In the increasingly federated, network-based IT environment, perimeter security is important, but not sufficient by itself to protect a company’s secrets, says Mike Rothman, president and principal analyst of Security Incite and a former Meta Group security analyst.
Firewalls, demilitarised zones and similar boundary security technologies and methodologies are certainly still important for protecting your network from internet-based attacks, he says. But they’re not enough.
“The problem with depending totally on perimeter security is that it is based on the idea that all enemies are outside, and that is not always a good presumption,” he says. “There is a growing recognition that employees do not always do the right thing, either through malice or by accident.”
Also, as companies increasingly partner to meet the demands of a fast-evolving, worldwide marketplace, they need to let employees of partner companies — who may also be competitors in other areas — access specific applications and data inside the corporate firewall.
Based on these realities, Rothman recommends what he calls “pragmatic security”, which arranges security according to different domains. The first of these is infrastructure, which focuses on the traditional areas of perimeter and physical security.
The second level is data security, which includes the following:
1. Security levels: “Data security starts by recognising that different sets of information require different levels of security,” he says. For instance, an organisation might give outside business partners access to design data for a new product they are developing jointly. It might restrict access to the corporate email system to employees, and restrict access to corporate financials and employee and customer personal information to specific individuals.
2. Security policy: This defines exactly who sees what information on the enterprise network. The beauty of modern, network-based IT architectures is that all information is potentially available on the network. The problem is that all information, including information regulated by Sarbanes-Oxley and other regulations, is potentially available to anyone who can get on the network.
3. Compliance: In the worldwide business environment that many companies operate in today this is a complex area because each country has its own regulations. Thus, it’s not enough for a US-based company to meet Sarbanes-Oxley and HIPAA requirements for protecting financial and personal medical information. If that entity also operates in the UK, for instance, it must also secure employee personal information and track any access to that information to meet UK laws.
4. Ease of use: This is vital for good security. Without it, users won’t obey security rules. Among business users, security has the reputation of getting in the way of accomplishing anything. Faced with having to remember complex, 50-character password strings that change monthly, users will write the passwords on sticky notes and attach them to their monitors, making the passwords available to anyone who walks past their office door.
5. Role-based security: “This can be useful for some applications, and SAP, for instance, employs it,” Rothman says. However, it has its limits and Sarbanes-Oxley, for example, requires that individuals accessing regulated corporate financial information be individually identified, and that everything they do with or to that information be logged under their name.
6. Virtualised organisations: Security does not stop at the corporate perimeter. Today, as mentioned above, companies commonly create close partnerships with sub-contractors and other business partners for specific projects, but those partners could be competitors in other areas of business activity. Many companies also outsource parts of their infrastructure containing highly sensitive information that employees must be able to access securely. Rothman sees federated identity management as becoming important because it relieves the organisation of the need to manage the identities of both its own employees and those of business partners as well. This makes security administration easier and eliminates the requirement for legitimate users from outside to use a special password to get into the network.
7. Network access control: With increasing numbers of employees carrying portable computers and intelligent mobile devices, and with wi-fi-enabled smart phones beginning to appear, “the enterprise must be sure that the right people are accessing the network, from the right places and using the right devices, and that their devices have the right antivirus updates operating,” Rothman says. “If they do not, then you want to quarantine them until the situation can be rectified.”
8. Network traffic management: “Once I know who is on my network, and what they are doing, I can manage network traffic to restrict access to specific databases only to those who are authorised to see them,” Rothman says. This is the next level of network-based security. The concept is that users who are not authorised, for example, to see HR data on employees, don’t even see the server or application that contains that information on their version of the network. “This takes a lot of network intelligence and many organisations are not there yet, but it is definitely on the horizon,” he says.
9. Deprovisioning: Too many companies neglect to cancel network access for individuals who leave the company, or to cancel access to specific data when an individual’s responsibilities change and they no longer requires access to those applications. In some cases, former employees continue to have access to corporate networks and data long after they have left, and that’s a security nightmare. Federated identification management can help by allowing some deprovisioning to be handled by business partners.
10. Oversight: Sarbanes-Oxley and other regulations require reporting on access to specific information. However, “it is important to realise that you are not just trying to impress the auditor,” Rothman says.
“Ultimately, you have to define what success means in terms of data security, and your reporting needs to demonstrate that you meet that level of success. But people should not think that reporting is someone’s job. The job is security, and reporting is part of that.”