Perimeter
5/2/2012
09:12 AM
Amy DeCarlo
Amy DeCarlo
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Effective Security Policy: Emphasis On Execution

When it comes to mounting a successful defense in what is a fast-changing threat environment, best practices require consistent execution

With the release of each new vendor- or service provider-sponsored cyberthreat report detailing dramatic increases in attack volume and virulence comes an inevitable wave of widespread panic. This immediate alarm gives way soon enough to general resignation that escalating threat levels are inevitable.

The publication of the latest Symantec Internet Security Threat Report is no exception, with stomach-churning statistics such as the fact that 5.5 billion malicious attacks stopped by Symantec alone in 2011 represent an 81 percent increase versus 2010, and that hacking attacks resulted in 187 million personal identities being breached just last year.

But beyond raising the collective blood pressure of IT departments and executives, what purpose do these studies serve if they don't prompt organizations to re-evaluate whether they have adequate protections in place to defend against the current threat environment?

Vendor and service provider-sponsored threat reports yield not only fascinating -- and often scary -- facts, but they can also shed light on where the next threats may be coming from and what type of entities are in the cyberattackers' sights. To this end, the Symantec research found that more than 50 percent of all targeted attacks were leveled against organizations with 2,500 or fewer employees. The same report also pointed to some good news, noting that recent spambot takedowns had cut spam volumes from 88.1 percent of all email in 2010 to 75.1 percent last year.

This kind of information can be helpful in assessing the overall threat landscape and prioritizing defensive efforts. Unfortunately, too often the deer-in-the-headlights effect takes over, and overwhelmed enterprises continue business-as-usual practices when what they really need to do is stop and carefully assess whether their current security posture is adequate.

This process starts with taking a very careful look at current policies to make sure these are aligned with corporate governance and compliance requirements.

There is a long list of policy elements organizations should consider. These components include everything from classifying data and encrypting the most sensitive files, to ensuring consistent and thorough update patching policies, to instituting clear security best practices around Bring Your Own Device (BYOD). Are users allowed to connect directly from enterprise resources from their own mobiles and other computing devices, or will their connections be limited to a guest network? Enterprises also need to address common elements, such as whether and when to allow data to be downloaded to removable peripheral devices.

In defining these policies, IT organizations have to strike a balance between sufficient protective measures and overkill. In other words, effective security relies on organizations to find a way to institute security measures that don’t interfere with performance.

Unfortunately, far too many organizations have well-defined security policies that sit unused in an unopened binder somewhere on a shelf in the IT department. Clearly the best-designed security policies are completely ineffective if they aren't consistently implemented throughout the organization.

Effective security practices start with fundamental communication about what corporate policies are around things like data handling and encryption, and continue with ongoing programs to educate users on things like the potential danger of opening attachments from unknown sources and which websites might harbor malware.

This continuity and vigilance in both communications and implementation is critical to effective security. As we see in so many studies, the nature of the threat environment is always evolving.

Amy Larsen DeCarlo is a principal Analyst, Security and Data Center Services, for Current Analysis

Amy brings 17 years of IT industry experience to her position as Principal Analyst, Security and Data Center Services. Amy assesses the managed IT services sector, with an emphasis on security and data center solutions delivered through the cloud including on demand ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
KKAMINSKI197
50%
50%
KKAMINSKI197,
User Rank: Apprentice
5/2/2012 | 1:37:27 PM
re: Effective Security Policy: Emphasis On Execution
Effective Writing: Putting the Emphasis is on Paragraphs.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2021
Published: 2014-10-24
Cross-site scripting (XSS) vulnerability in admincp/apilog.php in vBulletin 4.4.2 and earlier, and 5.0.x through 5.0.5 allows remote authenticated users to inject arbitrary web script or HTML via a crafted XMLRPC API request, as demonstrated using the client name.

CVE-2014-3604
Published: 2014-10-24
Certificates.java in Not Yet Commons SSL before 0.3.15 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

CVE-2014-6230
Published: 2014-10-24
WP-Ban plugin before 1.6.4 for WordPress, when running in certain configurations, allows remote attackers to bypass the IP blacklist via a crafted X-Forwarded-For header.

CVE-2014-6251
Published: 2014-10-24
Stack-based buffer overflow in CPUMiner before 2.4.1 allows remote attackers to have an unspecified impact by sending a mining.subscribe response with a large nonce2 length, then triggering the overflow with a mining.notify request.

CVE-2014-7180
Published: 2014-10-24
Electric Cloud ElectricCommander before 4.2.6 and 5.x before 5.0.3 uses world-writable permissions for (1) eccert.pl and (2) ecconfigure.pl, which allows local users to execute arbitrary Perl code by modifying these files.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.