about their security and therefore buy their products? Is all the talk and hype about cyber-warfare and cyber-weapons something that we all should worry about or is it a way for vendors and other interested parties to create a perceived need for governments and industry to provide funding in this area? By asking “why are these stories appearing in the first place?” we can better understand the issues that really affect us as professionals, as a community and also affect our organizations.

The question “why?” should not just be reserved for vendors, pundits and those in the information security industry – we should also look into our organizations and ask the same question of them. We need to better understand the business that our organizations are conducting so we can better protect them. By engaging with our business colleagues and asking them the question “why?” we can better understand the issues the business is trying to address. It can help us eliminate unnecessary distractions and allow us focus on delivering real value and benefits to the organization.

Let’s stop being distracted by the “who?”, the “what?”, the “where?” and the “when?”. Let’s focus instead on the “why?”. It is time to reignite the curiosity that drove the early pioneers of the security community and made “why?” a useful tool once again.

Brian Honan is an independent security consultant based in Dublin, Ireland, and is the founder and head of IRISSCERT, Ireland’s first CERT. He is a Special Advisor to the Europol Cybercrime Centre, an adjunct lecturer on Information Security in University College Dublin, and he sits on the Technical Advisory Board for a number of innovative information security companies. He has addressed a number of major conferences, he wrote the book ISO 27001 in a Windows Environment and co-author of The Cloud Security Rules. He regularly contributes to a number of industry recognized publications and serves as the European Editor for the SANS Institute’s weekly SANS NewsBites.