Get Ready for the Intruder

Security is not about simply investing in equipment; it's about putting in a security life cycle that's driven by your business needs

Tuesday, November 11, 2003

Believe it or not, but your organization could be miles away from being secure even if you have a firewall in place. Conversely, you could have already achieved a high degree of security, even without a firewall. In short, securing an organization requires much more than a firewall. It requires a complete understanding of the security life cycle and how to deploy it.

Most security owners often tend to misinterpret the function of security. Securing an organization does not mean disconnecting all networks and powering down the systems. It is about securing the organization, while enabling it to continue doing its business. The organization provides the business needs based on which the access restrictions/rights are defined. So, whether Internet access and e-mail facility are required or not and to what extent, whether remote connection should be allowed on the network, are all driven by business needs. It is, of-course, assumed that such business decisions are done judiciously and the decision to grant rights or access is based on strict business requirements only. Based on these, a security policy document is created. This doesn't have to be a large and detailed document, so long as it contains the specific areas you would want to address. 

Once the policy is put in place, you will want to focus on education, processes, tools, audit and review. Most organizations underestimate the need for user training and education. The best of firewalls and tools can't provide as much security as a well-educated user would. So, spend the resources and time on educating your end users, senior management and IT department. There is a distinct need to turn the security policy into actionable items, which is taken care of by the processes section. Consider creating a SOP (Standard Operating Procedures) for each element of your security policy. The tools required are now a function of the needs specified in the policy. The firewall is as critical as a good proxy with access control and content-filtering capabilities. IS Security is fast evolving into a stand-alone function with expenditures of up to 10% of the total IT spend. However, even today, spending in many Indian corporations hovers around 2-3% of the total IT spend. It is important to realize that most organizations can achieve a high degree of security by actually spending very little on the overall costs. Security tools are expensive is a myth as can be seen from the list of open-source security tools in this article. Needless to say, these are just a few of the options available.

Auditing is a mechanism of ensuring that all stated needs in the policy are indeed implemented. Once again an audit of tools deployed is as critical as the audit of process deployment. If the policy requires installation of anti-virus on every computer in the company, then leaving out the MD's (or any other) computer will dilute all possible efforts to secure your organization.

Many corporations are also looking forward to conducting social engineering audits. These are conducted with the objective of acquiring company data and the auditors are allowed to use any means-corrupt, trick, please, soften, threaten, scheme-to steal the data from system or employees. These audits are extremely useful and act as deterrents to potential information leakage from your company. However, employee sensitivity and morale should be handled carefully by taking them into confidence, before conducting such audits. Like any other ongoing activity, security also needs regular review. It is suggested that a quarterly review is done to check the progress on the processes, tools and people deployment, besides checking the progress made on the audit recommendations. 

Alok Sinha,Chief of Information Security, Bharti Group 
The views presented here are of the author and may not reflect the views of the employer 

Page(s)   1  2