Triple-A ratings are normally associated with Chief Financial Officers (CFOs) keeping a tab on John Moody’s bond credit rating. In the world of IT however, how can a CIO or IT decision maker (ITDM) rate the efficiency of an IT security implementation?
IT security is one of the main concerns for ITDMs with recent attacks such as Shellshock and Heartbleed and others affecting organisations globally. Therefore ITDMs are taking steps to protect the corporate network from threats of all sizes. However, as it stands security is still at risk from internal and external stand point.
How can ITDMs know when they have reached a level of security that will protect from cyber-attacks while still empowering employees to do their job better? A comprehensive security approach should encompass three factors, it should be adaptive to threats, business requirements and also the ever evolving use of the internet within the corporate network, have adapted to meet the specific requirements of an organisation and have been adopted fully by end users.
A security approach is nothing without a security infrastructure to match, when implementing any new solution into the security portfolio of your network, it is essential to ensure the vendor is positioned in such a way to promote your organisations growth with the solution, or as I like to say; “better security, better business!”
These factors can be summarised as a ‘Triple A’ security approach. If you achieve this then you can strengthen the overall security posture and grant your organisation a ‘Triple A’ security rating. Read on to find out how you can achieve a security approach worthy of a ‘Triple A’ status and learn how IT security can be a driver of innovation, rather than an obstacle to it.
IT infrastructures are constantly changing. In the past we had static IT infrastructures, however, we are moving towards a world of convergence. Therefore, security infrastructures need to adapt in order to be effective. An adaptive security architecture should be preventative, detective, retrospective and predictive. In addition, a rounded security approach should be context aware.
Gartner has outlined the top six trends driving the need for adaptive, context aware security infrastructures: mobilisation, externalisation and collaboration, virtualisation, cloud computing, consumerisation and the industrialisation of hackers. But what exactly does context aware mean?
Gartner defines context aware security as “the use of supplemental information to improve security decisions at the time the decisions are made,” and predicts that by 2015, 90 per cent of enterprise security solutions deployed will be context aware.
The premise of the argument for adaptive, context aware security is that all security decisions should be based on information from multiple sources. This starts by looking at the context of the request and then allowing or denying it based on the information available e.g. the method of authentication used, the time of day etc. By taking this adaptive approach security can be improved.
No two organisations are the same, so why should security implementations be? Security solutions need flexibility to meet the specific business requirements of an organisation. Yet despite spending more than ever to protect our systems and comply with internal and regulatory requirements, something is always falling through the cracks.
In fact, 73 per cent of organisations globally have experienced a security breach in the last twelve months according to a Dell commissioned survey by Vanson Bourne.
There are dozens of “best-of-breed” solutions addressing narrow aspects of security. Each solution requires a single specialist to administer the software and leaves gaping holes between them. Patchwork solutions that combine products from multiple vendors inevitably lead to the blame game.
There are monolithic security frameworks that attempt to address every aspect of security in one single solution, but they are inflexible and extremely expensive to administer and organisations often find that they become too costly to run. They are also completely divorced from the business objectives of the organisations they’re designed to support.
Instead organisations should approach security based on simplicity, efficiency, and connectivity as these principals tie together the splintered aspects of IT security into one, integrated solution, capable of sharing insights across the organisation.
This means that business users can manage the rules and policies, and end users can easily comply. This type of security solution ensures that the security approach has adapted to meet the specific requirements and business objectives of an organisation, rather than taking a one size fits all approach.
Another essential aspect to any security approach is ensuring that employees understand and adopt security policies. IT and security infrastructure are there to support business growth, a great example of this is how IT enables employees to be mobile, therefore increasing productivity.
However, at the same time it is vital that employees adhere to security policies and access data and business applications in the correct manner or else mobility and other policies designed to support business growth, in fact become a security risk and could actually damage the business.
All too often people think security tools hamper employee productivity and impact business processes. In the real world, if users don't like the way a system works and they perceive it as getting in the way of productivity, they will not use it and hence the business value of having the system is gone, not to mention the security protection.
Looking at the example of mobility, BYOD is one of the most common ways in which employees can make their organisation vulnerable to attack. Although BYOD has given employees an increased level of flexibility, it has also given the end user even more potential to cause security breaches.
In fact, data loss on mobile devices is considered a top concern for companies today with 71 per cent of UK businesses citing “increased use of mobile” as a top threat to their IT security in the next five years. To some extent this explains why some companies in the UK are reluctant to enable workers to access company networks using personal devices.
In fact, 24 per cent of UK respondents said less than a tenth of employees use personal devices, this is lower than the global average of 13 per cent. Taking all this into account, it is more important than ever to fully educate employees about security attacks and protection.
By providing employees with training and guides around cyber security, this should lead to them being fully adopted and the IT department should notice a drop in the number of security risks from employee activity.
If your overall security policy is able to tick all of the three A’s, then you have a very high level of security, however, the checks are not something that you can do just once. To protect against threats, it is advisable to run through this quick checklist on a regular basis to ensure that a maximum security level is achieved and maintained at all times.
It is also important to ensure that any security solutions implemented allows your organisation to grow on demand, without there being any impact on the existing part of the network.
Overall, the Moody rating scheme is a widely respected and trusted scheme outlining the financial status of a country; however, the triple A security is also a good base to test a corporate security network. By ensuring that the network is ‘Triple A’ rated, it becomes possible to ensure that all areas of a corporate network are protected at all times.
By working towards this framework, it becomes possible to identify gaps in the network security, helping to prevent against future attacks.
Florian Malecki, International Product Director, Dell Networking Security.