This is the first entry in a series of blogs covering the role of security in businesses today.

When people talk about the fastest areas of growth in IT today we automatically think about cloud, mobile, social media and web or portal based services. However, it has become very clear in recent times that the fastest area of growth is most likely security. Today’s business security measures go far beyond locking doors and using firewalls. It includes things like knowing what you have, where it is, what level it is at and what the impact is if something goes wrong. More importantly, it is about determining which assets to protect and the priority for those assets when it comes to remediation. In short, it is all about risk mitigation.

Defining Security

Every CIO and CTO today is involved in risk mitigation for IT. Common pain points shared by nearly every IT shop include:

• Compliance – internal and HIPAA, PCI, etc.
• Unmanageable amounts of security event data
• The need for visibility into the network and systems
• Time required for forensics analysis
• Too many security products installed – this affects operational efficiency
• Need to improve management of vulnerabilities to reduce risk

Typically, the pain points above fall into one of the following areas:

• Lifecycle management
• Inventory and asset management
• Patch management
• Compliance
• Protection

Security means many different things to many people. True security covers everything from physical security all the way through to network security, fraud protection and, in some cases, disaster recovery. What is critical is to have a structure in place where someone owns security. There are several roles that have been introduced that take care of this – the primary two roles are the CSO (Chief Security Officer) and the CISO (Chief Information Security Officer). Sometimes the two are combined but more companies are separating the roles.

The CSO is the top executive who is responsible for all of the security needs and challenges for the firm, including security of personnel, physical and logical assets, and information in both physical and digital form. This includes communications as well as business systems. The CSO will also have a role working with the CIO in planning and managing DR (disaster recovery) activities, since DR, or the lack thereof, is a security risk. Typically, the CSO is responsible for security awareness, developing security practices and enforcing them, and buying products and services that help improve security. The CSO is also responsible for communicating security needs and challenges to company management and typically reports to the CIO or CTO, although occasionally they report to the CEO. Without a CSO, the responsibilities of the CSO role typically fall to the CIO.

The CISO role supplements that of the CSO. The CISO is responsible for structuring the security initiatives with security programs and business objectives. The CISO also ensures that the security programs adhere to any regulatory compliance programs that impact the company. Examples of such programs include PCI DSS, HIPPA, etc.

There are three major components to security and they require significant planning:

• Prevention

Stopping threats is critical and involves preventing attacks from being successful. It also includes fraud detection as well as preventive remediation, such as applying patches for known bugs.

• Detection

Detecting attacks before they are successful is important – it is much easier to deal with an attack and block it, than it is to clean up the aftermath of one.

• Response

This is where many companies fall down. A response plan and team needs to be set up before an incident occurs. It also needs to be well known within the company. That way, when there is an issue everyone knows their role and knows who to contact and what actions to take. This also means that policies and rules are followed so you don’t get into issues around chain of custody and it ensures that evidence gathering is done correctly. The response also needs to include policies around remediation as well.

What is the goal?

The first step in developing a security plan is to determine what your end goal is. This means performing a risk analysis and determining what the critical assets are that you need to protect. And don’t forget to include personnel who may be critical – it is not just about computers and software. Examples of plan items around protecting assets would include:

• Governing and administering users and their access (physical and computer)
• Identifying and protecting critical business assets
• Managing application security risks
• Securing data once you know what and where it is – This includes actual data as well as logs and programs.
• Protecting mobile assets – Cell phones, laptops, USB keys, and tablets are just a few of the items that fall into this category but they are the most likely assets to get stolen or lost and they often contain critical business data. Backup tapes should also be considered as a security risk, especially if they go offsite.

A typical approach to security is to make it difficult. As an example, not allowing users to repeat their last 25 passwords or requiring a password so long and complex that people have to write it down. There are many other approaches that are less onerous – things like two or three factor security where you can allow a simpler password to be used with something else like a token. A great deal of attention also needs to be paid to social engineering – teaching people best practices such as not allowing tailgating (holding he door for others without badges) even if it is the CTO or CEO. Common sense needs to be merged with security needs to come up with a best of breed solution.

Building a strategy

There is a plethora of products out there to help with your security needs and we will explore some of them in upcoming blogs. But products are not the whole answer. First, you have to know what you want to protect and then you need a plan that ensures that assets are protected and that they are incorporated into DR plans. There is also a trend to partially or completely outsource security. Security-as-a-service offerings have become more common and can include:

• Anti-virus and spam management
• Network security
• Log management and reporting
• Secure email and web gateways
• Identify and access management
• Remote vulnerability assessment
• Security information management
• Incident response

And there are many other offerings. All of this can be done fully or partially in-house or it can be outsourced. Cloud service providers can deliver total management of all your security services, policies and administration.

Summary

It seems impossible to completely secure your business, let alone your IT systems in times like this – it is an overwhelming task when you combine the network, server and other endpoints and realize just how many of them you have.  Enterprise data is stored across many disparate systems, and data volumes are huge and growing rapidly due to the growth in cloud, analytics and mobile. Additionally, good security plans need to protect people as well as buildings.

It is more critical than ever to have a good risk and remediation strategy for people, buildings and digital assets such as data. With the growth in cloud, mobile, social media and web or portal based services it is critical that a well thought out security plan that includes security intelligence and analytics as well as detection and remediation be in place. In future blogs we will explore some of the options and best practices for improving security.

References:

IBM Security

CSO versus CISO

How CSO and CISO roles are changing

Evolution of the CISO role

Schedule a consultation today to learn more about security or security-as-a-service.

If you liked this blog, you also might like: Strategies for Securing Your Business Part II 

Stay connected online:

Facebook | Twitter | LinkedIn | Instagram