With many of the security incidents that have occurred, customers are now uncertain as to which companies they should trust and which companies they should be concerned about.  One way to overcome this hurdle is to disclose information on a company’s security strategy in order to instill confidence.  

But the question arises – is it in the best interest of a company to reveal security controls?  Or is disclosing this information making the company a target for hackers?  We asked our experts for their thoughts on this issue. 

Vaune Carr, a principal consultant for BT Global Services, expressed her opinion on the topic:

When it comes to disclosing a company’s security defenses, many organizations insist on being secretive.  I happen to agree.  If a company has a need to talk about their security strategy, my suggestion is to be more controlled about any discussion of their specific computing environment as opposed to openly publicizing the information where it can possibly be used against them.  Why?

Well, it is simple, really.  An organization that reveals its specific hardware and software measures to the public or to competitors or to others runs the risk of opening themselves up to attack, or they make it easier than it would have been if an attacker had to guess what was on their end.  In fact, while having a public discussion of its security posture, the company may be unintentionally drawing attention to incomplete controls, literally inviting hackers into their networks.  And for those who are confident in their controls, it seems they are basically daring a criminal to prove them wrong and hack into their systems.  Why put your organization in that position? 

Ultimately, it is not the investment in tools that makes an organization good at security.  What makes ALL the difference is how you manage, monitor and maintain these tools.  But in the end, as you decide with whom you want to discuss how good your organization is at security, just make sure to provide some pertinent metrics. 

Jim Tiller, vice president, Security Professional Services for BT Global Services agrees:

I agree with Vaune.  And it’s worth briefly exploring the pros and cons of sharing security information.  Most enterprises will have standardized, best-practice security controls, such as firewalls, IDS/IPS, and the like – generally very predictable.  Add to this that even entry-level script kiddies can determine the type, software and version of many systems. So it can be argued that you may not be giving away information that can’t be easily discovered surreptitiously.  What we’re really talking about are the details and nuances.

Let’s ask the big question — Are there any advantages of sharing security information? Well, in some ways, yes.  A prominent security challenge is knowing what works and what doesn’t.  By sharing information with others, you can learn from one another and find a more refined and effective balance for your environment.  

Then there is concept of information as a deterrent, which is based on the “path of least resistance” for a threat, assuming that when a potential attacker knows your network is being monitored, for example, they will move on to another, less secure target. Unfortunately, this doesn’t apply to many forms of threats – deterrence in infosec is a gamble at best.  Lastly, a consistent and popular argument is consumer impression.  An online bank that shares details on their security controls to customers may increase customer confidence and loyalty; seemed to work for Bank of America.

What we’re really talking about is that disclosing details about your security controls publicly can play to a hacker’s desire to make an example of you. It’s like poking a dangerous animal — you’re increasing the chances of getting bit.  You better be sure of those controls, because they’ll be tested. In fact, I will go as far to say it’s less about the content of the information and more about the culture of the threat. Tell a hacker you’re secure and, regardless of your security control sophistication, they are attracted to you like a shark to blood – you become something to be conquered.

Therefore, as with all things security, it’s weighing the advantages against the risk and managing information disclosure.  It is well within reason to share certain information at varying degrees of detail with different groups and in different conditions, as long as there is clarity on the value-to-risk ratio you get from doing so.  Nevertheless, being a professional paranoid… my default rule is “loose lips sink ships.”

Weigh in with your thoughts.  Do you believe an organization should share security information or keep it under wraps?