F E AT U R E
BACK TO BASICS by Stuart Corner
Why can’t we get this stuff right?
A LITANY OF CYBERSECURITY FAILURES The title of Jess Dodson’s presentation at AusCERT2021, held in the Star Hotel on Queensland’s Gold Coast and online, was framed as a question: “Back to Basics - why can’t we get this stuff right?” She didn’t answer it. What she did was deliver an impassioned speech detailing the multiple failures in basic security practice and policy — yes even keeping
Dodson then presented a comprehensive list of failures in security practice and policy, broken down according to the categories in the NIST Cybersecurity Framework: identify, protect, detect, respond, recover. A summary of the basic security measures she described can be found on her blog. Here’s some of what she had to say.
username and password as ‘admin’ and ‘admin’ (more
IDENTIFY
of that later) — she has seen time and time again in
You can’t protect what you don’t know you have. “I
her 15 years as a Windows system administrator.
am yet to go into an organisation that has an asset
“I’m pretty miffed about some of the stuff I keep seeing when I’m going into organisations and businesses and companies,” Dodson said. “I feel like a lot of this is very much common sense. But if it is
system and an audit system that is up to date, and they know all of their inventory. Without having that inventory, without knowing what you’ve got, it’s incredibly difficult for you to protect your systems.”
common sense, and why isn’t it being done.” Good
Beware the single source of truth. “One person who
question.
knows everything and is the single point and source
Suspecting that many in her audience were likely guilty of the sins she was about to reveal, she warned them: “There are going to be things in here that will make you squirm. And I’m very sorry about that. But that is my intention. Think of this more as teaching you to reaffirm those beliefs that you have about
of truth for everything is not a good place to be. … But on the flip side, if everyone is responsible, then no one is responsible. So you need to make sure that your business owners and your system owners are actually owning their own risk and owning the risk of their systems.”
the things that you should be doing properly in your
Have a risk register. “Business owners will take risks
organisation.”
and they will accept those risks until things go wrong.
WOMEN IN SECURITY MAGAZINE
99
