10 ways to protect yourself with 'pragmatic network security'
I found this an interesting reading ....
In the increasingly federated, network-based IT environment, perimeter security is important but not sufficient by itself to protect a company's secrets, warns Mike Rothman, president and principal analyst of Security Incite and former Meta Group Inc. security analyst.
Firewalls, demilitarized zones and similar boundary security technologies and methodologies certainly are still important for protecting your network from Internet-based attacks.
"The problem with depending totally on perimeter security is that it is based on the idea that all enemies are outside, and that is not always a good presumption," Rothman says. "There is a growing recognition that employees do not always do the right thing, either through malice or by accident."
And as companies increasingly partner to meet the demands of a fast-evolving, worldwide marketplace, they need to let employees of partner companies -- which may also be competitors in other areas -- access specific applications and data inside the corporate firewall.
Based on these realities, Rothman recommends what he calls "pragmatic security," which arranges security according to different domains. The first of these is infrastructure, which focuses on the traditional areas of perimeter and physical security.
The second level is data security, which includes the following:
Security Levels: "Data security starts by recognizing that different sets of information require different levels of security," he says. For instance, the enterprise might give outside business partners access to design data for a new product they are developing jointly. It might restrict access to the corporate e-mail system to employees, and restrict access to corporate financials and employee and customer personal information to specific individuals.
Security Policy: This defines exactly who sees what information on the enterprise network. The beauty of modern, network-based IT architectures is that all information is potentially available on the network. The problem is that all information, including information regulated by Sarbanes-Oxley and other regulations, is potentially available to anyone who can get on the network. (See "Best Practices for Configuring Group Policy Objects.")
Compliance: In the worldwide business environment that many companies operate in today, this is a complex area because each country has its own regulations. Thus it's not enough for a U.S.-based company to meet Sarbanes-Oxley and HIPAA requirements for protecting financial and personal medical information. If that entity also operates in Great Britain, for instance, it must also secure employee personal information and track any access to that information to meet British laws. Even if it does not have operations in the U.K., in this age of identity theft, high security for employee and customer personal information is simply good business. (See "The Real Value in Sarbanes-Oxley.")
Ease of Use: This is vital for good security. Without it, users won't obey security rules. Among business users, security has the bad reputation of getting in the way of accomplishing anything. Faced with having to remember complex, 50-character password strings that change monthly, users will write the passwords on sticky notes and attach them to monitors, making the passwords available to anyone who walks past their office door.
Role-based Security: "This can be useful for some applications, and SAP, for instance, employs it," Rothman says. However, it has its limits, and Sarb-Ox, for instance, requires that individuals accessing regulated corporate financial information be individually identified, and that everything they do with or to that information be logged under their name.
Virtualized Organizations: Security does not stop at the corporate perimeter. Today companies commonly create close partnerships with subcontractors and other business partners for specific projects, but those partners could be competitors in other areas of business activity. Many companies also outsource parts of their infrastructure containing highly sensitive information that employees must be able to access securely. Rothman sees federated identity management as becoming important because it relieves the organization of the need to manage the identities not only of its own employees but those of business partners as well, making security administration easier and eliminating the requirement for legitimate users from outside to use a special password to get into the network. Message security, including encryption, also is increasingly important in this increasingly virtualized environment. (See "Real self-service for virtual provisioning.")
Network Access Control: With increasing numbers of employees carrying portable computers and intelligent mobile devices, and with Wi-Fi-enabled smart phones beginning to appear, "the enterprise must be sure that the right people are accessing the network, from the right places, using the right devices, and that their devices have the right antivirus updates operating," says Rothman. "If they do not, then you want to quarantine them until the situation can be rectified." (See "QuickStudy: Network Access Quarantine Control.")
Network Traffic Management: "Once I know who is on my network and what they are doing, I can manage network traffic to restrict access to specific databases only to those who are authorized to see them," says Rothman. This is the next level of network-based security. The concept is that users who are not authorized, for instance, to see HR data on employees, don't even see the server or application that contains that information on their version of the network. "This takes a lot of network intelligence, and many organizations are not there yet, but it is definitely on the horizon," he says. (See "How to choose a network management system.")
Deprovisioning: "This is as important as provisioning in the first place," Rothman says. "It is where the rubber meets the road." Too many companies neglect to cancel network access for individuals who leave the company, or to cancel access to specific data when an individual's responsibilities change and he no longer requires access to those applications. In some cases, former employees continue to have access to corporate networks and data long after they have leave, and that's a security nightmare. Federated identification management can help by allowing some deprovisioning to be handled by business partners.
Oversight: The Sarbanes-Oxley Act and other regulations require reporting on access to specific information. However, "it is important to realize that you are not just trying to impress the auditor," Rothman says. "Ultimately, you have to define what success means in terms of data security, and your reporting needs to demonstrate that you meet that level of success. But people should not think that reporting is someone's job. The job is security, and reporting is part of that." (See "What's a Control?")
Source: http://www.computerworld.com/action/...2&pageNumber=1
