Barracuda wrongly thought it drove 0-day hackers out of customers’ networks(arstechnica.com)
arstechnica.com
Barracuda wrongly thought it drove 0-day hackers out of customers’ networks
https://arstechnica.com/security/2023/08/barracuda-thought-it-drove-0-day-hackers-out-of-customers-networks-it-was-wrong/
5 comments
27001 doesn’t actually explicitly dictate anything other than the structure and operation of the ISMS itself.
The selection of appropriate security controls to implement is made on the basis of a risk assessment, and although the standard security controls which you are compelled to consider are explicitly listed in appendix A, the actual fine grained implementation of them is not prescribed at all.
There’s nothing stopping you implementing something better than the now slightly outdated recommendations/best practice for those controls found in 27002. It is guidance only, and if you have good reason to implement a control in a different way, or to not implement a control that is listed but instead treat a risk with an entirely different control you are free to do that.
That’s not to say that 27001 doesn’t have other flaws, and that it isn’t sold/understood as being something it’s not in a problematic way.
There’s nothing stopping you implementing something better than the now slightly outdated recommendations/best practice for those controls found in 27002. It is guidance only, and if you have good reason to implement a control in a different way, or to not implement a control that is listed but instead treat a risk with an entirely different control you are free to do that.
That’s not to say that 27001 doesn’t have other flaws, and that it isn’t sold/understood as being something it’s not in a problematic way.
I have highlighted numerous security flaws in my organization — e.g., forced password changes every 60 days, resulting in many employees using simple passwords — which I've been told were the result of certifications or regulations.
It seems like a quintessential example of "the road to hell is paved with good intentions". Either the prescribed solutions are bad, or the drive to check off boxes in an audit results in shallow implementations that appear to do something but don't actually.
It seems like a quintessential example of "the road to hell is paved with good intentions". Either the prescribed solutions are bad, or the drive to check off boxes in an audit results in shallow implementations that appear to do something but don't actually.
There aren't many certifications (or any) where passwords are all required to be rotated every 60 days. Heck, NIST even changed their guidance on this to be more nuanced. As an information security auditor I certainly don't recommend people change passwords on a set basis, we used to but the thought process has completely changed.
But I appreciate that the password example wasn't the point of your comment. Organisations will often default to a certification and/or standard blindly because they don't have the knowledge of how to do it differently themselves, or they don't want to be on the hook for choosing to deviate from a standard and be bitten.
Realistically security teams should be able to go above and beyond the strength of these certifications. In any case, ISO 27001 isn't really that great of a cert, it is only smaller less mature organisations that flash ISO 27001 as anything worth seeing.
Spot on at the end there
But I appreciate that the password example wasn't the point of your comment. Organisations will often default to a certification and/or standard blindly because they don't have the knowledge of how to do it differently themselves, or they don't want to be on the hook for choosing to deviate from a standard and be bitten.
Realistically security teams should be able to go above and beyond the strength of these certifications. In any case, ISO 27001 isn't really that great of a cert, it is only smaller less mature organisations that flash ISO 27001 as anything worth seeing.
Spot on at the end there
Sure in theory you could use a more decentralized solution but often there are no COTS solutions for this and making your own would require it to be certified, so that's not feasible. In some options you might even be better of with not deploying such a single point of failure. However for certifications that's often not an option.