Information Security is not just implementing security devices

Most of the organizations feel that by implementing Firewalls, Access Control Lists (ACL's), Intrusion Detection Systems / Intrusion Protection Systems (IDS/IPS) and to some extent implementation of log aggregation(Syslog) are means of achieving information security.
If you ask the CISO's and CIO's of the organizations what measures have they put in for information security, i would say more than 60% would say they have implemented security devices and have a dedicated team monitoring these devices and the network traffic. The part of their problem is also budgets for implementing security processes and solutions, then, what remains is an easy way out to answer stakeholders is to say they have implemented these devices. As i have said in my previous articles, 'Security' is considered as 'necessary evil' in most of the organizations, if management had a choice of not being attacked, they would not have implemented anything at all.
So, the question comes to our minds is, what are best practices for implementing security?
I think security is a combination of
1. People
2. Processes
3. Technology

1. People - You cannot take out the human intelligence, even if you implement hundreds of solutions and implement automation. Humans are required at every stage of security cycle - design, implementation & remediation. One thing to remember is even though the attacks are done by sophisticated tools, they are done by destructive by intelligent minds.

2. Processes - Setting up processes for implementing security controls is they key. Processes are required for every types of controls Preventive, Detective & Corrective. Without processes there is a high possibility of the attacks going unnoticed. For e.g. if you do not implement a monitoring & SIRT (Security Incident Response Team) how much ever devices you implement, the attacks will still happen since the devices will alert but there is nobody to respond to those alerts.

3. Technology - Organizations have to be abreast with new technologies coming up. New technologies do not come up for the heck of creating a product. They are invented or discovered to address a newly found problem which may be critical. Ofcourse the due diligence on feasibility to organization's environment has to be done along with the cost benefit analysis of implementing the technology to the information value.

The other thing that organizations have to keep in mind is that security has to be looked at all 7 layers of OSI model - Physical, Data Link, Network, Transportation, Session, Presentation and Application. Most of the organizations think that if they secure the network perimeter layer, they are secure. However, statistics say that more than 60% hacks are internal and hence solutions have to be implemented to prevent external as well as possible internal attacks.

Information Security - Layered Security Model

Bruce Schneier, the renowned security technologist and author, believed that the mantra for any good security engineer is “Security is not merely a product, but a process. It's more than designing strong cryptography into a system; it's designing the fail-safe system such that, all security measures, including cryptography, work together." 

Steps in Security:

1. Comprehend your network configuration, network traffic and communication systems

2. Prepare a comprehensive Information Security policy, procedure and its implementation plan

3. Obtain an approval for policy and procedure from the management

4. Maintain up to date documentation for entire IT Infrastructure

5. Periodically test & audit your IT infrastructure. Maintain audit trails of all changes

6. Create Security awareness among all users via training, crash courses, quiz, posters, banners etc.

7. Focus to 'Preventive Measures' than 'Corrective Measures'

Layered Security Model:

'Defense is in depth' it is said and it should be followed while designing any security solution.

The layered security model consists of 4 layers

1. Perimeter Defense

2. Operating Systems & Servers  protection

3. Workstation Security

4. Information Protection

1. Perimeter Defense

This is like your fence, walls & roofs of the house. The perimeter security solutions include Firewalls, Proxy Servers, Content Filters, Routers etc. A survey has showed that majority of the attacks (70-80%) are internal attacks (i.e. somebody within your organization) and hence the security solution should also consider this fact in the designing stage.

The common attacks at the perimeter security are Denial of Service 'DOS' attacks and Man in the Middle attacks.

2. Operating Systems & Servers Protection

This layer is the protection of Application, Web, Database Servers and all other infrastructure servers such as Mail, DNS, Proxy etc.

While traffic is regulated at the perimeter depending on the needs of the organization, the applications utilizing the traffic run on different application/webservers which in turn run on operating systems. An abuse of operating system privileges can potentially compromise network security. Users with access to the underlying operating system can jeopardize the availability and integrity of the firewall and expose critical network resources to both internal and external security threats. Hardening this layer will protect the network from number of internal threats.
Vulnerabilities exist in operating systems, web servers, proxy servers, mail servers and application servers that need patches / service packs / hotfixes to fill those holes.
An organization may have multiple operating systems in its network. It is the responsibility of the OS vendors to make their products secure. In addition the user organization also has the responsibility of applying the available security features. 
Common solutions for OS protection
1. OS Hardening
2. Periodic security patch implementation
3. Logging
4. File Integrity Monitoring
5, Review of superuser rights on a periodic basis

3. Workstation Security

We need to have workstation security for two reasons:

• to protect against someone trying to attack from within the network
• to protect the data stored on workstation from someone coming in through the firewall

Common solutions for Workstation Security:

1. Anti-Virus

2. Anti-Malware

3. End Point protection

4. Information Protection

This layer focuses on protecting the actual business critical data. Businesses should identify critical data and security teams should design an optimum cost effective solution on protecting the actual information.
Common solutions for Information Protection:
1. Database encryption
2. Data Masking
3. Data Loss Prevention



CONCLUSION
Security is not just perimeter security as most of us think. There are a lot of APT's (Advanced Persistent Threats) that can penetrate the defense of perimeter security and either gain access of your environment or stop you from having access to your own environments. All four layers of security should be looked at while designing a robust security solution.
Also Security cant just be achieved by implementing robust security solutions,you have to set up right processes and you have to have right set of people to identify & mitigate the threats. 
The idea behind multi-layered defense security is to manage the security risk with multiple defensive strategies, so that if one layer of defense turns out to be inadequate, another layer of defense will, ideally, prevent a full breach.

Big Data and Information Security

The only thing Constant in life is 'Change' & nothing else can be true about it than 'Technology'. Technology today is changing at rapid pace and more so are the latest buzz words. The new buzzword these days is 'Big Data'.

Its a small name for a powerful concept: more precisely that data has utility and when data size increases exponentially, the utility of data increases non linearly. In other words opportunities to make use of data for productivity compound along with the size of the data and so does its management.

This should be more relevant to Organizations who are going through Cloud transition. Since they are trying to centralize, standardize and virtualize at the data that leads to centralization and aggregation of data that transforms the dispersed datasets across their environment to a centralized  aggregated 'Big Data'.

For those in Information Security, 'Big Data' poses a 'Threat' as well as an 'Opportunity'.

Threat

It is needless to say that centralized, extremely large volumes of data has a significant security impact. Imagine you storing all your jewelry in one Cupboard in one of your homes. Although it becomes simpler for you to manage the inventory of the jewelry, it also is a big risk, since the thieves know that all your jewelry is in one place & they target that once place. Although you may implement 100 security controls to that cupboard but you are never sure that your jewelry is 100% safe. Similarly if all your data is in one single location, it is an easy target for the hackers, since they now know that they have a specific place to target their attack.

However, its not always the 'Worthiness' of the target that constituents a risk. It is also because the huge size of data that pose challenge to implement security controls. Just imagine to implement a security solution of encrypting an exabyte of data!!! Also consider that fact that how many AV, IDS and DLP solutions would actually work on this amount of data.

Hence not only does the big data overwhelm information security folks, the tools required to implement security controls over this data are also complicated to deploy. Thus big data makes information security professionals think on the security solutions to implement in an effective and cost efficient manner.

Opportunity

Along with Threats, there are also Opportunities. Although distributed or dispersed data has an advantage of not having a targeted attack to gain entire information, it also has a problem of 'Where does my organization data live?' and 'Where all do i put my security controls?'  

By this i mean - Information Security professionals have challenge on identifying valuable / business critical data and to implement cost effective solutions to implement it. For e.g. if you have a 20 grand diamond necklace in one place and 30 grand gold in another place, what security controls will you implement at these locations if you have a limited budget.

As data becomes centralized, while the specifics of data storage at a central location becomes complicated, the "sprawl" of the data within the enterprise can be reduced. Getting away from this "sprawl" can be beneficial as we can improv the security controls over the centralized data.

Moreover, the data itself can be analyzed to find fraud since all the data is available at a centralized place. What is required is a data mining solution that can mine the data and provide us only the useful data that needs to be protected.

Last but not the least, its an opportunity to revisit the legacy environment and apply resources to secure the data. Anything that makes the management to think on investing in information security is a way for the savvy information security practitioner to capitalize. Information Security is obviously a huge part of data strategy for any organization, so facing the 'big data' movement, obviously is a challenging and interesting journey of a Security professional.

BYOD Security

In this modern era of IT, organizations are allowing BYOD 'Bring Your Own Device' to reduce both Capital and Operations cost. BYOD has also created new opportunities for businesses looking to increase productivity from mobile employees and remote offices, but security still remains an area of concern for the IT departments and CIO's. According to Gartner's report from Nov 2011, 86% of enterprise respondents are planning to purchase a smartphone or tablets in year 2012.
According to this survey, the top security issues includes the use of privately owned devices and deployment of new mobile platforms. Gartner recommended focusing on mobile data protection (MDP), network access control (NAC), and mobile device management (MDM) tools. Survey results also indicate enterprises are providing support for BYOD programs, offering technical support for 32 percent of smartphones, 37 percent of tablets and 44 percent of laptops. However, the report noted that support varied greatly by region. Mature countries consider BYOD programs as bringing with them both legal and technical issues, whereas emerging countries only see technical issues. For instance, mature regions are more concerned with security and data privacy regulations for immature MDM than emerging regions.

Organizations can have tight control over company issued smartphones, tablets or laptops. However, there is little or no control over privately owned devices. When employees install apps on smartphones or tablets an at the same time connect with work PC for sync, there is a risk that the downloaded app may infect the entire network. A study found that only 10% users auto-lock their smartphones or tablets with password protection. Only one in four secure the personal smartphones they use for work, and only one in three adequately protect their laptops. More than 50% of employee’s personal devices are unsecured, lost phones, laptops, and tablets constitute a significant data breach risk.
Corporations that allow 'BYOD' should implement a strict BYOD policy to help IT staff manage these devices and ensure network security.

What is the difference between personal and employer issued mobile devices?
Mobile devices provided by your employer requires a “company mobile liability policy.” This means they not only provide and pay for your mobile device, they also dictate what you can and can’t do on the device. In most of the cases, the employer may have remote capabilities to monitor activity and, in the event of loss or employee termination, wipe the data.

“Employee mobile liability policies” are for employees who prefer to BYOD. While these employees may pay for their own devices and their monthly data plans, but the same restrictions can (and should) be imposed on employees who use personal devices at work. If employee chooses to use personal device for work purposes, at any time, for any reason, the employer will more than likely want control over that device. This means that, again, the employer may have remote capabilities to monitor activity wipe employee's device’s data if it is lost or you resign or are fired.

In both situations, the employer will be liable for leaked data. So if employees choose to BYOD, they should be prepared to give up some liberties.

Compliance vs Security

We all Security folks face various regulatory compliance requirements in our lives be it SOX, PCI, HIPAA, GLBA etc. & we feel that by implementing security controls that are written in these compliances will solve our issues.
But is it so? I don't think so...The controls mentioned in the compliance requirements only guide us on how to keep our Organization data safe & morover they are updated either quarterly,semi-annually or annually. Whereas hackers, crackers are finding new attacks daily or should I say every second.
Also, I feel some of the organizations treat security as a 'Necessary Evil' just to comply to Compliance requirements. Instead of implementing full fledged solutions they implement low cost solutions that will help them pass the regulatory audits. But I feel this approach is wrong, look at what happened to Sony whose Playstation site was hacked & they lost their precious customer data consisting of credit cards & PII (Personally identifiable Information) & they lost their credibility in the market.
Security world, I believe is a totally different world than the Compliance World. Although Security organization should align with compliance Organization, it should go beyond that & suggest more robust solutions & try to convince the management about its necessity. Organizations management will be only convinced if they see
1. Monetory loss to the Organization
2. Loss of Brand Value
3. Loss of critical Information
4. Risk of legal law suites & offcourse
5. Compliance to Regulatory requirements

These are the key drivers for any organizations that will drive them to implement robust security solutions instead of just focussing on passing their yearly audits.
Also, we as Security professionals need to align the solution to meet business requirements that would not be as a hindrance in the business.