Kevin Mandia | IT security and the law

When it comes to electronic discovery in investigations, finding the right information can be time-consuming and detrimental to the organization being investigated. Kevin Mandia, president and chief executive officer of Mandiant, is familiar with the process. Mandiant is an information security company that provides professional services, education and incident-response management software to corporations, law firms, financial institutions and government agencies. Mandiant has offices in the Washington area and New York City. We spoke with Mandia to get his views on e-discovery, the recent events in Estonia and what the new threats are in network security. I have been involved in computer security since 1993, so it has been the focus of my entire career. After 10 years in the industry, I started my own organization because, wherever I was hired, it was to set up an information security practice. So I decided the next step was to start my own organization rather than build something for someone else. I also wanted to bring the team together and work with folks I had known for 10 years or more. I started the company in February of 2004, and we are currently at approximately 50 employees.There are a lot of ways to answer that question, but I think the current largest challenge is handling the decentralization of security. Right now, most of the incidents we are responding to impact and affect the end-user systems. With the maturation of patch management and vulnerability management technologies, Internet-facing systems seem much less vulnerable to attacks than years ago. Also, with Web application security tools, Web apps seem to be more hardened. Therefore, security breaches have evolved into an end-user problem. So the challenge is securing the end-user systems ' which involves some good security awareness training and policies. Attackers definitely target the soft areas of a network. With most preventative technologies being applied to secure the perimeter of networks, attackers are using spam and e-mail vectors to attack systems. Also, as long as safe harbors exist around the world, attacks will continue. I think for what we do it is electronic-evidence discovery. There is a strong need for organizations to be able to quickly and efficiently collect electronic evidence in response to potential litigation. The obligation to preserve and ultimately produce electronic documents can be a very expensive proposition, and we intend to make the entire process much simpler. When it comes to incident response, it is my experience that the government will fund research and development efforts ' and also tolerate a more in-depth investigation into what actually happened. The private sector seems more intent on stopping the bleeding. They are not as accommodating to lengthy or in-depth analyses. If we send a team of consultants into the field to respond to a corporate computer security incident, I always say, 'If they're not back in seven days, then we are doing something wrong.' First I would ask the nontechnical question, 'Where is the money going?' Because where the money goes, the attacks follow. I would imagine if people start using mobile devices for online banking and credit transactions, then mobile devices may be the next target. I'm not too familiar with it, other than browsing a couple of articles. I read somewhere that 49 percent of the folks interviewed in Estonia felt impacted by the incident. That's a pretty big number. The attacks seem similar to the CNN and Yahoo [distributed denial-of-service] attacks back in 2000. If NATO responds, I guess they might as well have a bunch of firewalls with NATO stamped on them. I really do not know what sort ofresponse NATO can provide other than some hardening technologies. I don't think it merits a military response ' at least not one involving explosive ordnance. We make special tools for special people, as well as special tools for special-use cases. We have 15 or 20 consultants with a top-secret clearance, and they get to do some interesting R&D. It's mostly information security R&D, but sometimes it is computer forensics-type tools as well. I think there is always a lag between the advances in technology and their eventual adoption. The legal community adds an additional time span to adopting new technologies. There is a great need for organizations to have the ability to search data at rest wherever it happens to be, and in a way that is not too cumbersome. Right now, a company might come in and shut down 40 computers to mirror hard drives, and [electronic-evidence discovery] firms exist that do nothing more than cull data and minimize data and put it into a form for review.These types of business practices cost a lot of money and can severely impact a company's operations. I think the ability to search data at rest in a live environment, solely collecting the responsive materials, is where the EED market needs to go. It is probably easier to answer what is getting people's attention. I believe identity management is going to make unauthorized access much more difficult ' so I feel ID management technologies are getting some good attention.I guess to answer this question best, I need to put on the chief information security officer hat. I think CISOs are most concerned with knowing where'the data that matters [is]. They want to find that data, and they want to evaluate which information is the most important and be sure that it is protected. Build a moat around the crown jewels. I do not want to jump on the data leakage bandwagon, but I think CISOs are really concerned about knowing where all the important data is.