Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

9/4/2015
10:30 AM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Back To Basics: 10 Security Best Practices

The most effective strategy for keeping organizations, users and customers safe is to focus on the fundamentals.

"We need the latest security technology in order to protect our network against sophisticated attacks."

That’s a quote I’ve heard all too often, but those shiny new toys are not always the best use of your money – or your security staff’s time.

Despite the media hype, the biggest threats to your enterprise data assets are actually from the same old threats that we were worried about last year, five years ago, and in many cases even a decade ago. Only a handful of attacks truly use sophisticated “Mission Impossible” techniques, so the shiny new tools may do more harm than good at protecting your organization.

First, precious IT time is needed to learn, deploy, and adapt these new tools to your environment – time that could be better spent maximizing the benefits of your existing tools. Second, these new tools will likely overload staff with even more alerts and anomalies, and your already overwhelmed staff may not have the skills or the time to analyze, prioritize, and address them.

So before investing in new tools, here are 10 security best practices to help protect your organization with the techniques and technologies you likely already have in place. These best practices should be common knowledge, but unfortunately they are hardly common practice.

#1. Patch. Despite the hype, most attacks exploit known vulnerabilities. Make sure you are investing adequate time in patching your systems. It’s not glamorous, but it is extremely effective.

#2. Limit. Like making too many master keys to a building, you shouldn’t give admin rights to too many individuals. Make sure that anyone with privileged rights to the enterprise infrastructure and the security policy is truly trusted and keep an eye on them. What is true for people also holds true for network traffic. Make sure you do not have any overly permissive firewall rules (E.g. ANY/ANY) that allow traffic without any business justification.

#3. Check. Data theft by insiders can be costly, or even calamitous. So while you’re looking at network policies, verify the outbound access you allow employees to have while on your network. Lock down everything that’s not needed. For example, if your company doesn’t use Dropbox or Google Drive, lock them out.

#4. Segment. Network segmentation remains an important strategy to contain attacks by limiting the lateral movement of attackers. Understand where your critical data is stored, and use firewalls to limit traffic to and from those network segments.

#5. Automate. Your attackers are using automated tools to scan ports and identify misconfigured devices, so how on earth do you stand a chance if you attempt to do this work manually? Automating mundane security tasks such as analyzing firewall changes and device configurations not only mitigates manual errors, it also frees up precious time to focus on more strategic security initiatives.

#6. Visualize. You can’t secure what you can’t see. With the complexity of today’s networks and applications, it’s very difficult to understand the impact of a security policy change (such as adding a firewall rule) on business applications. This complexity coupled with a lack of visibility can have serious implications on security. So make sure you have complete, up-to-date visibility of your enterprise network and active monitoring of system configurations. 

#7. Document.  Make sure to document your security policies in a knowledge database so that network admins, security staff, and even application teams understand exactly what is going on – and why. This is particularly important when setting up rules to support new applications, because when an application is decommissioned or moved, you’ll want to reverse that rule. But you won’t be able to do so if you don’t know about it.

#8. Align. Security teams are not always in alignment with other teams such as operations, and this misalignment can be even greater with the business side of the house. Make sure security is integrated into operations and business processes as early as possible. Failure to do so will perpetuate the situation where security is “bolted on” as an afterthought, and is perceived is an inhibitor to the business rather than an enabler.

#9. Educate. Security awareness should be part of your business’ DNA, and practiced both top-down and bottom-up. This is where an ounce of prevention is worth a pound of cure: Have a well-organized, well-understood, well-maintained, and well-monitored security policy for both insiders and outsiders, and make sure they undergo periodic training.

#10. Measure Make sure you define metrics that are meaningful and can help you assess your security posture over time. With increased attention (and often increased budget) from the Board comes increased responsibility to demonstrate accountability.

As security practitioners, our job is to minimize business risk. We’ll get the most impact, and do the most to keep our organizations, users, and customers safe, by focusing on the fundamentals. Getting back to basics is the best way to cover your security bases.

 

Originally a software engineer and then a product manager for security products, Nimrod (Nimmy) Reichenberg now heads global strategy for AlgoSec. Nimmy is a frequent speaker at information security events and a regular contributor to industry publications including Security ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Amriteshsingh
50%
50%
Amriteshsingh,
User Rank: Apprentice
9/7/2015 | 6:22:54 AM
Ten IT admin mistakes that can be expensive on security and productivity fronts
Thanks for sharing this fantastic stuff !

I appreciate the effort you have made.

I would also to share one another informtiave article that covers those common IT admin mistakes that can be expensive on security and productivity fronts. I hope, you will enjoy it :  www.lepide.com/blog/ten-it-admin-mistakes-that-can-be-expensive-on-security-and-productivity-fronts/
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.
CVE-2020-7222
PUBLISHED: 2020-01-18
An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one tries to authenticate. An attacker who changes the result parameter (to true) in this JavaScript code can bypass authentication and achieve limited privileges (...