IT security admins, get to know your known unknowns

Tempting though it may be to ignore little oddities on the network, exercise some initiative in the name of security

Say what you will about Donald Rumsfeld 's defense policies, but  the former Secretary of Defense uttered a series of seemingly conflated nonsensical statements on July 12, 2002, that actually made perfect sense: "There are known knowns. These are things we know that we know. There are known unknowns. That is to say, there are things that we now know we don't know. But there are also unknown unknowns. These are things we do not know we don't know."

As an IT security admin, how well do you know your known unknowns, and do you communicate them to management? Tempting though it may be ignore them, those unknowns can pose serious security risks.

[ InfoWorld Security Adviser Roger Grimes offers other helpful advice for security admins, including "Create a top 10 list of threats at your organization" and "Think strategically and come up with solutions." ]

By known unknowns, I mean those dark spaces that exist at every organization that has more than a very small IT shop: areas of unmanaged networks, unexpected IP addresses, unauthorized wireless access points, weird protocols, and unexplainable network packets. We all know about them. We even know where most of them exist in our networks. We've seen them, wondered about them, and then gone about our daily jobs.

See, it's not like we're getting paid or rewarded to seek out all those little unanswered questions, and while they may have been mentioned to management or co-workers in passing, they didn't well up into enough of a problem to become a project. I think if you spent hours and hours researching them, you would likely find they were innocent misconfigurations and explainable, acceptable phenomena.

But at a few of my clients' shops, I've recently discovered something different. These known unknowns weren't innocent: They were malicious, dedicated backdoor programs allowing corporate espionage to go on unheeded for months and years. The wild thing is that in all these cases, the network and security folks knew and wondered about the strange symptoms -- but no one took it upon himself or herself to investigate further.

And if you have unexplainable activities but ignore them, how can you really measure risk? I can tell you that each of these companies wishes, upon reflection, that they had been more curious.

So what do you do? First, don't ignore your known unknowns. Document that unexplainable stuff. Sniff your network, put up some honeypots, and run some traffic analysis tools. Collect all the weird stuff into a single report and then report it to management. Tell them you don't know what this stuff is and that you're not sure if it should be made a priority project, but give them all the information they'll need to be informed. Let management make the risk decision. But by silently sitting on the "weirdness" and not communicating it better to management, you've just become part of the problem.

Fix or justify all those unexplainable problems, and you'll sleep a little better at night. This is something that we do know.

This story, "IT security admins, get to know your known unknowns," was originally published at InfoWorld.com.