Perimeter
5/2/2012
09:12 AM
Amy DeCarlo
Amy DeCarlo
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Effective Security Policy: Emphasis On Execution

When it comes to mounting a successful defense in what is a fast-changing threat environment, best practices require consistent execution

With the release of each new vendor- or service provider-sponsored cyberthreat report detailing dramatic increases in attack volume and virulence comes an inevitable wave of widespread panic. This immediate alarm gives way soon enough to general resignation that escalating threat levels are inevitable.

The publication of the latest Symantec Internet Security Threat Report is no exception, with stomach-churning statistics such as the fact that 5.5 billion malicious attacks stopped by Symantec alone in 2011 represent an 81 percent increase versus 2010, and that hacking attacks resulted in 187 million personal identities being breached just last year.

But beyond raising the collective blood pressure of IT departments and executives, what purpose do these studies serve if they don't prompt organizations to re-evaluate whether they have adequate protections in place to defend against the current threat environment?

Vendor and service provider-sponsored threat reports yield not only fascinating -- and often scary -- facts, but they can also shed light on where the next threats may be coming from and what type of entities are in the cyberattackers' sights. To this end, the Symantec research found that more than 50 percent of all targeted attacks were leveled against organizations with 2,500 or fewer employees. The same report also pointed to some good news, noting that recent spambot takedowns had cut spam volumes from 88.1 percent of all email in 2010 to 75.1 percent last year.

This kind of information can be helpful in assessing the overall threat landscape and prioritizing defensive efforts. Unfortunately, too often the deer-in-the-headlights effect takes over, and overwhelmed enterprises continue business-as-usual practices when what they really need to do is stop and carefully assess whether their current security posture is adequate.

This process starts with taking a very careful look at current policies to make sure these are aligned with corporate governance and compliance requirements.

There is a long list of policy elements organizations should consider. These components include everything from classifying data and encrypting the most sensitive files, to ensuring consistent and thorough update patching policies, to instituting clear security best practices around Bring Your Own Device (BYOD). Are users allowed to connect directly from enterprise resources from their own mobiles and other computing devices, or will their connections be limited to a guest network? Enterprises also need to address common elements, such as whether and when to allow data to be downloaded to removable peripheral devices.

In defining these policies, IT organizations have to strike a balance between sufficient protective measures and overkill. In other words, effective security relies on organizations to find a way to institute security measures that don’t interfere with performance.

Unfortunately, far too many organizations have well-defined security policies that sit unused in an unopened binder somewhere on a shelf in the IT department. Clearly the best-designed security policies are completely ineffective if they aren't consistently implemented throughout the organization.

Effective security practices start with fundamental communication about what corporate policies are around things like data handling and encryption, and continue with ongoing programs to educate users on things like the potential danger of opening attachments from unknown sources and which websites might harbor malware.

This continuity and vigilance in both communications and implementation is critical to effective security. As we see in so many studies, the nature of the threat environment is always evolving.

Amy Larsen DeCarlo is a principal Analyst, Security and Data Center Services, for Current Analysis

Amy brings 17 years of IT industry experience to her position as Principal Analyst, Security and Data Center Services. Amy assesses the managed IT services sector, with an emphasis on security and data center solutions delivered through the cloud including on demand ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
KKAMINSKI197
50%
50%
KKAMINSKI197,
User Rank: Apprentice
5/2/2012 | 1:37:27 PM
re: Effective Security Policy: Emphasis On Execution
Effective Writing: Putting the Emphasis is on Paragraphs.
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0972
Published: 2014-08-01
The kgsl graphics driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, does not properly prevent write access to IOMMU context registers, which allows local users to select a custom page table, and consequently write ...

CVE-2014-2627
Published: 2014-08-01
Unspecified vulnerability in HP NonStop NetBatch G06.14 through G06.32.01, H06 through H06.28, and J06 through J06.17.01 allows remote authenticated users to gain privileges for NetBatch job execution via unknown vectors.

CVE-2014-3009
Published: 2014-08-01
The GDS component in IBM InfoSphere Master Data Management - Collaborative Edition 10.0 through 11.0 and InfoSphere Master Data Management Server for Product Information Management 9.0 and 9.1 does not properly handle FRAME elements, which makes it easier for remote authenticated users to conduct ph...

CVE-2014-3302
Published: 2014-08-01
user.php in Cisco WebEx Meetings Server 1.5(.1.131) and earlier does not properly implement the token timer for authenticated encryption, which allows remote attackers to obtain sensitive information via a crafted URL, aka Bug ID CSCuj81708.

CVE-2014-3534
Published: 2014-08-01
arch/s390/kernel/ptrace.c in the Linux kernel before 3.15.8 on the s390 platform does not properly restrict address-space control operations in PTRACE_POKEUSR_AREA requests, which allows local users to obtain read and write access to kernel memory locations, and consequently gain privileges, via a c...

Best of the Web
Dark Reading Radio