Security: It’s Everyone’s Business!
Keith Yorkston · 2019
Security isn’t only a bit of software that can be bought, installed and forgotten with the occasional upgrade thrown in. Security isn’t only that set of password rules we are supposed to follow. Security isn’t only that locked filing cabinet, or a guard and a scan card reader at the front door. It includes all those things, and many, many more. We all need to think about security differently. Every organisation has thousands of vulnerabilities—weaknesses that could be exploited by a malicious attacker. And, as a malicious attacker, I only need to find one vulnerability to exploit. It could be a helpful staff member holding the door open for a “fellow smoker”, or a person in Finance who believed that last phone call asking them to process “that important invoice”. It might be an open comms port on the production web server, or the unpatched server in the test environment. Or it could be the report listing last week’s customer contacts that is mailed to the sales staff each Monday (including the sales staff who have left the organisation). I mention these because my colleagues and I have used all these techniques (and many more) to test organisations. We are security testers.