BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Enterprise Security and Risk Management

Posted August 23, 2011    Morey Haber

Searching the internet finds a plethora of definitions, services, products, solutions, and even training classes for Enterprise Security and Risk Management. The topic is so broad that almost every security vendor falls into this category. At the middle of almost all the definitions (excluding physical security theft) is the protection of an organizations most treasured resource: Information.

 

Corporate information can generally be divided into three categories:

  • Public: Accessible to everyone in the company. This is commonly displayed as an intranet bulletin board or even through Human Resources.
  •  Sensitive: This data is sensitive to only the individuals, groups, and departments that need it. It is vast majority of data in an organization and is sensitive to the users that created it and need it for daily operations.
  • Confidential: This data contains everything from personal information, passwords, credit cards, and even company secrets (new products, employee salaries, etc.)

Confidential information is the most valuable to an organization and generally the target for an attack and extraction for illegal monetary gain. This information can come from a wide variety of computing resources as we move outward from the center of the diagram. Protecting servers and workstations is a mature discipline with plenty of tools and solutions to assess vulnerabilities, risk, and data. Other categories such as the proliferation smart phones and emergence of cloud computing represent  untested security models for users, business transactions, and other physical devices that may interact with them. Attacks on these new technologies are currently challenging the traditional solutions for Enterprise Security and Risk Management.

For example,  my team and have been working with cloud providers and recently stood up some fresh images for a new project. After a few minutes of exposing the new image to the internet, it was infected. We did not even have a chance to load any management utilities or even perform a vulnerability assessment since the default image provided by the vendor had only service packs applied and did not contain any security updates since the last service pack was issued.  From an enterprise security and risk management perspective, you would never stand up a new production server and make it available until it was fully patched, properly configured, and past quality assurance checks. So why would depending on a cloud resource be any different knowing that the vendor providing the image is not keeping it fully patched in the first please. Consider if you would let a rooted smart phone on your network as well. Both of these technologies have access to information, represent changes to the technology landscape, and can not be controlled with current documented and enforceable security procedures for enterprise security and risk management.

The definition of enterprise security and risk management is incredibly diverse. As we introduce new technologies to increase efficiency, lower cost, make us competitive, and provide easier access to information, we potentially introduce new risks and attack vectors that can compromise our most confidential information. Current procedures and tools for these technologies are just emerging and will add another layer of security management to implement and manage. This does not need to be another vendor and with yet another solution. It can just be an expansion of the toolsets you have to meet current challenges or the introduction of one vendor to manage all of your unified vulnerability management needs. For more information on how eEye meets these needs, please click here. Our technology and solutions are addressing these emerging problems and can provide the relief and products your organization needs to safeguard your information.

Additional articles

gartner market guide image - aug 2014

Introducing the Gartner Market Guide for Privileged Account Management

Posted July 29, 2014    Chris Burd

Gartner recently released a new Market Guide for Privileged Account Management (PAM), and we’d like to share a complimentary copy with you. The report includes PAM market analysis and direction, vendor overviews, and recommendations for selecting PAM solutions for your environment. BeyondTrust is one of two representative vendors (out of 20) to address all solution…

Tags:
, , , , , , , ,
Integrating Least Privilege and Password Management to Solve Account Security Challenges

Integrating Least Privilege and Password Management to Solve Account Security Challenges

Posted July 24, 2014    Morey Haber

There is a reason all BeyondTrust Privileged Account Management (PAM) solutions share the PowerBroker name: They all inherently enable you to reduce user-based risk and can be integrated under a centralized IT risk management platform. Here’s one common use case that demonstrates how this integration changes the playing field. Consider the challenge of privileged access:…

Tags:
, , , , ,
PowerBroker Password Safe Password Age Report

Reshaping Privileged Password Management with Password Safe 5.2

Posted July 21, 2014    Martin Cannard

Today, we’re pleased to unveil the latest edition of our privileged password management solution, PowerBroker Password Safe. I’ll start with a brief intro of what’s new and then tell you a little about the driving factors behind Password Safe development. New features for mitigating password risk and ensuring accountability enterprise-wide Here’s the 10,000-foot overview of…

Tags:
, , ,