Get in Shape

Get in Shape

Seven essentials for enterprise security success

In a year in which some of the biggest names in both physical and logical security have been named and shamed for security lapses and subsequent breaches, reality is bearing down hard on the IT executive. New threats and risks seem to have bombarded enterprise networks at an unrelenting pace. If your organization is one of the many without a comprehensive, multifaceted security program, now is the time to take your head out of the sand. Antivirus programs and firewalls alone no longer cut it. Hackers and malicious insiders long ago figured out that these elementary safeguards are about as effective as a suit of armor made of tissue paper.

Convincing Unbelievers

Unfortunately, it can be difficult to convince the organizations most vulnerable to cybercrime that they even have a problem. The most oblivious among them have no idea that they may already be in the clutches of a hacker because they don’t have the tools or processes in place to properly investigate the anomalies in system and network behavior that raise red flags.

While there certainly are many moving parts in any comprehensive IT security program, everything ultimately boils down to visibility and control. Organizations need to see who or what is accessing their data and be able to limit access based on each user’s role within the IT ecosystem. IT staff need to keep tabs on system configurations and patch levels to limit inappropriate access and service disruptions. And organizations need to be able to look into system logs to spot anomalies and stop attacks before a great deal of damage is done.

Every enterprise is different, and the severity of risk always depends on individual circumstances. But in my more than 30 years of experience as a security professional, I believe a solid enterprise security framework incorporates the following seven fundamentals.

Endpoint Management

As the consumerization of IT continues to push a wide diversity of devices onto many enterprise networks, security professionals now face greater difficulties protecting their networks from the risks that each new gadget can impose. It is time to stop ignoring these issues and start analyzing how much of a threat these different classes of devices pose to your network. It is time to create and then enforce policies that effectively balance user productivity and risk. More importantly, regardless of whether devices are owned by your business or by your end users, they should meet a minimum standard of secure configuration before they connect to your network. This means patch levels must be up to date, unique passwords set for every application and function on those machines, and anti-malware installed.

The devil is in the details, but the overall goal is to ensure that, if hackers do compromise a machine, it is configured in such a way that it cannot become a launch pad for attacks deep into your network. This also means making sure there are no common privileged credentials in embedded applications waiting to be exploited. For example, if a backup task image is installed on every network device that has a common privileged identity attached to it and a hacker compromises that device and finds that password, the hacker has a meal ticket into future network exploits. Be careful of that.

Shared Passwords

Shared administrative passwords are a dirty little secret in the IT community. Many IT administrators avoid creating unique IDs for the privileged users who control the systems and applications on their networks—and fail to change the account passwords frequently—because the work is tedious and takes time away from higher-visibility tasks. However, shared logins can make it impossible to determine a chain of custody on highly privileged accounts, and thus they create an attractive target for hackers sniffing around the network for vulnerabilities. Similarly, it should be a top priority to secure application accounts that use default or common passwords. These accounts are ripe for misuse should a malicious insider or an outside attacker gain access to one of these passwords, since they’ll be accessing data that likely includes sensitive information about your customers and employees.

Log Management and SIEM

Speaking of log management, are logging capabilities turned on for all the different devices on your network? Many times I see organizations falter in this critical regard. In doing so, they fail to gain valuable insight into user and system behavior. Even when logging is enabled, many organizations lack the tools and practices to turn the deluge of data into actionable information. Log management and security information and event management (SIEM) solutions are an essential part of an effective IT security program. These tools are the first line of defense to help IT departments flag nefarious behavior, stop it in its tracks and eventually determine who is responsible. But these technologies can take a great deal of skill and expertise to operate properly. So each organization needs to invest not only in the tools but also in the training to use them. What’s more, you’ll need to make the supporting investments to ensure that the data is useable. If you spend a lot of money on an SIEM solution but then there is no effective identity management system in place supplying the data about who is responsible for security events, it makes that log data a lot less valuable to the organization.

Account Management

When an employee leaves your company or loses a device, do you know which credentials may have been compromised in the process? Without some way to keep track of all of these accounts it’s almost certain that they’ll be misused. Far too many enterprises are cavalier about the process of provisioning and deprovisioning accounts. Even if an organization manages to eradicate shared passwords, if they fail to shut down accounts once they’ve expired, bad things happen. For example, serious risks could arise from a disgruntled former employee who is still able to access the accounting system because no one bothered to shut down his account once he left the company. Or consider the possibility of a current employee who uses a former coworker’s credentials to steal data undetected because the ex-employee’s account stays active. Or if a device with stored passwords is lost and nothing is reset, an outside attacker will gladly take advantage of that opening.

Controlling Access to Data

Even with sound account and password management practices in place, malicious insiders or hackers who gain control of an account with access to too much data can still do a lot of damage. Organizations need to think carefully about how much data individual users can access through their accounts. Ideally, enterprises should implement role-based access so that users touch only the data necessary to get their jobs done.

And even when that practice is in place, it is probably a good idea to limit the volume of accessible data to prevent large scale exfiltration of information through e-mail, USB or screen-scrape dumps. An employee may need to view dozens of customer records each day, but does he really need access to, say, hundreds or thousands? It is of the utmost importance to implement data loss prevention (DLP) controls to help determine how much data should be accessed in any timeframe, thereby helping prevent someone from sending large amounts of sensitive information out the door.

Data Visibility Outside The Corporate Walls

If you are using DLP but then turn around and willingly ship a datacenter full of sensitive information to an outsourced or cloud provider, you’ve just wasted your money. The money you’ll save in the cloud will be squandered once that external infrastructure is breached and you have no way of investigating what went wrong—because most cloud service providers have no concept of DLP and other critical controls.

Enterprises really need to think critically about what they’re getting into when they send information outside the corporate walls. If a data store is too valuable to lose, then it probably isn’t a good idea to let an outside organization with unproven or perhaps nonexistent security controls take command of that information.

Centralization Could Kill You

For the last ten years, companies have been de-siloing applications and data storage, putting everything into giant databases so that anyone can get any information they might need. It’s mighty handy for the IT department and corporate users, but it also creates a huge target of opportunity for data thieves.

The fundamental danger really comes down to a simple rule: If your sensitive business data is in one place, you’re in big trouble if someone breaks into that system.

No need to stop de-siloing applications and streamlining operations. The more centralized your information, the more critical it is to implement solid database security and access management practices. IT executives need to start asking themselves what can be accessed from where, and how much of that access can be limited. Which IP addresses are allowed? What time of day is access permitted? How are users or devices authenticated? Is multifactor authentication needed to add another layer of security? All of these considerations become more important as your data becomes more consolidated.

The more organizations start to focus on these seven essential factors, the greater their chances of avoiding costly security breaches or at least limiting the potential damage when incidents do occur. These fundamentals are all about bringing greater visibility and control to the IT infrastructure. Fail to take control and it becomes not a question of if your organization will be breached, but when.

This article originally appeared in the October 2011 issue of Security Today.


  • Cloud Adoption Gives Way to Hybrid Deployments

    Cloud adoption is growing at an astonishing rate, with Gartner forecasting that worldwide public cloud end-user spending will approach $600 billion by the end of this year—an increase of more than 21% over 2022. McKinsey believes that number could eclipse $1 trillion by the end of the decade, further underscoring the industry’s exponential growth. Read Now

  • AI on the Edge

    Discussions about the merits (or misgivings) around AI (artificial intelligence) are everywhere. In fact, you’d be hard-pressed to find an article or product literature without mention of it in our industry. If you’re not using AI by now in some capacity, congratulations may be in order since most people are using it in some form daily even without realizing it. Read Now

  • Securing the Future

    In an increasingly turbulent world, chief security officers (CSOs) are facing a multitude of challenges that threaten the stability of businesses worldwide. Read Now

    • Guard Services
  • Report: Physical Security Market Turning to Cloud and Hybrid Solutions

    Genetec, a provider of unified security, public safety, operations, and business intelligence solutions, today shared the results of its 2024 State of Physical Security report. Based on insights from over 5,500 physical security leaders worldwide (including end users and channel partners), the report looks at the security strategies organizations are putting in place to effectively navigate the realities of a changing industry. Read Now

Featured Cybersecurity

New Products

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles. 3

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction. 3

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.” 3