Get in Shape

Get in Shape

Seven essentials for enterprise security success

In a year in which some of the biggest names in both physical and logical security have been named and shamed for security lapses and subsequent breaches, reality is bearing down hard on the IT executive. New threats and risks seem to have bombarded enterprise networks at an unrelenting pace. If your organization is one of the many without a comprehensive, multifaceted security program, now is the time to take your head out of the sand. Antivirus programs and firewalls alone no longer cut it. Hackers and malicious insiders long ago figured out that these elementary safeguards are about as effective as a suit of armor made of tissue paper.

Convincing Unbelievers

Unfortunately, it can be difficult to convince the organizations most vulnerable to cybercrime that they even have a problem. The most oblivious among them have no idea that they may already be in the clutches of a hacker because they don’t have the tools or processes in place to properly investigate the anomalies in system and network behavior that raise red flags.

While there certainly are many moving parts in any comprehensive IT security program, everything ultimately boils down to visibility and control. Organizations need to see who or what is accessing their data and be able to limit access based on each user’s role within the IT ecosystem. IT staff need to keep tabs on system configurations and patch levels to limit inappropriate access and service disruptions. And organizations need to be able to look into system logs to spot anomalies and stop attacks before a great deal of damage is done.

Every enterprise is different, and the severity of risk always depends on individual circumstances. But in my more than 30 years of experience as a security professional, I believe a solid enterprise security framework incorporates the following seven fundamentals.

Endpoint Management

As the consumerization of IT continues to push a wide diversity of devices onto many enterprise networks, security professionals now face greater difficulties protecting their networks from the risks that each new gadget can impose. It is time to stop ignoring these issues and start analyzing how much of a threat these different classes of devices pose to your network. It is time to create and then enforce policies that effectively balance user productivity and risk. More importantly, regardless of whether devices are owned by your business or by your end users, they should meet a minimum standard of secure configuration before they connect to your network. This means patch levels must be up to date, unique passwords set for every application and function on those machines, and anti-malware installed.

The devil is in the details, but the overall goal is to ensure that, if hackers do compromise a machine, it is configured in such a way that it cannot become a launch pad for attacks deep into your network. This also means making sure there are no common privileged credentials in embedded applications waiting to be exploited. For example, if a backup task image is installed on every network device that has a common privileged identity attached to it and a hacker compromises that device and finds that password, the hacker has a meal ticket into future network exploits. Be careful of that.

Shared Passwords

Shared administrative passwords are a dirty little secret in the IT community. Many IT administrators avoid creating unique IDs for the privileged users who control the systems and applications on their networks—and fail to change the account passwords frequently—because the work is tedious and takes time away from higher-visibility tasks. However, shared logins can make it impossible to determine a chain of custody on highly privileged accounts, and thus they create an attractive target for hackers sniffing around the network for vulnerabilities. Similarly, it should be a top priority to secure application accounts that use default or common passwords. These accounts are ripe for misuse should a malicious insider or an outside attacker gain access to one of these passwords, since they’ll be accessing data that likely includes sensitive information about your customers and employees.

Log Management and SIEM

Speaking of log management, are logging capabilities turned on for all the different devices on your network? Many times I see organizations falter in this critical regard. In doing so, they fail to gain valuable insight into user and system behavior. Even when logging is enabled, many organizations lack the tools and practices to turn the deluge of data into actionable information. Log management and security information and event management (SIEM) solutions are an essential part of an effective IT security program. These tools are the first line of defense to help IT departments flag nefarious behavior, stop it in its tracks and eventually determine who is responsible. But these technologies can take a great deal of skill and expertise to operate properly. So each organization needs to invest not only in the tools but also in the training to use them. What’s more, you’ll need to make the supporting investments to ensure that the data is useable. If you spend a lot of money on an SIEM solution but then there is no effective identity management system in place supplying the data about who is responsible for security events, it makes that log data a lot less valuable to the organization.

Account Management

When an employee leaves your company or loses a device, do you know which credentials may have been compromised in the process? Without some way to keep track of all of these accounts it’s almost certain that they’ll be misused. Far too many enterprises are cavalier about the process of provisioning and deprovisioning accounts. Even if an organization manages to eradicate shared passwords, if they fail to shut down accounts once they’ve expired, bad things happen. For example, serious risks could arise from a disgruntled former employee who is still able to access the accounting system because no one bothered to shut down his account once he left the company. Or consider the possibility of a current employee who uses a former coworker’s credentials to steal data undetected because the ex-employee’s account stays active. Or if a device with stored passwords is lost and nothing is reset, an outside attacker will gladly take advantage of that opening.

Controlling Access to Data

Even with sound account and password management practices in place, malicious insiders or hackers who gain control of an account with access to too much data can still do a lot of damage. Organizations need to think carefully about how much data individual users can access through their accounts. Ideally, enterprises should implement role-based access so that users touch only the data necessary to get their jobs done.

And even when that practice is in place, it is probably a good idea to limit the volume of accessible data to prevent large scale exfiltration of information through e-mail, USB or screen-scrape dumps. An employee may need to view dozens of customer records each day, but does he really need access to, say, hundreds or thousands? It is of the utmost importance to implement data loss prevention (DLP) controls to help determine how much data should be accessed in any timeframe, thereby helping prevent someone from sending large amounts of sensitive information out the door.

Data Visibility Outside The Corporate Walls

If you are using DLP but then turn around and willingly ship a datacenter full of sensitive information to an outsourced or cloud provider, you’ve just wasted your money. The money you’ll save in the cloud will be squandered once that external infrastructure is breached and you have no way of investigating what went wrong—because most cloud service providers have no concept of DLP and other critical controls.

Enterprises really need to think critically about what they’re getting into when they send information outside the corporate walls. If a data store is too valuable to lose, then it probably isn’t a good idea to let an outside organization with unproven or perhaps nonexistent security controls take command of that information.

Centralization Could Kill You

For the last ten years, companies have been de-siloing applications and data storage, putting everything into giant databases so that anyone can get any information they might need. It’s mighty handy for the IT department and corporate users, but it also creates a huge target of opportunity for data thieves.

The fundamental danger really comes down to a simple rule: If your sensitive business data is in one place, you’re in big trouble if someone breaks into that system.

No need to stop de-siloing applications and streamlining operations. The more centralized your information, the more critical it is to implement solid database security and access management practices. IT executives need to start asking themselves what can be accessed from where, and how much of that access can be limited. Which IP addresses are allowed? What time of day is access permitted? How are users or devices authenticated? Is multifactor authentication needed to add another layer of security? All of these considerations become more important as your data becomes more consolidated.

The more organizations start to focus on these seven essential factors, the greater their chances of avoiding costly security breaches or at least limiting the potential damage when incidents do occur. These fundamentals are all about bringing greater visibility and control to the IT infrastructure. Fail to take control and it becomes not a question of if your organization will be breached, but when.

This article originally appeared in the October 2011 issue of Security Today.

Featured

  • Maximizing Your Security Budget This Year

    The Importance of Proactive Security Measures: 4 Stories of Regret

    We all want to believe that crime won’t happen to us. So, some business owners hope for the best and put proactive security measures on the back burner, because other things like growth, attracting new customers, and meeting deadlines all seem more pressing. Read Now

  • 91 Percent of Security Leaders Believe AI Set to Outpace Security Teams

    Bugcrowd recently released its “Inside the Mind of a CISO” report, which surveyed hundreds of security leaders around the globe to uncover their perception on AI threats, their top priorities and evolving roles, and common myths directed towards the CISO. Among the findings, 1 in 3 respondents (33%) believed that at least half of companies are willing to sacrifice their customers’ long-term privacy or security to save money. Read Now

  • Milestone Announces Merger With Arcules

    Global video technology company Milestone Systems is pleased to announce that effective July 1, 2024, it will merge with the cloud-based video surveillance solutions provider, Arcules. Read Now

  • Organizations Struggle with Outdated Security Approaches, While Online Threats Increase

    Cloudflare Inc, recently published its State of Application Security 2024 Report. Findings from this year's report reveal that security teams are struggling to keep pace with the risks posed by organizations’ dependency on modern applications—the technology that underpins all of today’s most used sites. The report underscores that the volume of threats stemming from issues in the software supply chain, increasing number of distributed denial of service (DDoS) attacks and malicious bots, often exceed the resources of dedicated application security teams. Read Now

Featured Cybersecurity

Webinars

New Products

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction. 3