Make detailed incident reports public, Chief Information Security Officers told

Trey Ford

When there’s a serious aircraft accident in the United States, the National Transportation Safety Board investigates and issues an exhaustive public report and recommendations to the aviation industry.

By contrast, details about high-profile data breaches — think Target, Home Depot, Sony  — are closely held, or smothered in leaks and speculation, with organizations reluctant to divulge what really happened for fear of lawsuits or damage to their brands.

But the aviation model is what infosec pros should strive for to improve IT security, Trey Ford, a private pilot and global security strategist at incident response firm Rapid7 told the SecTor conference in Toronto on Wednesday.

Public reporting would spread knowledge, increase public confidence in IT security and improve the infosec profession, he argued.

In the early years of aviation “when a plane crashed… (pilots) worked together to forward the profession. Their failures, their lessons learned weren’t  kept secret, they were shared.”

Similarly infosec pros have to learn to share de-personalized threat and incident information if the IT industry is ever going to get ahead of attackers, he said.

Read more: http://www.itworldcanada.com