The Power of One

Employing a layered security solution from a single vendor enhances synergy among systems

• By Steven Duncan
• Aug 17, 2007

ORGANIZATIONS are under attack, not from competitors, federal regulations or consumer outrage, although those are concerns. But enterprises—and subsequently their client base—have become targets.

To leverage security as a valuable tool rather than a hindrance, organizations must implement a strong, layered enterprise security strategy that fits specific business needs. This strategy, comprised of several distinct layers, can be hindered by numerous vendors and an abundance of different, sometimes incompatible, security solutions and products. However, seeking an entire layered security solution from a single vendor creates a vital synergy that promotes interoperability, efficiency and cost-effectiveness.

Knowing Who's Who
Employees, executives and business associates are demanding more access to information—anywhere and at any time. However, weak password-based authentication to critical enterprise resources leaves networks and data exposed to unnecessary risk and is often not in compliance with corporate and regulatory policies.

A strong, multi-factor authentication solution is the smart, efficient approach to satisfying the first level of a layered enterprise security solution. Multi-factor authentication is a proven strategy that employs higher or multiple levels of authentication (e.g., grid cards, hardware tokens, knowledge challenges and out-of-band authentication), commonly when the sensitivity of the requested information increases.

Data Lockdown
The threat of a data breach or an organization's intellectual property being stolen has moved many institutions to deploy disk security and encryption solutions. These safeguards typically encrypt entire hard drives, files, USB drives or any type of removable media that could contain sensitive data.

Once the data is encrypted, a user has to have access to an authorized digital certificate to access the contents. This process is typically automatic and does not affect the efficiency of the end user. The solution should provide ease of use by enabling users to automatically encrypt data stored on laptops and desktops, with little impact on normal behavior or the performance of user PCs.

Furthermore, disk security solutions help enable compliance and information security requirements set out by regulations such as Sarbanes-Oxley, Gramm-Leach Bliley, HIPAA and EU Directive 95/46/EC.

A strong media encryption tool also can lower total security costs by providing centralized administration for creating, deploying, managing and updating corporate laptop and desktop security policies.

Remote Access Reassurance
As the mobile workforce continues to be a staple of the modern-day business world, enterprises are faced with additional challenges in not only providing remote access via laptops and PDAs, but also securing and authenticating workers who use the technology.

Remote access authentication is typically a mid-level step in a layered enterprise security approach. At this stage, the security of virtual private networks is central to network integrity. VPNs allow an organization to easily build, manage and operate low-cost private networks using the Internet to connect mobile and remote workers, remote offices and branch offices more efficiently.

VPNs provide a door from the Internet into the corporate network and all its resources. The security of the network is only as strong as the method used to identify the users or devices at each end of the VPN communication. Most corporations have this capability, but VPNs typically just require a username and password. A smart security solution provides the necessary safeguards to protect valuable resources and information. Common authentication methods include digital certificates, grid cards, hardware tokens and knowledge-based solutions.

Encrypting and Enabling
While common security risks such as identity theft and online fraud are highly important, enterprises also need solutions to secure and encrypt important files and folders, protect intellectual property and promote the sharing of information throughout an organization.

It's no secret that intellectual property is the livelihood of any business. Protecting its value is paramount, especially when considering the manner in which technology makes it easier to access, view, manipulate, modify and transfer information. The compromise of trade secrets, proprietary information and customer data could result in the loss of a company's competitive advantage.

Products on the market today attempt to solve these problems, but they don't provide the necessary protection without adding additional management inconveniences. The majority of corporations leverage networks as the primary means of collaborating. Past offerings have been difficult to manage, didn't offer audit capabilities, resulted in high training costs for administrators and did not provide persistent encryption—a method in which files or folders remain encrypted no matter where they are stored. They also couldn't provide an audit trail.

Implementing a robust network folder encryption solution can secure this information, as well as ease the concerns of clients, customers, stakeholders, vendors and third parties. The solution should be automatic, transparent and persistent and provide advanced audit capabilities.

E-mail Security
Despite the methods used by previous layers to protect information, users often need to send the content, no matter how routine or sensitive, via e-mail. This step exists to safeguard the transmission of this information—internally and externally—and ensure the efforts of the previous layers remain intact.

The challenge with e-mail communication is that it relies on the user to be responsible for determining how to send it—whether sensitive or not—and make the decision on whether to encrypt the contents. Another issue is whether the recipient is inside or outside the organizations and if they have the proper credentials to view the encrypted message.

In the majority of organizations, internal e-mails do not require encryption. E-mail encryption becomes more important when the message has to leave the protection of the corporate firewall. A strong e-mail encryption solution makes it possible to automatically encrypt e-mail before it is delivered to external recipients without requiring any additional desktop software or end-user action.

Having Control
The final stage in protecting information and identities looks for solutions aimed at monitoring the actual content that leaves the organization. Content control, coupled with policy-based encryption, is a vital step in a layered approach.

Whether or not outbound communication channels—e-mail, file transfer protocols, instant message, HTTP—are encrypted is determined by the solution. Advanced scanning capabilities can examine the full content of a message and determine the level of risk in the communications. Based on the results, the solution will act appropriately (i.e., block, redirect or encrypt content).

The proper solution can integrate with content monitoring and control technology to provide content encryption that is identified as sensitive by the content control software. The solution should enable encryption to be applied to sensitive messages both in transit through a variety of communication channels and while at rest in user inboxes, on hard drives or on mail servers.

Thinking Forward
At one point, enterprise security was an aspect of a corporation that was often kept secret. Fears of public backlash and damage to brand reputation often moved organizations to make the information regarding their security approach private.

Today, organizations that address security concerns are seen as consumer-minded, forward-thinking entities. This group understands the value of protecting proprietary information and enabling safe, efficient communication with employees, customers, third parties, partners and vendors.

Building a layered security strategy with multiple vendors can be more expensive, is often difficult to deploy and lacks the “connection points” of a well-integrated solution. For example, powerful content control is made stronger by integrating automatic e-mail encryption, which in turn is made stronger by integrating multi-factor authentication for access.

Opting for a layered strategy from a single vendor promotes synergy—a cooperative interaction that will enable organizations to realize a security strategy that features seamless interoperability, efficiency and cost-effectiveness.