Tag: GRC

Security: Protecting Ourselves, Our Businesses, Our Customers and Our Future

While Operation Aurora, Zeus, and Conficker have garnered some national attention (fading), the mainstream user population remains relatively unphased by these security risks and the dangers they pose to both their workplace and home. High profile breaches from the likes of Blue Cross and HSBC have done little to raise awareness and anger over security mishaps. Heck, even attacks against the beloved site Facebook are nothing more then annoyances that are becoming commonplace for their millions of loyal users.

I find it humorous when people refer to Operation Aurora attacks as primitive or unsophisticated. The question is not how sophisticated or elegant an attack is, but rather how effective is the attack itself? Early denial-of-service attacks were not sophisticated but they were deadly. Remember the old SYN Flood or Ping of Death attacks?

Like all industries, cyber criminals come in varying levels of expertise and knowledge. Let’s face it, some are down right brilliant across multiple areas; finding exploits, writing virus or malware programs, finding a delivery mechanism, and avoiding detection. Others aren’t as gifted, but they do have the ability to cook up schemes and piggy back on the work of others (Zeus) to create havoc and personal gain. Remember, the good guys have to be right all the time while the bad guys only have to be right once.

IT security is a waltz between classic security elements such as firewalls and virus scanners, applications, servers, clients, networking, storage, virtualization, and people. While it is always exciting to deploy the latest security gadget, one cannot discount the role people play in IT security. Communication, understanding, flexibility, and a willingness to work together are just a few of the keys to creating and maintaining a positive environment for meaningful IT security.

Finally, IT security must transcend silos to view the big picture and think strategically. If we view each discipline as a puzzle piece, then only by putting all the pieces together does the true picture reveal itself. Like any piece of art, the picture must be shared across the disciplines and various levels within an organization to garner perspective and insight. This can only be accomplished via automation, correlation, reporting, and more; a must-have not a nice-to-have in any enterprise. Why is this principle accepted for financial data displayed within multi-million dollar business intelligence portals yet not understood for security?

In the end, we are all human and no piece of hardware or software is perfect. However, through communication, visibility, and vigilance we can protect ourselves, our companies, our customers, and our future.

Advertisement

Security: Moving Beyond Firewall Configuration Management

For over 20 years, the firewall has been the cornerstone of TCP/IP (Internet) security.  In fact, the firewall has crossed-over from the geek to the chic as it has appeared or starred in print, television, and movies.  While the battle between hackers and security vendors rages on, firewalls have become more sophisticated and complicated to operate and manage. Further adding to the complexity is the increasing trend to build firewalls into routers, switches, unified chassis, and more.

Over the past few years, companies like Tufin, AlgoSec, SecurePassage, Skybox Security, and more have created products that analyze firewalls configurations, rules, and policies to alert security personnel to possible issues.  They have the ability to manage multiple firewall vendors as well as analyzing configurations from multiple firewalls deployed within an organization.  These products are essential to managing and maintaining an ever complex and changing security posture that requires automation to augment and compliment human interaction.  However, to completely understand an organizations security posture we must move beyond the firewall.

While firewalls are complex, they represent only a fraction of the total number of network devices within an organization.  Security personal routinely issue changes to routers, switches, IDS/IDP, and more that impact the entire network infrastructure.  Adding to the complexity are new devices and technology, such as WAN acceleration and virtualization, which are becoming mainstream.  These changes are important to maintain security and regulatory compliance within an organization.

However, the broad impact of these changes (access control lists, port security, network access control, VPNs, and more) may never be fully understood until after the changes are made. High availability and disaster recovery only adds to the complexity as they require synchronized changes/configurations across multiple devices and manufacturers.

Of course, using modeling software from companies like OPNET coupled with internal testing/procedures will aid organizations in making these changes.  The issue is how fresh the information obtained is and the time allotted to make the change given the severity/urgency of the security issue.

Imagine building a security software management platform that allows security and network engineers to jointly view, analyze, and document all security changes while coupling them to a sophisticated and easy to use GRC engine.  A proposed firewall change would trigger a review of the firewall policies followed by a warning that an ACL must be changed on 2 downstream routers while suggesting a re-ordering of said ACL to mitigate a potential security risk and alerting that a HA router must be updated. Next, the GRC engine would require documentation to ensure PCI compliance is maintained.  The coup de grace would be wrapping the entire platform within a visual interface that allowed for layered views of all security/network devices.

Is this farfetched?  Perhaps, but the recent uptick in stories about cyber warfare and cloud computing security threats have created an environment that is ripe for change and innovation.