Critical Lessons For CISOs From The Suez Canal Debacle

The Suez Canal can easily be said to be the biggest Bottle-Neck of the world ,of this century. I am an armchair nautical enthusiast and let me start on a lighter note by saying that; One can only so far with respect to risk management, allow me to present an average board presentation on that is unduly panicked due to the Suez Canal / Ever Given situation.

“Both probabilities exist in moderation, at a later point in time; all water bodies will dry up, or all land masses will be submerged eventually – hence the situation must be monitored using a competent third party and either flying or submersible cargo boats must be invested in. A detailed study on feasibility on both of them must be undertaken ASAP.”

Haste and panic always takes away attention from the real causes of the threat, and draws everyone in the room to what seems to the lowest-hanging-wrongest-fruit (waiting it out / buying a the latest technology). Practically very few companies out any thought on alternate supply chains or alternate drop points.

Intentional Bottle-Necking

I say “Intentional” because often CISOs shoot themselves in the foot, myself included. These bottlenecks are introduced mainly due to 3 reasons (a) Rush to evaluate & implement the latest technology (b) Poor attention to legacy and inter-connect and (c) Destruction of security design.

Let us look at some illustrations of some of these. Poorly or partially implemented technologies such as “Data encryption / Rights Management” are perfect examples of bottlenecks. I say this with confidence, implementation of these technologies is user-driven and exhausting. Don’t get me wrong – They are wonderful & effective. However, to reap the full (read as, actual) benefits of such a technology you need you have it working right from your endpoints, servers, 3rd parties, APIs, require complaint / complementary software (at all ends of the supply chain). Not to mention, it takes more than just an “security aware” staff to operate in such an environment. When launching yourself or your organisation at such an endeavour you are easily looking at at project of nearly year plus. The abandonment rates of such projects are enormous; they rarely successfully conclude.

Data encryption and rights management (just like so many other security controls) are vitals aspects of information security, and furthermore of information privacy – But they need to be addressed appropriately. Identity and access management are other examples such implementations that are well-known to create security design lacunae and bottlenecks. Investments made fixing the lacunae often supersede the cost the products. These implementations can NOT come at the cost destruction of smoothly functioning legacy, building custom connecting connectors, customizing 3rd party applications or voiding warranties and eventually introducing new holes in the security design. Thus, avoiding the crucial bottleneck.

High-Dependency & The Hunt for the Enigmatic Silver Bullet / Automation, Orchestration, AI, ML

The Suez Canal was always “Too big to fail” – It was treated like the Achilles Heel by the entire shipping industry; and for good reason – They had no other viable profitable options.

Automation, Orchestration, AI – ML enabled security systems make very high promises that easily lure that best CISOs. The trust of the matter is very different though. When you break-down these systems in isolation these on-line promises are technically (a) reduction of manpower (b) reduction of security devices (c) reduction security complexity and (d) Infinite learning of capabilities of newer attack techniques (e) Net. Improvement of security posture & longevity of security investment

It is rather depressing that despite aggressive marketing and sky-high promises made very little of the above promises are actually accomplished. Experienced CISOs when candidly questioned will actually confess that such Silver Bullets cause (A) Increase the cost and need for more sophisted manpower (B) Automation / Orchestration systems add tremendous compute overheads. They require connectors for systems which are (according to them) non-standard (C) There is NO way complexity goes DOWN, a traditional 3 tier inside-out architecture with an MSSP, changes tremendously. (D) Security is NOT an finit problem and ML solutions can NOT solve them; if they could – It would have been the end of several security soutions a long while back. MITRE frameworks suck ATT&CK are testimony to ever evolution of attacks. (E) Simple answer. No. You invited unjustified, and unstudied complexity in your life – You pay the price.

The silver bullet is indeed enigmatic – And many have fallen in deep rabbit holes. If the Suez Canal teaches some impart lessons they are –

Too Much Stability is NOT a good thing

Focus of Long Term Risk Management

Plans B & C are NOT good enough

Mr. Dhananjay Rokde