What’s The One Big Issue Behind Almost Every Hack?
Hint: Most Risk Assessments Ignore It!
- Poorly configured or managed firewalls,
- Untested backup systems,
- Improper network segmentation
In case you missed Part I , Read it Here:
I’ve been writing a series of articles on risk assessments over the past couple of months. If you’re in the security business (or trying to break in on this growing cash cow) it’s time to get on board with how assessments work; how they’re sold, what they’re for, how to get them read, and how to make them work for you inside the accounts you sell to.
In Part I, I covered Differentiating Yourself in the Sales Call. (Note: if you’re looking for a technical read, this is not it…
So, next, let’s turn to the scope, and how what you cover in your engagement has a lot to do with who buys it and who reads it.
If you want to grow your business, keep reading – the assessment is the best way (and one of the only ways) to get engaged with decision makers (the people writing the checks).
I hear it all the time, “The client is always right.” No they’re not!!! Especially when it comes to security.
Remember (See my book, The House & The Cloud) your IT contacts are not liable. And your asset-owner contacts (who are liable) have very little understanding when it comes to security.
So don’t let the client dictate the scope.
In short, you can’t simply respond to an RFP and come up with a meaningful assessment project (I discuss RFP responses in detail in my book, From Vendor to Adviser).
When I bring up, Assessment. The first question I get is, which tools (scanners) do you recommend? I’ll cover the actual assessment process in a future article. But for now, set tools/scanners, etc. aside. There’s something far more important here to consider…
The typical approach to assessing risk is, Inside/Outside. But looking inside (trusted), and then out, is wrong thinking…
The truth is, your client doesn’t have and inside or outside anymore. Sure, your dream client has a perimeter, but half the office is on the road or working at home. They’re all outside on their mobile devices. Chances are these knowledge workers are going back and forth between personal (Facebook and shopping) and business, and on breaks their kids are playing Counter Strike or World of Warcraft (or surfing porn and gambling sites).
(And then there’s the 75% of employees who admit they steal from their employers – all inside…WSJ)
Every paid assessment should cover perimeter devices, end nodes, and network architecture/segmentation & configuration. The obvious, so I won’t elaborate.
Yet, when I read a scope document, and it breaks the assessment down into: Internal, External, Network, Perimeter, and Servers/Storage…I get concerned.
This infrastructure-centric approach is for the super-techies, not business leaders.
I can already imagine the deliverable with it’s endless tables and network diagrams. The Red, Yellow, Green light ratings that appear on every assessment. If you’re looking to differentiate yourself, this won’t do it.
Price will be the deciding factor!!!
The business people (Asset Owners) are the ones who will be writing this check. So, what is it they need? In my book, The House & The Cloud I spell out exactly what the board is looking for (see page 195). It’s restated in Selling Assessments Part I.
This type of deliverable requires a different approach. The final outcome is a measure of risk (illustrated in the Impact vs. Likelihood Chart).
START HERE – DIGITAL ASSETS: Think like a Disaster Recovery Specialist…
Where is the data? Which of these assets are most important, and what can’t they do without?
It’s a fact that most companies have no idea where their data actually is, or who has access to it. When people travel, work from home, or use cloud apps, knowing gets even harder. Ad-hoc data is everywhere.
Tools such as those provided by RiskIQ are designed to find data. In some cases that data is sitting on someone else’s server (such as a competitor or in a darknet chat room, for sale).
Digital assets, not hardware infrastructure, is what assessing risk is all about. So Consider the following:
ACCESS CONTROL – ACCESS TO DIGITAL ASSETS: People(and now robots) access data. Behind every data breach is a person. Some people have access, so they’re authorized. But not all authorized people are doing things they’re authorized to do.
Does your assessment include the people inside the organization? It should. Remember, “75% of internal workers admit they steel from their employer (as referenced earlier)”.
PEOPLE: Given all that’s just been said, be sure to include interviews (more details on this in my book, The House & The Cloud pg. 196).
DATA ASSET TRANSMISSION & STORAGE: Once you know where the data is, you want to know who accesses it, from where, when, and why. Data transmission and storage is part of a company’s workflow. So include in your scope, an analysis of assets as follows:
TRUE SECURITY (ALL THREE ASPECTS): Security can be looked at several ways. The CISSP ISC2.ORG common body of knowledge looks at 7 (and this varies over time) major disciplines. Most security professionals recognized three pillars:
All three should be considered in the scope. I’ll provide more detail on approach in a future writing…but be sure to cover all three.
SOCIAL ENGINEERING: Social engineering is part of just about every cybercrime incident (probably all of them). However, it’s rarely part of the assessment. Again, go back to the purpose – identifying risk. The amount of risk a company has, has a lot to do with how susceptible it’s end-users are to a ruse.
Testing them is one way to uncover weaknesses – such as an email phishing test. In any case, some thought should be given to their current security awareness program, policy (covered below), and security culture.
POLICY: I’ve heard security experts say, all security breaches are the result of some policy not being followed, or not existing. I don’t know if that’s always true, but it does carry some weight.
Most policies are written to satisfy some compliance officer, not guide the daily activities of end-users, who create, use, and store digital assets all day long. Include a review, not only of the written policy, but how it’s used and enforced.
WHAT ABOUT AUDITS: This is not an audit, so don’t treat it like one. Audits are about being compliant (get your compliance offering going with HIPAA here) against some standard or law. They don’t measure risk.
So take time to educate your buyer on the difference. The goal should be to comply with the law, and then make sure things are secure. One does not satisfy the other.
Finally, security can be differently by different people, so just what does it mean to be secure? Or to assess risk?
Having certifications such as the CISSP (ISC2.ORG) or GIAC (SANS.ORG) can go a long way in proving to your buyer that you understand security.
Security engineers are not required to have their PE or Engineering Certificate, or be authorized by a board in the way doctors or lawyers are. While I am not in favor of more big government oversight (like what we’re seeing in the ever-frustrating world of healthcare), pointing to a standard or framework (such as NIST) is powerful when selling.
Most sales people (your competition) are not going to be able to articulate what standards/frameworks (such as NIST) mean. So take some time and educate yourself on what I call, The Wall Street Journal Version of NIST (or whatever standard your firm will follow.) You can check out my recent article on Understanding NIST here. (CLICK).
Do you want to win your next sales opportunity????
Assessments open doors and allow you to prove your value…however,…
Assessing Risk is a business function. Like Disaster Recovery/ Business Impact Analysis (which are really just one of the security disciplines) it is the executive team that needs an understanding of their exposure and impact/likelihood…the odds they’ll suffer a loss.
And this explains why high-end consulting firms like PwC and KPMG have long been welcomed in the board room, while resellers and most hardware manufactures continue to hit the down button when getting on the elevator.
© 2017, David Stelzl
P.S. Get the entire security sales approach here (The House & The Cloud) – the only book out there with a clear methodology for selling high-margin security business.
A couple of weeks ago I wrote about free assessments – an incredibly fast (yet misunderstood) way to create business, when the prospect doesn’t understand their true needs (which seems to be more often than not).
The question is, is there a time to charge? And if so, how much, what scope, where do you start?
In this Part I article, I’ll show you where to begin when creating new business through fee based assessments…
First, it’s important to start where people are, and then take them to where they need to go. In other words, you can’t sell someone what they need, when they don’t yet know their needs. Great marketing starts by understanding the buyer’s desires, and then reframing that prospect’s thinking.
Most larger (fee based) assessment opportunities start with an IT person. If the prospect-company lacks an IT group, they’re probably too small to command a reasonable price for assessing. In that case, I’d go back to FREE ASSESSMENTS and sell them the recurring revenue-managed services & security program. That is what they really need…
When asked to quote an assessment, you might be tempted to jump in and start your discovery; how many firewalls, how many servers, do you want applications assessed too?
This is the wrong approach!!!!
Leading with technical questions, leads to competing on price.
The IT person has something in mind…is it a true risk assessment? Did they call it something else; Pen Test, Vulnerability Assessment, Audit, etc. Do they know the difference? (Probably not).
Establish your contact’s desire first. Ask them…What is it you’re looking for?” And, “WHY do you need it?”
This second question is the more important question (WHY). Expect answers like, “To see if we’re secure,” or “To show our clients we are secure.” You see the problem here?
First, you know that there is no such thing as being “secure”. Second, the assessment is only going to reveal problems this company didn’t know existed. So the idea of certifying your buyer’s infrastructure is a fallacy.
It’s time to reframe (EDUCATE)!!!
Find out where this request is coming from and what’s been done in the past.
Chances are your IT contact doesn’t really know what’s going on. He needs an assessment or pen test, and probably doesn’t know the difference. At this point he’s looking to you for a comparison quote. The last thing you want to do is give him what he’s asking for.
Your IT contact is just a cog in the larger wheel of technology bureaucracy. (Note, if your contact is actually part of a security team, the approach will be different.
I’m specifically talking about IT here – and I started my career in IT, working for two different F500 companies. I’ve seen this from the other side. Don’t over estimate what IT knows about security.
If you simply respond to a bid, or scope out what IT is requesting, the buyer will have nothing to match your price against (in terms of value) other than your competition’s bids and his budget.
Comparison’s against anything other than established need and value are meaningless, and simply lead to price wars.
In every competitive deal there’s at least one guy working out of his garage, offering low-ball prices (and they’re not Steve Jobs or Steve Wozniak). You don’t want the truck-slammers of the world to be the yardstick by which buyers vet your price.
Here’s what happened the last time I worked on a competitive assessment deal…
I was hired by a reseller to work closely with their sales team as a coach/advisor…
(Years ago I had built and led the Security Team for a large global integrator, where we primarily led with assessments – so this call was not new territory).
As expected, our new prospect was looking for an assessment – in his words, a vulnerability assessment. After going through the steps outlined above, we began our reframing process.
First, we asked him, “Do you know what your board is asking your CIO for?” His answer was predictably vague. How would he know?
Next, my client (the reseller) drew the Impact vs. Likelihood Graph on the whiteboard (Page 194 in my book, The House & The Cloud). He began to review the five things board members demand:
Without calling out our competition (never a good thing to do), we began to describe what most vulnerability assessments look like, how they’re approached (something for a future article), and why they aren’t going to satisfy the board’s request.
At that point, my client (the reseller I had been working on the House & Cloud Concepts with) pulled out a sample deliverable (with no intention of leaving it with the prospect) and began to go through the type of deliverable that would make an IT Director a hero…
Deal closed…Well, There’s more to it, but this is just Part I of a predictable assessment sales process designed to front-end big profits and future business.
© David Stelzl, 2017