Get in Shape

Seven essentials for enterprise security success

In a year in which some of the biggest names in both physical and logical security have been named and shamed for security lapses and subsequent breaches, reality is bearing down hard on the IT executive. New threats and risks seem to have bombarded enterprise networks at an unrelenting pace. If your organization is one of the many without a comprehensive, multifaceted security program, now is the time to take your head out of the sand. Antivirus programs and firewalls alone no longer cut it. Hackers and malicious insiders long ago figured out that these elementary safeguards are about as effective as a suit of armor made of tissue paper.

Convincing Unbelievers

Unfortunately, it can be difficult to convince the organizations most vulnerable to cybercrime that they even have a problem. The most oblivious among them have no idea that they may already be in the clutches of a hacker because they don’t have the tools or processes in place to properly investigate the anomalies in system and network behavior that raise red flags.

While there certainly are many moving parts in any comprehensive IT security program, everything ultimately boils down to visibility and control. Organizations need to see who or what is accessing their data and be able to limit access based on each user’s role within the IT ecosystem. IT staff need to keep tabs on system configurations and patch levels to limit inappropriate access and service disruptions. And organizations need to be able to look into system logs to spot anomalies and stop attacks before a great deal of damage is done.

Every enterprise is different, and the severity of risk always depends on individual circumstances. But in my more than 30 years of experience as a security professional, I believe a solid enterprise security framework incorporates the following seven fundamentals.

Endpoint Management

As the consumerization of IT continues to push a wide diversity of devices onto many enterprise networks, security professionals now face greater difficulties protecting their networks from the risks that each new gadget can impose. It is time to stop ignoring these issues and start analyzing how much of a threat these different classes of devices pose to your network. It is time to create and then enforce policies that effectively balance user productivity and risk. More importantly, regardless of whether devices are owned by your business or by your end users, they should meet a minimum standard of secure configuration before they connect to your network. This means patch levels must be up to date, unique passwords set for every application and function on those machines, and anti-malware installed.

The devil is in the details, but the overall goal is to ensure that, if hackers do compromise a machine, it is configured in such a way that it cannot become a launch pad for attacks deep into your network. This also means making sure there are no common privileged credentials in embedded applications waiting to be exploited. For example, if a backup task image is installed on every network device that has a common privileged identity attached to it and a hacker compromises that device and finds that password, the hacker has a meal ticket into future network exploits. Be careful of that.

Shared Passwords

Shared administrative passwords are a dirty little secret in the IT community. Many IT administrators avoid creating unique IDs for the privileged users who control the systems and applications on their networks—and fail to change the account passwords frequently—because the work is tedious and takes time away from higher-visibility tasks. However, shared logins can make it impossible to determine a chain of custody on highly privileged accounts, and thus they create an attractive target for hackers sniffing around the network for vulnerabilities. Similarly, it should be a top priority to secure application accounts that use default or common passwords. These accounts are ripe for misuse should a malicious insider or an outside attacker gain access to one of these passwords, since they’ll be accessing data that likely includes sensitive information about your customers and employees.

Log Management and SIEM

Speaking of log management, are logging capabilities turned on for all the different devices on your network? Many times I see organizations falter in this critical regard. In doing so, they fail to gain valuable insight into user and system behavior. Even when logging is enabled, many organizations lack the tools and practices to turn the deluge of data into actionable information. Log management and security information and event management (SIEM) solutions are an essential part of an effective IT security program. These tools are the first line of defense to help IT departments flag nefarious behavior, stop it in its tracks and eventually determine who is responsible. But these technologies can take a great deal of skill and expertise to operate properly. So each organization needs to invest not only in the tools but also in the training to use them. What’s more, you’ll need to make the supporting investments to ensure that the data is useable. If you spend a lot of money on an SIEM solution but then there is no effective identity management system in place supplying the data about who is responsible for security events, it makes that log data a lot less valuable to the organization.

Account Management

When an employee leaves your company or loses a device, do you know which credentials may have been compromised in the process? Without some way to keep track of all of these accounts it’s almost certain that they’ll be misused. Far too many enterprises are cavalier about the process of provisioning and deprovisioning accounts. Even if an organization manages to eradicate shared passwords, if they fail to shut down accounts once they’ve expired, bad things happen. For example, serious risks could arise from a disgruntled former employee who is still able to access the accounting system because no one bothered to shut down his account once he left the company. Or consider the possibility of a current employee who uses a former coworker’s credentials to steal data undetected because the ex-employee’s account stays active. Or if a device with stored passwords is lost and nothing is reset, an outside attacker will gladly take advantage of that opening.

Controlling Access to Data

Even with sound account and password management practices in place, malicious insiders or hackers who gain control of an account with access to too much data can still do a lot of damage. Organizations need to think carefully about how much data individual users can access through their accounts. Ideally, enterprises should implement role-based access so that users touch only the data necessary to get their jobs done.

And even when that practice is in place, it is probably a good idea to limit the volume of accessible data to prevent large scale exfiltration of information through e-mail, USB or screen-scrape dumps. An employee may need to view dozens of customer records each day, but does he really need access to, say, hundreds or thousands? It is of the utmost importance to implement data loss prevention (DLP) controls to help determine how much data should be accessed in any timeframe, thereby helping prevent someone from sending large amounts of sensitive information out the door.

Data Visibility Outside The Corporate Walls

If you are using DLP but then turn around and willingly ship a datacenter full of sensitive information to an outsourced or cloud provider, you’ve just wasted your money. The money you’ll save in the cloud will be squandered once that external infrastructure is breached and you have no way of investigating what went wrong—because most cloud service providers have no concept of DLP and other critical controls.

Enterprises really need to think critically about what they’re getting into when they send information outside the corporate walls. If a data store is too valuable to lose, then it probably isn’t a good idea to let an outside organization with unproven or perhaps nonexistent security controls take command of that information.

Centralization Could Kill You

For the last ten years, companies have been de-siloing applications and data storage, putting everything into giant databases so that anyone can get any information they might need. It’s mighty handy for the IT department and corporate users, but it also creates a huge target of opportunity for data thieves.

The fundamental danger really comes down to a simple rule: If your sensitive business data is in one place, you’re in big trouble if someone breaks into that system.

No need to stop de-siloing applications and streamlining operations. The more centralized your information, the more critical it is to implement solid database security and access management practices. IT executives need to start asking themselves what can be accessed from where, and how much of that access can be limited. Which IP addresses are allowed? What time of day is access permitted? How are users or devices authenticated? Is multifactor authentication needed to add another layer of security? All of these considerations become more important as your data becomes more consolidated.

The more organizations start to focus on these seven essential factors, the greater their chances of avoiding costly security breaches or at least limiting the potential damage when incidents do occur. These fundamentals are all about bringing greater visibility and control to the IT infrastructure. Fail to take control and it becomes not a question of if your organization will be breached, but when.

comments powered by Disqus

Free e-News Subscription

Security Today newsletter provides essential industry news and product information that can help you stay afloat in the fast-paced world of security.

I agree to this site's Privacy Policy