Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

5/2/2012
09:12 AM
Amy DeCarlo
Amy DeCarlo
Commentary
50%
50%

Effective Security Policy: Emphasis On Execution

When it comes to mounting a successful defense in what is a fast-changing threat environment, best practices require consistent execution

With the release of each new vendor- or service provider-sponsored cyberthreat report detailing dramatic increases in attack volume and virulence comes an inevitable wave of widespread panic. This immediate alarm gives way soon enough to general resignation that escalating threat levels are inevitable.

The publication of the latest Symantec Internet Security Threat Report is no exception, with stomach-churning statistics such as the fact that 5.5 billion malicious attacks stopped by Symantec alone in 2011 represent an 81 percent increase versus 2010, and that hacking attacks resulted in 187 million personal identities being breached just last year.

But beyond raising the collective blood pressure of IT departments and executives, what purpose do these studies serve if they don't prompt organizations to re-evaluate whether they have adequate protections in place to defend against the current threat environment?

Vendor and service provider-sponsored threat reports yield not only fascinating -- and often scary -- facts, but they can also shed light on where the next threats may be coming from and what type of entities are in the cyberattackers' sights. To this end, the Symantec research found that more than 50 percent of all targeted attacks were leveled against organizations with 2,500 or fewer employees. The same report also pointed to some good news, noting that recent spambot takedowns had cut spam volumes from 88.1 percent of all email in 2010 to 75.1 percent last year.

This kind of information can be helpful in assessing the overall threat landscape and prioritizing defensive efforts. Unfortunately, too often the deer-in-the-headlights effect takes over, and overwhelmed enterprises continue business-as-usual practices when what they really need to do is stop and carefully assess whether their current security posture is adequate.

This process starts with taking a very careful look at current policies to make sure these are aligned with corporate governance and compliance requirements.

There is a long list of policy elements organizations should consider. These components include everything from classifying data and encrypting the most sensitive files, to ensuring consistent and thorough update patching policies, to instituting clear security best practices around Bring Your Own Device (BYOD). Are users allowed to connect directly from enterprise resources from their own mobiles and other computing devices, or will their connections be limited to a guest network? Enterprises also need to address common elements, such as whether and when to allow data to be downloaded to removable peripheral devices.

In defining these policies, IT organizations have to strike a balance between sufficient protective measures and overkill. In other words, effective security relies on organizations to find a way to institute security measures that don’t interfere with performance.

Unfortunately, far too many organizations have well-defined security policies that sit unused in an unopened binder somewhere on a shelf in the IT department. Clearly the best-designed security policies are completely ineffective if they aren't consistently implemented throughout the organization.

Effective security practices start with fundamental communication about what corporate policies are around things like data handling and encryption, and continue with ongoing programs to educate users on things like the potential danger of opening attachments from unknown sources and which websites might harbor malware.

This continuity and vigilance in both communications and implementation is critical to effective security. As we see in so many studies, the nature of the threat environment is always evolving.

Amy Larsen DeCarlo is a principal Analyst, Security and Data Center Services, for Current Analysis

Amy brings 17 years of IT industry experience to her position as Principal Analyst, Security and Data Center Services. Amy assesses the managed IT services sector, with an emphasis on security and data center solutions delivered through the cloud including on demand ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
KKAMINSKI197
50%
50%
KKAMINSKI197,
User Rank: Apprentice
5/2/2012 | 1:37:27 PM
re: Effective Security Policy: Emphasis On Execution
Effective Writing: Putting the Emphasis is on Paragraphs.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-4966
PUBLISHED: 2021-01-21
IBM Security Identity Governance and Intelligence 5.2.6 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the...
CVE-2020-4968
PUBLISHED: 2021-01-21
IBM Security Identity Governance and Intelligence 5.2.6 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 192427.
CVE-2020-4969
PUBLISHED: 2021-01-21
IBM Security Identity Governance and Intelligence 5.2.6 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man in the middle techniq...
CVE-2020-26285
PUBLISHED: 2021-01-21
OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, there is a vulnerability which enables remote code execution. In affected versions an administrator with permission to import/export data and to create widget instances was able to inject an exe...
CVE-2020-26295
PUBLISHED: 2021-01-21
OpenMage is a community-driven alternative to Magento CE. In OpenMage before versions 19.4.10 and 20.0.5, an administrator with permission to import/export data and to edit cms pages was able to inject an executable file on the server via layout xml. The latest OpenMage Versions up from 19.4.9 and ...