{"id":325,"date":"2017-07-24T13:33:49","date_gmt":"2017-07-24T13:33:49","guid":{"rendered":"http:\/\/securitycurve.com\/?p=325"},"modified":"2017-07-24T13:33:49","modified_gmt":"2017-07-24T13:33:49","slug":"new-methods-are-great-not-an-excuse-though","status":"publish","type":"post","link":"https:\/\/securitycurve.com\/?p=325","title":{"rendered":"“New Methods” Are Great. Not an Excuse Though."},"content":{"rendered":"

\"\"<\/a>This morning I came across this article<\/a> over at TechTarget (SearchHealthIT). \u00a0It’s about a healthcare shop in California and their approach to security. \u00a0It’s an interesting read and the gist is that this particular shop, by virtue of their conclusion that “traditional cybersecurity technologies aren’t effective”, is embracing “next gen” tools instead. What are these next gen tools? \u00a0 They say they include microsegmentation and endpoint protection (via Cylance).<\/p>\n

So, the thing I want to point out about this is something that I think is probably obvious to most folks that have been in the field for a while, but that might be a trap for those that haven’t. \u00a0Specifically, that “new methods” is great – and absolutely, I agree with the conclusion that some legacy methods (e.g. perimeter defense, network monitoring, etc.) are less effective nowadays than they used to be. \u00a0That said, getting on the bandwagon of the “new hotness<\/a>” isn’t an excuse to not do the fundamentals.<\/p>\n

The reason I’m calling this out specifically is that, as anybody who has had anything to do with security at an institutional healthcare provider knows, the track record for security in healthcare is… well, let’s call it “suboptimal.” \u00a0So here’s the thing: it’s all good to get on board with new methods. \u00a0I totally support that. \u00a0But not if it’s coming as an excuse to not do the bare minimum blocking and tackling required to keep the shop humming. \u00a0In other words, the position to eschew the past and go full bore on new models is one that I respect, and I think is awesome. \u00a0However, it’s not an excuse to underinvest in controls that you might have failed to implement in years past… \u00a0Note that I’m not implying that’s what this shop is doing. \u00a0Just pointing out that there’s a danger. \u00a0And it’s tempting to cover up sins of the past with a story of “we’re not doing that anyway.”<\/p>\n

The trap comes about if you’re not keeping to a reasonable bar, there’s plenty of opportunity for armchair quarterbacking down the road. \u00a0So don’t do that, k?<\/p>\n","protected":false},"excerpt":{"rendered":"

This morning I came across this article over at TechTarget (SearchHealthIT). \u00a0It’s about a healthcare shop in California and their approach to security. \u00a0It’s an interesting read and the gist is that this particular shop, by virtue of their conclusion that “traditional cybersecurity technologies aren’t effective”, is embracing “next gen” tools instead. What are these […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[4],"tags":[62,63,65],"class_list":["post-325","post","type-post","status-publish","format-standard","hentry","category-security","tag-healthcare","tag-heathit","tag-hit"],"_links":{"self":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/posts\/325","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=325"}],"version-history":[{"count":0,"href":"https:\/\/securitycurve.com\/index.php?rest_route=\/wp\/v2\/posts\/325\/revisions"}],"wp:attachment":[{"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=325"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=325"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securitycurve.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=325"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}