Playing it safe – Preparing for Worst-case Scenarios

Companies need to ensure defenses are up and constantly ready to battle against every worst-case scenario. But, asks Frances Davies, is enough being done?

Ask many organizations today what their top priorities are and they are almost certainly likely to mention security. This should come as no surprise: a recent RSA security conference in San Francisco attracted record attendance and included such high-profile speakers as Bill Gates, Larry Ellison and Colin Powell – a fitting testament to how much the issue of security is looming large on the corporate radar. Organizations increasingly find themselves in a position where they must relentlessly identify, prevent and, in the worst-cases, recover from an attack. According to a recent Senforce Technologies survey, 23 percent of respondents said their organization had reported a network security breach in the last 18 months, while another 25 percent admitted they didn't even know whether such a breach had occurred.

A breach can have a devastating effect on a company, and not just financially. It can also irreversibly damage a reputation and brand image that have often taken years to build. The recent revelation that TJX Companies, the parent company of retailers including TJ Maxx, Marshalls and Homesense, had lost the personal information of millions of its customers in what is thought to be the largest theft of consumer data in the US is one such unfortunate example. Astonishingly, this wasn’t the first time the company had compromised customer data; nine months earlier, another security breach had occurred. Not heeding the warning, the company failed to safeguard data and now has to overhaul its security procedures, apologize to millions of customers who bought goods between 2003 and 2006 and face significant legal action – 19 independent class action lawsuits have already been filed. Furthermore, the incident could spur federal disclosure legislation and increased scrutiny of corporate data management.

The case serves as a nasty reminder to others to neglect security at their peril; indeed, gone are the days when spending on security was seen as a minor expenditure. “The traditional view that security is an unnecessary cost, with little or no benefit to the organization, has gradually changed over the past few years,” stresses Doug Philbin, CIO at engineering and construction company Parsons Corp. “Virus attacks of a few years ago were the first impetus to changing this view. The more recent requirements to meet stringent government project execution standards and regulatory calls for increased confidentiality are the latest factors in driving home the importance of a sound security posture.”

Threatening behavior

Security breaches can inflict a dark shadow over the reputation of a company even if it has achieved a spotless track record in the past. Trust is a precious attribute for customers to have in a company so when it’s lost it is a difficult thing to recapture. “Our clients trust is our most precious asset,” acknowledges Paul Heller, CIO at Vanguard, one of the world’s largest investment management firms. “To that end, we have invested millions of dollars and countless human resources to mitigate these risks.”

Despite this investment however, each year brings a new set of challenges that organizations have to prepare themselves for. Spyware continues to be an enormous problem, as the profitability of gaining access to and then using personal data becomes more desirable to criminals. A recent survey by Webroot Software Inc. indicates that the magnitude of the problem is high, with more than 40 percent of the companies surveyed saying that spyware was causing business losses, while 26 percent of enterprises reported that confidential information had been compromised as a result of spyware.

Trojan attacks, system monitor attacks, pharming and keylogging are all tiresome threats that companies are forced to deal with on a regular basis. Even something as harmless as a social networking site can turn into a security nightmare, as there is a chance malware can be stored in these services. Visiting blogs, chat rooms and other social networking tools is a popular activity during breaks and lunchtimes, with a report by consulting firm Clearswift revealing that, out of more than 800 employees across a range of industries, more than half said they spent at least an hour a week accessing these kind of services.

Unsurprisingly, there are similarities between the security concerns of different companies. One of the biggest is the laborious job of identifying and then preventing attacks. In many cases, it’s a thankless task that hinders a company from actually getting on with real, value-adding work. The harsh reality is that as soon as one threat is quashed, another pops up – such as with hackers who move onto other vulnerabilities in a system as soon as one is patched over. “There is so much threat out there in the network today that administrators are spending a huge amount of time just struggling to keep up with every new threat,” says Tony Redmond, Vice President of Security at Hewlett Packard. “One CIO told me recently that a number of his company’s administrators do no useful work as they spend all day, every day struggling to deal with threats.”

In support of this account, a study by Nucleus Research and KnowledgeStorm found that two out of every three e-mails received by today’s businesses are spam. The result is the loss of valuable business time as workers struggle to contain the problem by identifying and deleting each pointless message.

Guessing games

As networks become increasingly complex, so it becomes harder to predict the likelihood of a new attack. As many organizations have operations all over the world, staff that are increasingly mobile and networks that are accessed by a multitude of users, it is all the more important to ensure that unauthorized users are restricted from gaining entry. “Parsons operates a diverse, global network infrastructure, with offices in the Middle East, Europe, Asia and the Americas,” says Philpin. “Many of these offices are shared with clients and partners, some of whom may be direct competitors to Parsons. In addition, we support an extremely mobile workforce that need access with appropriate levels of authentication to ensure that only approved people and devices are able to connect to our network infrastructure.”

Laptops, smart phones, PDAs and the like have certainly made life easier for many employees who need to travel as part of their job, but this increased mobility has also brought with it added security worries as a company’s applications can now be accessed from anywhere. There is therefore a need for strict policies and procedures. “CIOs understand that mobility is high and therefore need to consider how to have control over these devices so that if they are lost the sensitive data on the device can be wiped remotely,” advises Redmond. “They also want to be able to automatically and consistently assign policies to the devices so that, for example, users are forced to enter passwords before they can get at data. They need to be able to ensure that passwords are of a particular quality and that there are automatic timeouts so that if you don’t use the device for 15 minutes then a password blocker comes up. We will see more of these requirements coming through from CIOs as corporate security departments become more aware of the vast amount of sensitive data that is being carried around on these mobile devices.”

If the worst happens, business continuity is vital. However, a recent survey by the Xiotech Corporation revealed that although many companies are investing in IT to support business continuity, many of the respondents did not seem to have a good handle on the various risks that could affect their company. Only 49 percent of respondents indicated they had quantified the type and likelihood of risks that could impact their organization's ability to continue operating. Companies need to have a solid understanding of the spectrum of risk – something that isn’t always that easy to foresee. “Business continuity is definitely something we hear time after time as a challenge from CIOs,” says Redmond. “This involves knowing how to keep things going when you operate in a world threat. Disasters that could happen might include the radical infection of a network by a very virulent worm or virus that infects a large proportion of an infrastructure, takes servers offline and stops applications running. The overall impact of such an infection depends on the servers and the applications affected, but for most companies, an attack on their systems would be pretty dramatic. There is a need to come up with new and improved ways to resist an attack.”

Adding to an already complex task is the necessity to meet various regulatory and standards needs, covering information security standards and those introduced as a result of various corporate and financial data scandals. For instance, Sarbanes Oxley was introduced to guarantee integrity in accounting and reporting practices. Meeting compliance is a vast issue for enterprises to deal with, but it is vitally necessary in order to help protect information. “Internationally, there is a growing requirement for information security programs that conform to ISO standards, such as ISO 17799,” explains Philbin. “While there may be some technical measure that result from implementing these regulations and standards, they do not call for a purely technical solution. The ever-changing regulatory environment requires an appropriate policy structure, awareness that these policies may have to be tailored for specific environments due to conflicts between regulations and standards and, finally, alertness to changes in the pertinent regulations and standards.”

Technology

Updating procedures and technology along with constant training are all necessary steps to thwart a security threat. Companies have adopted diverse measures to ensure they do not become a target. “We have a broad plan in place that touches every aspect of security and we will continue to invest heavily in solutions that make sense for the enterprise and our clients,” explains Heller. “We’ve centralized our efforts within a security operations center that monitors our environment, and we’ve increased the number of people dedicated to security issues within the organization. We have invested in the best tools in the industry to monitor, protect and prevent security risks. And perhaps most importantly, we have improved awareness at all levels of the company about security issues, and risk management discussions take place at the most senior levels of management.”

These days it is pretty much standard practice for companies to have some form of anti-virus protection, filters to log or block outbound e-mail that might contain sensitive data, as well as strict authentication and verification tools. But listening to feedback could also prove to be a useful weapon in the CIO’s arsenal. “One of the best ways we respond to security issues, and more general technology needs, is by listening to our clients,” continues Heller. “We vigorously collect and act on client feedback.”

Deploying an encryption system that will act as a barrier to prevent information being read following the loss or theft of equipment containing sensitive data is another wise security measure. Parsons, is planning to roll out a system this year onto PCs containing the most sensitive corporate data such as business development, legal or financial data. “Our PC encryption project reduces the chance that PII data will be disclosed due to the loss or theft of an employee’s PC,” says Philbin.

Finally, network access control (NAC) solutions are able to limit the damage from security threats. At Parsons, hardware access controls are guaranteed by these kinds of tools. “Computing assets are interrogated by NAC to determine their validity and security posture before granting access,” says Philbin. “NAC policies can automatically deliver upgrades such as patches and anti-virus updates to bring computers into compliance.”

Reactive to proactive

Despite all these precautions, Redmond believes that there needs to be an overhaul in attitudes toward protection. “The reactive kind of management that we have seen so much of in today’s defense environment is struggling to keep up with the volume of threats,” he says. “Whereas people can continue to erect very strong perimeters with things like anti-intrusion devices, anti-spam, anti-virus, firewalls and so forth, the fact remains that the security infrastructures that we are building are so complex that it is easy to make a mistake. We have to move from reactive to proactive. This means that the devices we put on the network (network switches, routers, servers, workstations, PCs) have to be capable of protecting themselves at least against simple attacks and then gradually, over time, complex attacks.”

According to Redmond, the perfect scenario would be for technology to be able to detect and then warn administrators of a problem so that they are able to take action to fix the problem. Currently this concept is still in its infancy. “We are still not at the level of sophistication that we should be because administrators are still taking manual steps to fix the problem,” he explains. “It would be good to reach a stage where we have the ability to self-heal after an attack and to be more self-repellent so that we don’t even allow the attacker onto the network component. Today we have to allow it in before we can even identify its presence. The switch from active security management to proactive security management seems to be a very good approach to solve the problem. We can’t let the situation go on, we must be more resilient in the future.”

Most company’s now understand the harshness of the security threat epidemic. It is a plague that is here to stay and one that is virtually impossible to completely eradicate. Good security planning can certainly go a long way to reduce the risk, although it takes a great deal of organizing, a highly structured approach and commitment throughout the company to achieve tight security. Despite this, and even with the best intentions, the constant evolving nature of threats means that nothing is guaranteed.

“The traditional view that security is an unnecessary cost, with little or no benefit to the organization, has gradually changed over the past few years”
Doug Philbin

“One CIO told me recently that a number of his company’s administrators do no useful work as they spend all day, every day struggling to deal with threats”
Tony Redmond

“Our clients trust is our most precious asset; to that end, we have invested millions of dollars and countless human resources to mitigate these risks”
Paul Heller

23 percent
Companies reporting a network security breach in the last 18 months
25 percent
Companies admitting they didn't even know whether a data breach had occurred