BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Enterprise Security and Risk Management

Posted August 23, 2011    Morey Haber

Searching the internet finds a plethora of definitions, services, products, solutions, and even training classes for Enterprise Security and Risk Management. The topic is so broad that almost every security vendor falls into this category. At the middle of almost all the definitions (excluding physical security theft) is the protection of an organizations most treasured resource: Information.

 

Corporate information can generally be divided into three categories:

  • Public: Accessible to everyone in the company. This is commonly displayed as an intranet bulletin board or even through Human Resources.
  •  Sensitive: This data is sensitive to only the individuals, groups, and departments that need it. It is vast majority of data in an organization and is sensitive to the users that created it and need it for daily operations.
  • Confidential: This data contains everything from personal information, passwords, credit cards, and even company secrets (new products, employee salaries, etc.)

Confidential information is the most valuable to an organization and generally the target for an attack and extraction for illegal monetary gain. This information can come from a wide variety of computing resources as we move outward from the center of the diagram. Protecting servers and workstations is a mature discipline with plenty of tools and solutions to assess vulnerabilities, risk, and data. Other categories such as the proliferation smart phones and emergence of cloud computing represent  untested security models for users, business transactions, and other physical devices that may interact with them. Attacks on these new technologies are currently challenging the traditional solutions for Enterprise Security and Risk Management.

For example,  my team and have been working with cloud providers and recently stood up some fresh images for a new project. After a few minutes of exposing the new image to the internet, it was infected. We did not even have a chance to load any management utilities or even perform a vulnerability assessment since the default image provided by the vendor had only service packs applied and did not contain any security updates since the last service pack was issued.  From an enterprise security and risk management perspective, you would never stand up a new production server and make it available until it was fully patched, properly configured, and past quality assurance checks. So why would depending on a cloud resource be any different knowing that the vendor providing the image is not keeping it fully patched in the first please. Consider if you would let a rooted smart phone on your network as well. Both of these technologies have access to information, represent changes to the technology landscape, and can not be controlled with current documented and enforceable security procedures for enterprise security and risk management.

The definition of enterprise security and risk management is incredibly diverse. As we introduce new technologies to increase efficiency, lower cost, make us competitive, and provide easier access to information, we potentially introduce new risks and attack vectors that can compromise our most confidential information. Current procedures and tools for these technologies are just emerging and will add another layer of security management to implement and manage. This does not need to be another vendor and with yet another solution. It can just be an expansion of the toolsets you have to meet current challenges or the introduction of one vendor to manage all of your unified vulnerability management needs. For more information on how eEye meets these needs, please click here. Our technology and solutions are addressing these emerging problems and can provide the relief and products your organization needs to safeguard your information.

Additional articles

VMware Hardening Guidelines-img3

How to Audit VMware ESX and ESXi Servers Against the VMware Hardening Guidelines with Retina CS

Posted February 27, 2015    BeyondTrust Research Team

Retina CS Enterprise Vulnerability Management has included advanced VMware auditing capabilities for some time, including virtual machine discovery and scanning through a cloud connection, plus the ability to scan ESX and ESXi hosts using SSH. However, in response to recent security concerns associated with SSH, VMware has disabled SSH by default in its more recent…

Tags:
, , , ,
dave-shackleford-headshot

Privileged Passwords: The Bane of Security Professionals Everywhere

Posted February 19, 2015    Dave Shackleford

Passwords have been with us since ancient times. Known as “watchwords”, ancient Roman military guards would pass a wooden tablet with a daily secret word engraved from one shift to the next, with each guard position marking the tablet to indicate it had been received. The military has been using passwords, counter-passwords, and even sound…

Tags:
, , ,
Privileged Account Management Process

In Vulnerability Management, Process is King

Posted February 18, 2015    Morey Haber

You have a vulnerability scanner, but where’s your process? Most organizations are rightly concerned about possible vulnerabilities in their systems, applications, networked devices, and other digital assets and infrastructure components. Identifying vulnerabilities is indeed important, and most security professionals have some kind of scanning solution in place. But what is most essential to understand is…

Tags:
, , , , ,