Perimeter
5/2/2012
09:12 AM
Amy DeCarlo
Amy DeCarlo
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Effective Security Policy: Emphasis On Execution

When it comes to mounting a successful defense in what is a fast-changing threat environment, best practices require consistent execution

With the release of each new vendor- or service provider-sponsored cyberthreat report detailing dramatic increases in attack volume and virulence comes an inevitable wave of widespread panic. This immediate alarm gives way soon enough to general resignation that escalating threat levels are inevitable.

The publication of the latest Symantec Internet Security Threat Report is no exception, with stomach-churning statistics such as the fact that 5.5 billion malicious attacks stopped by Symantec alone in 2011 represent an 81 percent increase versus 2010, and that hacking attacks resulted in 187 million personal identities being breached just last year.

But beyond raising the collective blood pressure of IT departments and executives, what purpose do these studies serve if they don't prompt organizations to re-evaluate whether they have adequate protections in place to defend against the current threat environment?

Vendor and service provider-sponsored threat reports yield not only fascinating -- and often scary -- facts, but they can also shed light on where the next threats may be coming from and what type of entities are in the cyberattackers' sights. To this end, the Symantec research found that more than 50 percent of all targeted attacks were leveled against organizations with 2,500 or fewer employees. The same report also pointed to some good news, noting that recent spambot takedowns had cut spam volumes from 88.1 percent of all email in 2010 to 75.1 percent last year.

This kind of information can be helpful in assessing the overall threat landscape and prioritizing defensive efforts. Unfortunately, too often the deer-in-the-headlights effect takes over, and overwhelmed enterprises continue business-as-usual practices when what they really need to do is stop and carefully assess whether their current security posture is adequate.

This process starts with taking a very careful look at current policies to make sure these are aligned with corporate governance and compliance requirements.

There is a long list of policy elements organizations should consider. These components include everything from classifying data and encrypting the most sensitive files, to ensuring consistent and thorough update patching policies, to instituting clear security best practices around Bring Your Own Device (BYOD). Are users allowed to connect directly from enterprise resources from their own mobiles and other computing devices, or will their connections be limited to a guest network? Enterprises also need to address common elements, such as whether and when to allow data to be downloaded to removable peripheral devices.

In defining these policies, IT organizations have to strike a balance between sufficient protective measures and overkill. In other words, effective security relies on organizations to find a way to institute security measures that don’t interfere with performance.

Unfortunately, far too many organizations have well-defined security policies that sit unused in an unopened binder somewhere on a shelf in the IT department. Clearly the best-designed security policies are completely ineffective if they aren't consistently implemented throughout the organization.

Effective security practices start with fundamental communication about what corporate policies are around things like data handling and encryption, and continue with ongoing programs to educate users on things like the potential danger of opening attachments from unknown sources and which websites might harbor malware.

This continuity and vigilance in both communications and implementation is critical to effective security. As we see in so many studies, the nature of the threat environment is always evolving.

Amy Larsen DeCarlo is a principal Analyst, Security and Data Center Services, for Current Analysis

Amy brings 17 years of IT industry experience to her position as Principal Analyst, Security and Data Center Services. Amy assesses the managed IT services sector, with an emphasis on security and data center solutions delivered through the cloud including on demand ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
KKAMINSKI197
50%
50%
KKAMINSKI197,
User Rank: Apprentice
5/2/2012 | 1:37:27 PM
re: Effective Security Policy: Emphasis On Execution
Effective Writing: Putting the Emphasis is on Paragraphs.
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-5242
Published: 2014-10-21
Directory traversal vulnerability in functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the name parameter in a get_template action.

CVE-2012-5243
Published: 2014-10-21
functions/suggest.php in Banana Dance B.2.6 and earlier allows remote attackers to read arbitrary database information via a crafted request.

CVE-2012-5702
Published: 2014-10-21
Multiple cross-site scripting (XSS) vulnerabilities in dotProject before 2.1.7 allow remote attackers to inject arbitrary web script or HTML via the (1) callback parameter in a color_selector action, (2) field parameter in a date_format action, or (3) company_name parameter in an addedit action to i...

CVE-2013-7406
Published: 2014-10-21
SQL injection vulnerability in the MRBS module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-2531
Published: 2014-10-21
SQL injection vulnerability in xhr.php in InterWorx Web Control Panel (aka InterWorx Hosting Control Panel and InterWorx-CP) before 5.0.14 build 577 allows remote authenticated users to execute arbitrary SQL commands via the i parameter in a search action to the (1) NodeWorx , (2) SiteWorx, or (3) R...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.