BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Don’t say “Lockdown”!

Posted October 15, 2012    Peter McCalister

Here at BeyondTrust, we have been fortunate to be able to speak with thousands of security professionals in dozens of industries, and it is astonishing how differently organizations assess risk and approach computer security. Some organizations are very strict about security and are able to completely lock down desktops. Others are significantly more lax about the security of their desktop computers, and place a bigger emphasis on servers and backend infrastructure. What is interesting about these two ends of the spectrum is how the organization ends up where they are. When we speak to IT professionals who have loosely managed desktops, they universally cite the fact that it is difficult to change the culture of the organization to implement the controls to better manage those desktops and improve security. For folks who have very locked down environments, we find that they did, in fact, have to change the culture in order to improve security. Here are a few things that you can do to help smooth the transition to a new and improved security position.

  • Don’t use words like “Locked Down Desktop.”  The end users will freak out if you say this.  Even though the end user doesn’t own the desktop, they still think it is theirs.  It’s better to brand any project to improve desktop security as “Trusted Desktop Initiative” or “Secure Desktop” instead of using the words “lock down.”
  • Do explain to the end users why improving security is good for them.  More security means fewer viruses and malware.  A well-managed desktop means fewer application conflicts.  Following security best practices like removing admin rights from users, means less configuration drift and more stability, reliability and speed in the long run.
  • Don’t try to do too much.  Many organization want to roll out too much security, all at the same time.  Some organizations want to deploy more control at the same time they roll out a new operating system.  The most successful organizations that we have worked with set the foundation first.  By implementing security best practice (Anti-virus, Least Privilege, Vulnerability Scanning, etc.) and then layering on additional tools (Application Whitelisting, Device Control, etc.), you will end up with a more robust implementation in the long run.
  • Do get executive buy-in.  Everything goes much more smoothly when the boss sponsors what you are trying to do.
  • Don’t go it alone.  As we learn more about our industry and what is available, we realize just how much we don’t know.  Technology is constantly changing, and no one person can keep up with all of the knowledge, so seek out advice from others.  Talk with your vendors, peers at other organizations and your colleagues.  They can be a huge asset when undertaking a project to improve security.
  • Don’t forget to communicate.  End users hate surprises.  All they want to do is get their job done.  That’s how their performance is measured.  If they are surprised by some new security restriction that slows them down, they are going to kick and scream, but if you’ve communicated appropriately, your chances of headaches are lessened.
Tags:
, ,

Leave a Reply

Additional articles

PowerBroker Password Safe Password Age Report

Reshaping Privileged Password Management with Password Safe 5.2

Posted July 21, 2014    Martin Cannard

Today, we’re pleased to unveil the latest edition of our privileged password management solution, PowerBroker Password Safe. I’ll start with a brief intro of what’s new and then tell you a little about the driving factors behind Password Safe development. New features for mitigating password risk and ensuring accountability enterprise-wide Here’s the 10,000-foot overview of…

Tags:
, , ,
PowerBroker for Windows tamper protection

PowerBroker for Windows 6.6 Tamper Protection

Posted July 18, 2014    Morey Haber

I have a bone to pick: Stopping an administrator from performing an action on a system is futile endeavor. As an administrator, there is always a way to circumvent a solution’s from tampered protection. Really! By default, Windows administrators have unrestricted access to the system – and even though an application, hardened configuration, or group policy…

Tags:
, ,
PowerBroker for Windows can be configured to automatically identify the end user’s language preference

Implementing Least Privilege Around the World with PowerBroker for Windows

Posted July 17, 2014    Morey Haber

BeyondTrust recognizes that international, multilingual businesses have unique operating challenges, especially when it comes to implementing enterprise software. PowerBroker for Windows is a least-privilege solution often deployed across thousands of systems spanning multiple geographies and protecting users of diverse backgrounds. Earlier this year, PowerBroker for Windows introduces new data privacy features for EMEA and APAC,…

Tags:
, ,