Priority Two: Eliminate passwords

Passwords, or more accurately, effective user authentication, remains a massive problem across virtually all industries, governments, and even religious organizations. Making sure someone is who he's supposed to be and can only gain access to those things for which he's approved goes to the very core of security. The fact that trivial passwords are commonly used and complex passwords are commonly written down or phished out should scare us far more then it does. Until you address this exposure, you remain at high risk of being a bad example in the next exposé on companies not protecting customer data adequately.

Dual-factor authentication is becoming a common requirement for financial institutions and government entities. It will eventually spread to the companies that serve these groups, and it would be wise to get well ahead of that curve so you aren't seen as incompetent if there is a breach (better yet, circumvent that possibility in the first place). While I personally prefer a combination of biometrics and smart cards, there are a number of alternatives that may be more appropriate for your organization. In any case, lose the password.

Priority Three: Keep it simple

The biggest problem with facing the level of threat diversity we have today is the tendency to layer on targeted security solutions for an increasing variety of vendors. The more complexity you create, the harder it is to manage the result – systems won't talk to each other, and things that should be automated require excessive human intervention to function. This results in a resource drain and an equally excessive focus on systems maintenance rather than increasing security.

It is easy to increase complexity and incredibly hard to eliminate it. If you can focus on maintaining simplicity, your result should be systems that are vastly easier to manage, vastly more secure in total, and substantially less expensive for what they do. A side benefit typically is you are left with some free time to anticipate and prepare for new threats as opposed to having to clean up the mess after being hit.

Of these three, the first is by far the most important, but if you keep all three uppermost in your thinking and planning, you should be able to both increase your site's security and your own piece of mind substantially.

— Rob Enderle is President and Founder of Enderle Group . Special to Dark Reading