Most of the organizations feel that by implementing Firewalls, Access Control Lists (ACL's), Intrusion Detection Systems / Intrusion
Protection Systems (IDS/IPS) and to some extent implementation of log
aggregation(Syslog) are means of achieving information security.
If you ask the CISO's and CIO's of the organizations what measures have they put in for information security, i would say more than 60% would say they have implemented security devices and have a dedicated team monitoring these devices and the network traffic. The part of their problem is also budgets for implementing security processes and solutions, then, what remains is an easy way out to answer stakeholders is to say they have implemented these devices. As i have said in my previous articles, 'Security' is considered as 'necessary evil' in most of the organizations, if management had a choice of not being attacked, they would not have implemented anything at all.
So, the question comes to our minds is, what are best practices for implementing security?
I think security is a combination of
1. People
2. Processes
3. Technology
1. People - You cannot take out the human intelligence, even if you implement hundreds of solutions and implement automation. Humans are required at every stage of security cycle - design, implementation & remediation. One thing to remember is even though the attacks are done by sophisticated tools, they are done by destructive by intelligent minds.
2. Processes - Setting up processes for implementing security controls is they key. Processes are required for every types of controls Preventive, Detective & Corrective. Without processes there is a high possibility of the attacks going unnoticed. For e.g. if you do not implement a monitoring & SIRT (Security Incident Response Team) how much ever devices you implement, the attacks will still happen since the devices will alert but there is nobody to respond to those alerts.
3. Technology - Organizations have to be abreast with new technologies coming up. New technologies do not come up for the heck of creating a product. They are invented or discovered to address a newly found problem which may be critical. Ofcourse the due diligence on feasibility to organization's environment has to be done along with the cost benefit analysis of implementing the technology to the information value.
The other thing that organizations have to keep in mind is that security has to be looked at all 7 layers of OSI model - Physical, Data Link, Network, Transportation, Session, Presentation and Application. Most of the organizations think that if they secure the network perimeter layer, they are secure. However, statistics say that more than 60% hacks are internal and hence solutions have to be implemented to prevent external as well as possible internal attacks.
If you ask the CISO's and CIO's of the organizations what measures have they put in for information security, i would say more than 60% would say they have implemented security devices and have a dedicated team monitoring these devices and the network traffic. The part of their problem is also budgets for implementing security processes and solutions, then, what remains is an easy way out to answer stakeholders is to say they have implemented these devices. As i have said in my previous articles, 'Security' is considered as 'necessary evil' in most of the organizations, if management had a choice of not being attacked, they would not have implemented anything at all.
So, the question comes to our minds is, what are best practices for implementing security?
I think security is a combination of
1. People
2. Processes
3. Technology
1. People - You cannot take out the human intelligence, even if you implement hundreds of solutions and implement automation. Humans are required at every stage of security cycle - design, implementation & remediation. One thing to remember is even though the attacks are done by sophisticated tools, they are done by destructive by intelligent minds.
2. Processes - Setting up processes for implementing security controls is they key. Processes are required for every types of controls Preventive, Detective & Corrective. Without processes there is a high possibility of the attacks going unnoticed. For e.g. if you do not implement a monitoring & SIRT (Security Incident Response Team) how much ever devices you implement, the attacks will still happen since the devices will alert but there is nobody to respond to those alerts.
3. Technology - Organizations have to be abreast with new technologies coming up. New technologies do not come up for the heck of creating a product. They are invented or discovered to address a newly found problem which may be critical. Ofcourse the due diligence on feasibility to organization's environment has to be done along with the cost benefit analysis of implementing the technology to the information value.
The other thing that organizations have to keep in mind is that security has to be looked at all 7 layers of OSI model - Physical, Data Link, Network, Transportation, Session, Presentation and Application. Most of the organizations think that if they secure the network perimeter layer, they are secure. However, statistics say that more than 60% hacks are internal and hence solutions have to be implemented to prevent external as well as possible internal attacks.
