Byecole
What does IT Security Risk Management REALLY mean?
The most common misunderstood term seen in the security industry is Risk Management. If you Google the term “Risk Management”, you will find yourself buried in a pile of information ranging from financial risk management to business risk management. And if you happen to fall upon the actual security risk management concept, you may come across a blog post, or online article describing risk management incorrectly. To avoid such situations it is important to take the help of a solution like Network Provisioning Software NIM that can easily manage your organization and mitigate any security threats. Even when speaking with some corporate decision makers (and some IT professionals), the security term risk is often used interchangeably with other terms such as vulnerability and threat. People need to know that CNAPP is here to stay and people can use it for cybersecurity. I have seen vendors marketing tools that were for “Risk Management” but in reality, they were vulnerability management tools. I can truly understand why education must be made a priority when talking to decision makers prior to discussing a risk management assessment. The cybersecurity for the chemical industry is the strongest and that is the kind of security every company needs.
The terms risk, vulnerability and threat are three separate terms that work together:
1. Vulnerabilities – are holes and weaknesses in an organization, which are typically the easiest to find and remediate, usually through penetration and vulnerability tests.
2. Threat – is the possibility that something or someone will find out about the vulnerability and exploit it.
3. Risk – is the probability that a threat can become real, resulting in some form of impact on the business, should that vulnerability become exploited – the unanswered question is how badly will it hurt the organization. This is usually the hardest to calculate.
Some companies think they have a risk management program already in place, but due to the misunderstanding of terminology, will actually have a vulnerability program in place. I have had some companies actually refer to their traditional Enterprise Risk Management (ERM) program when asked if they had a risk management program in place – which is completely different from any security program. ERM includes credit, liquidity, regulatory compliance, and market risk, as well as risk transfer strategies, capital management, and strategy development. However, a solid IT Security Risk Management Program should be an integral part of a holistic ERM – which will cover the organizations risks more efficiently and effectively. After a brief explanation between the differences of the terms, it is quickly understood that their misunderstanding may have caused them to fall short in implementing a solid risk management program. Additionally, if the risk management program does not include and address all of the layers of the organization that can contain threats – such as administrative, technical, physical, operations, tactical, and strategic – it is not a risk management program.
Risk Management can be both complex and time consuming. The need to understand business, capital, and human resource issues, as well as management levels are critical during assessment – rather than looking at it solely through a technical perspective. An organization must attempt to read the future, determine what can happen, and how much it can cost.
Risk management should not solely rest on the shoulders of the CSO. It should be a collective effort by including decision makers and department heads throughout the entire organization that are knowledgeable and able to contribute to the process. Not only are they able to fully understand their department and the risks that take place – which are not just technical risks – they are also effectively positioned to enforce the plan, as well as assist in making changes to the culture of the organization starting within their department.
During the assessment, a tremendous amount data will be gathered and the current security component, as well as the business issues than can be affected by the current security in place, will be reviewed. Vulnerability and penetration tests will reveal what needs to be protected and how, and interviews with staff will provide information on gaps in policies and procedures. This process will allow organizations to learn their acceptable risk levels – which will tell them how much security they actually need. An organization’s policies should reflect acceptable risk levels in order to implement the right amount of security.
You can’t address all of your risks, and in many situations, it would not be necessary to do so. Once you associate the vulnerability with the threat, and how that threat can affect the business, this will clarify how to manage your risk. The vulnerability that has the highest threat and will cost the company the most if exploitation occurs will be the order in which risk should be managed.
Understanding what risk management truly is continues to be the best strategy in properly assessing your organization the first time around, which will save you money in the long-term. When this concept is not fully understood, organizations find themselves either spending too much money on security, or not enough money – yet still lacking the right countermeasures implemented for tangible and intangible assets or controls that actually need risk management.
Byecole
When was the last time you reviewed your Risk Assessment?
With all of the statistics, comprehensive data, and war stories shared from security officer to security officer, I often wonder what is behind the thought process of decision makers declining assistance in implementing a cyber security risk assessment – especially organizations that clearly need it for compliance reasons.
I speak with many technology decision makers of fairly large companies regarding implementing a free cyber security risk assessment for their infrastructure. If I had a dollar for the amount of individuals within these organizations who believed that the assessment done over 2 years ago makes them prepared for the black hat techniques that advance faster than the pace of white hat security initiatives, I could hang up my coat and retire. There is a false sense of security that is prevalent in companies both large and small that believe if they were not significantly compromised in the last 3 or 4 years, their risk and compliance practices are consistent or above average with best practices in their industry. According to Economist Intelligence Unit Survey, “Ascending the Maturity Curve, Effective Management of Enterprise Risk and Compliance”, at least 87% of respondents agreed with this notion.
However, it is recommended that a review of an organizations security program should be done a minimum of every 2 years. And it is not only to their advantage to outsource this task to a reputable security consulting company in order to provide an objective point of view, something that is difficult to accomplish in-house, but to also use a different consulting company to continue to gain a different perspective each time. Rotating security consulting companies provides the opportunity to catch risks that may have been missed previously.
Although the financial services field was found to be most likely to have this false sense of security, the health care industry is barely on the map. The health care industry is just now beginning to embark on discovering a consistent risk assessment standard. Standards are underdeveloped as to how assessments and vulnerability remediation should be completed. Although HIPAA developed a requirement, a lot is left for interpretation. Unfortunately, this results in spotty assessments, or horrifically, no assessments done at all.
That’s why I scratch my head at a decision maker who turns down a free risk assessment. They have the opportunity to find out – utilizing a fresh pair of eyes – what may be exposed in their organization…for free. Addressing the risks, of course, is another subject. So, the next time you receive that call from a reputable security consultant about evaluating your risk assessment program that was implemented more than a year ago, reconsider. Hackers are not waiting every 2 years to develop new ways to crack you network – they are advancing each day.
Top Ten Ways to Ensure the Security of Your Network
Ensuring the security of your business network should be a priority for any company. Because so much work is done on your computer, storing files with important customer information and company secrets, it is crucial that a business protect that information as well as it can. Here are ten easy-to-implement tips for protecting the security of your network:
- Do not let unknown users use your computer network. All users should be authenticated with a login and password assigned by a domain administrator who has verified the identity of the user.
- Educate users on safe password creation and handling. Because some users find passwords easy to forget, some may try to use easy to remember dictionary words or even their own names. Some users may even write down their passwords in an easy to find place. This creates an opportunity for someone to steal a password and compromises the security of your network.
- Require users to change their passwords at least every 90 days. The more a password changes, the less likely it is to be useful if stolen.
- Limit the number of failed logins that can be tried before the system locks the user out. Password crackers often try different passwords at high speed. By limiting the number of failed logins, you can lock a potential intruder out.
- Never set up an unsecured wireless network at your company. If your business has a need for a wireless network, make sure that the wireless network is secured and that unauthorized users are not able to access it.
- Educate users on opening e-mail attachments. If a user receives an attachment from an unknown source or from a strange email, they should delete it. It could be a malware program that can create back doors to your network and breach your network security.
- Use antivirus programs and be sure to keep them up to date. Antivirus programs can detect and eradicate various malware threats.
- Restrict the websites to trusted sites only for your users to browse. Malware is often downloaded unknowingly from untrustworthy websites, especially illegal download or adult websites.
- Restrict the types of programs that can be downloaded onto your user’s computer. Users may download malware in the form of a trojan or a worm without realizing it.
- Consider restricting administrator access on your desktop computers. Most users and applications do not need administrator access on their computers and can work just fine with regular user access.
Although having an IT consultant can help you to limit damage if your network security is breached, this is one case in which prevention really is worth an ounce of cure. By creating a secure network ahead of time and working with your employees to implement safe practices, you can avoid damage or lost productivity before it occurs.
Business Travel and the Internet
These days, travel and computer use almost go hand-in-hand. Whether you’re carpooling across state or you’re flying internationally for business, almost all companies have some sort of ties to the mobile workforce.
In fact, many companies plan for it by making laptops accessible for employees on the go. Other companies rely on Blackberrys and other portable digital devices to keep their employees connected to email and the web.
However, Internet access tends to be rather sketchy on the road. Unless you’re able to supply your computers with wireless capabilities through a 3G network or other mobile routing system, it may be difficult for employees to send large files or share information from a remote location.
These days, car companies and airlines are stepping in to provide mobile Internet access. Automobile makers like BMW offer computers as a part of their more luxury vehicles. These computers have in-vehicle Internet access as long as you’re within range of their network. Airlines are also offering onboard Internet access, as long as you’re seated in one of the equipped stations (usually in business or first class) and you pay the appropriate fee.
Like most advances in technology, it’s only a matter of time before these types of services are offered more universally. Although they come at an added expense right now, experts estimate that most people will have more mobile Internet options within the next five years.
If your business is on the cutting edge of technology, it might be worthwhile to invest in these types of “on the road shortcuts” right now. However, if you’re content to wait, you can tap into netbooks and PDAs as a way to provide a little more connectivity until the rest of the technology catches up.
How to Reduce the Threat of Computer Viruses
Almost all personal computers and business hardware has anti-virus software as a way to keep viruses and other malware sources at bay. The reason is simple: it’s easy to install, easy to update, and easy to use.
However, in the business world, just installing the anti-virus software isn’t enough. In order to keep your data secure and your client information confidential, you must follow up to ensure that the software is being used to its maximum potential.
- Regularly update all of your software – even ones that aren’t related to information security in any way. Viruses are usually developed to get into operating systems and programs that are outdated or otherwise weak. When a software update is offered, it’s usually because the programmers have found a way to make it more secure (and usually easier to run, too).
- Keep an eye on your employees. Although it isn’t always deliberate, the number one cause of viruses on work computers is employees who accessed unsafe sites or opened an email they shouldn’t have. Whether you need to restrict Internet access, train employees on Internet safety, or instill a new policy into your company manual regarding computer use and viruses, you should always make sure your staff knows the rules regarding viruses and information security.
- Put up protection behind the protection. No matter what business you’re in, anti-virus software simply isn’t enough. Your company’s reputation and your customers’ safety is dependent on your network being a safe, secure place that keeps viruses and other sources away from sensitive information. Sometimes, this means hiring an IT vulnerability manager to help you overhaul your entire network, and other times it means taking steps to improve policy management.
When it comes to viruses and other types of malware, IT solutions don’t always have to be complicated. Sometimes, it’s the small steps (anti-virus software, employee training, limited Internet use) that can have the biggest impact on your information safety measures.
Five Disaster Recovery Planning Tips
If your business is getting ready to set up or install an IT disaster recovery plan, make sure you cover all the bases. Few companies are able to fully recovery from the loss of data or significant downtime, so this is one type of safety net you simply can’t do without.
- Monitor and/or update your disaster recovery plan regularly. The business world and the Internet are both like living, breathing organisms – they change and adapt daily. This means that a disaster recovery plan put in place six months ago might very well be obsolete by the time the unthinkable occurs. Whether you rely on automated monitoring, regular back-up data storage, or an actual physical update of your system, it’s a good idea to include regular updates into your planning and your recovery budget.
- Test the system regularly. Although this is technically part of the monitoring step, it’s a step that 9 out of 10 companies fail to do. But if there are weaknesses in your disaster recovery plan, you might actually be worse off than if you had no plan at all. That’s because you and your team will go through your recovery efforts under the assumption that you were safe from the more pressing issues, and you might fail to perform the most basic – and necessary – steps.
- Keep data stored somewhere else. Whether you keep your backed-up data stored physically off-site or you use offshore storage for all your information needs, having the information away from your own system is the most important thing. This back-up data will need to be updated regularly, according to your recovery point objective (or how reliant your business is on having the most recent data possible).
- Protect the hardware that goes home. If you have laptops that employees take home for work use, you need to install the laptops with theft recovery and data delete options. The top-of-the-line options will be able to return all the necessary information to you and still disable the computer so that the thief can’t get access to the same data.
- Consider hiring someone to do the disaster recovery planning for you. Whether you are a small business without an IT department or a large business whose data planning needs span entire departments and cross-country facilities, this is one area where it doesn’t pay to cut corners.
Disaster Recovery Priorities
It doesn’t matter whether you’re seeking protection against the physical damages of flood and fire or the more pervasive damages of a system that has been infiltrated by hackers – disaster recovery planning is necessary for any business. However, because the scope of potential threats is so large – and because there are so many kinds of threats you may not have even realized – it can be a daunting task to undertake.
Before you do any disaster recovery planning, it’s important to prioritize what’s important for your business. No two disaster recovery plans are alike, and the only way to minimize your own damages is to act accordingly.
Some of the questions you’ll need to ask yourself include:
-
What are the most likely worst-case scenarios? (For example, if you are located in a flood plain, you may need to place a greater focus on keeping physical damages to a minimum. If your company deals with a large amount of personal data, keeping your customer’s information safe might be the most important thing.) How can these be prioritized to streamline the disaster recovery planning stage?
-
What do you need to keep the business running in the event of a disaster? Do you need email? Phones? Access to backed-up data on the system? Alternate computers or technology?
-
What liabilities might you be facing? If your network is infiltrated by hackers, what are the legal ramifications for your company? How much of an effect will this have on your company reputation and your bottom line?
-
How long can your system be down without causing you to go bankrupt? (For example, if you experience a denial of service attack or you simply can’t access your system for a few days, how prepared is your company to “weather the storm?” Do you have access to emergency funds or an alternate way to keep business running?)
-
Is your data somewhere safe? Imagine that you’ll never be able to get your system back up and running again. Do you have backed up data located somewhere where it won’t be damaged?
-
What sort of information sharing system do you have in place? Employees and administrators will need to be kept appraised of the disaster and its recovery efforts. A way to contact everyone is important in making sure that things continue to run as smoothly as possible.
-
How are you going to let your customers know about the situation? Nothing is more irritating to a customer or client than being unable to access your company (either online or in person). If your system is going to be down, or if you need to send out notifications of an information breach, you must have a way to get in contact with all of your customers.
No one likes to think that a disaster can happen to them. However, most businesses will experience some sort of an information emergency during operations. In order to successfully get your company back up and running, it’s important to plan ahead.
Getting Started with Vulnerability Patch Management
Last week, we discussed the benefits of a vulnerability patch management plan in boosting information security on a company-wide level. From IT policy development to network restructuring, there are countless reasons to integrate vulnerability patch management.
Once you decide to start working with an online or local IT consulting firm, you will most likely go through the following steps:
Inventory and Assessment: Not only will your IT consultant assess the strength of your current system from an operating standpoint, but he or she will also inventory the resources you have in the form of hardware, software, bandwidth, and even the employees you can rely on. All of these factors weigh in on the strength and viability of your system.
Monitor and Identify Threats: Using the inventory you currently have (or using new additions based on your consultant’s recommendations), you will begin a monitoring program that finds weaknesses and emerging threats. This may be automated, or it may be part of your consultant’s plan. In either case, you should be able to tell where to put your focus for moving forward.
Move Forward: This includes prioritizing the vulnerabilities, creating a database of solutions based on the prioritization list, and actually implementing the patches. It doesn’t matter whether you immediately apply the patches or if you spread them out over a period of time, this is the point at which you develop a long-term solution to see you and your company through the next few years.
Begin Automation: Making vulnerability patch management a regular part of your business means relaying the appropriate information to administrators and setting up an automated detection patch deployment system. In many cases, this will include training your IT staff on how to read the vulnerability scan results and how to apply solutions before they become liabilities in your business.
Benefits of Vulnerability Patch Management
Many of today’s top companies have been working on vulnerability management for as long as they’ve operated on a network of information technology. After all, information security is an important component of running a successful business – especially when that business works with personal information, finances, and other sensitive data.
However, companies that have an existing vulnerability management plan might not be as protected as they think. Over time, the series of patches used to repair weaknesses or “holes” in the system might burden a network or fail to provide complete safety against penetration. That’s why most IT consultants recommend vulnerability patch management as a way to revitalize an existing system that is either ineffective or that hasn’t been updated in at least a year.
Overall, vulnerability patch management systems work by:
-
Providing a core for all other vulnerability tasks. Instead of merely putting patches on top of patches, you’re looking beyond an immediate solution to an entire restructuring of the way your business handles technology. This also creates a concrete plan of action that can gear your entire company toward a more results-oriented approach to technology.
-
Bringing administrators, technology experts, and separate department together. For a vulnerability patch management program to work effectively, it must become a company-wide solution that pays attention to the organizational hierarchy. What department has the biggest need for vulnerability protection? Where is it the most cost-effective to start? The answers to these questions can be integrated into policy to become a baseline for future vulnerability patch solutions.
-
Eliminating downtime. Whether it’s freeing up a burdened system to run more effectively or freeing up your employees to turn their attention to more pressing tasks, a vulnerability patch management plan is a great way to monitor, revise, and streamline your information system.
Next week, we’ll look at how getting started with vulnerability patch management works and what businesses can expect.
7 Easy Ways to Improve Your Employees’ IT Security
No matter what type of business you’re in, employees remain one of the biggest threats to information security. Enforce these steps, and you’re well on your way to a stronger, more secure network.
-
1. Differentiate between files that contain confidential data and files that don’t. The ones that must be confidential should be dealt with first (whether that means deleting them or encrypting them).
-
2. Only save confidential data in a proper storage files. Don’t allow this type of information to be stored on individual PCs or laptops.
-
3. Keep track of portable storage device use. If a flash drive or portable hard drive contains sensitive information, it needs to be handled properly. Make sure the check out/check in process is formalized and that there is secure storage during non-use.
-
4. Require employees to log out of all applications (or even their computer) when they walk away. Depending on the type of work he or she does, this may need to be enforced even for short breaks.
-
5. Don’t allow employees to save non-work-related files to their computers, This includes pictures, music files, movies, or documents – especially those from illegal download sites. It is too difficult to monitor all files for safety.
-
6. Monitor all software installations. There are many types of free software (such as toolbars, instant messaging applications, and even web browsers) that employees might be tempted to put on their computers. These should only be allowed under your discretion.
-
7. Enforce email and email attachment rules. These should be a part of company policy and be strictly monitored.