Large Businesses Wrestle With Web 2.0

New capabilities turn security policies and practices on end, panelists say

3 Min Read
Dark Reading logo in a gray background | Dark Reading

LAS VEGAS -- Interop 2008 -- If you have any doubts as to whether Web 2.0 technology is changing the nature of security in large organizations, we've got a couple of Garys for you.

Gary Hodge, executitve vice president at CTO at U.S. Bank, and Gary Dobbins, director of information security at the University of Notre Dame, appeared in a keynote panel session here this morning. Besides their first names, the two top security executives agreed on another point: Web 2.0 is seriously disruptive to security policy.

"After years of keeping them protected from the outside world, we're now exposing our internal systems to our customers; it totally changes the way we look at security," said Hodge, whose bank is the sixth-largest in the country. "Now, we have 3.5 million customers who are accessing our systems legitimately -- plus that group of bad guys who are trying to break in."

Aside from the huge problem of access control, U.S. Bank is dealing with the issues of mobile security that often accompany the move to Web 2.0. "It took us 10 years to get our employees to maintain a minimum of hygiene on their PCs," Hodge said. "Now we're not only dealing with employees, but with customers, and we're looking at iPhones and other mobile devices that may bring a whole rash of vulnerabilities."

In addition, Web 2.0 heightens the danger of insider threats, Hodge said. "We're now in a situation where we have to monitor what our employees are doing all day long. We need to know if their usage falls within normal patterns of behavior. We have to prove they don't have access to systems they shouldn't be able to access. I would say that today, I spend the bulk of my time on issues related to IT security."

U.S. Bank's approach to security is "very aggressive at the endpoints," said Hodge. The bank locks down USB ports, doesn't allow iPods, scans transmissions for credit card or other personal information, filters out potentially dangerous URLs, and logs and tracks usage information across the organization.

"If sensitive information shows up in the public domain, we want to know who lost it," he said.

The other Gary, Notre Dame's Dobbins, doesn't have the luxury of restricting user access across the enterprise. "There is a perception in the university environment that safe access isn't free access," he said. "It's like trying to operate a network for a whole city, but without network-based controls."

Notre Dame is tasked with facilitating the use of Web 2.0 applications across its campuses, but it must also protect the personal information of students, faculty, and employees, which have been breached or exposed at many other universities. As a result the home of the Fighting Irish has created a narrow "perimeter" that protects personal information and other sensitive data while making next-generation applications and services available to users whose PCs aren't controlled by the university.

"We've had to define a group of very granular controls and a system of layered protection that's necessitated by Web 2.0," Dobbins said.

The use of blogs, social networking, and next-generation technologies is "turning security on end," said Dmitri Alperovitch, director of intelligent analysis and hosted security at Secure Computing, which hosted the keynote panel. "The idea that any user can produce content is totally contrary to the old model. The browser is now the new operating system, but it was never designed for that."

"Securing the network at the perimeter used to work," said John McNulty, chairman and CEO of Secure Computing, who moderated the panel even after announcing his retirement last week. "That's not going to work anymore."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

About the Author

Tim Wilson, Editor in Chief, Dark Reading

Contributor

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one of the top cyber security journalists in the US in voting among his peers, conducted by the SANS Institute. In 2011 he was named one of the 50 Most Powerful Voices in Security by SYS-CON Media.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights