BeyondTrust

Security In Context

Bringing you news and commentary on solutions and strategies for protecting your critical IT infrastructure.

Enterprise Security and Risk Management

Post by Morey Haber August 23, 2011

Searching the internet finds a plethora of definitions, services, products, solutions, and even training classes for Enterprise Security and Risk Management. The topic is so broad that almost every security vendor falls into this category. At the middle of almost all the definitions (excluding physical security theft) is the protection of an organizations most treasured resource: Information.

 

Corporate information can generally be divided into three categories:

  • Public: Accessible to everyone in the company. This is commonly displayed as an intranet bulletin board or even through Human Resources.
  •  Sensitive: This data is sensitive to only the individuals, groups, and departments that need it. It is vast majority of data in an organization and is sensitive to the users that created it and need it for daily operations.
  • Confidential: This data contains everything from personal information, passwords, credit cards, and even company secrets (new products, employee salaries, etc.)

Confidential information is the most valuable to an organization and generally the target for an attack and extraction for illegal monetary gain. This information can come from a wide variety of computing resources as we move outward from the center of the diagram. Protecting servers and workstations is a mature discipline with plenty of tools and solutions to assess vulnerabilities, risk, and data. Other categories such as the proliferation smart phones and emergence of cloud computing represent  untested security models for users, business transactions, and other physical devices that may interact with them. Attacks on these new technologies are currently challenging the traditional solutions for Enterprise Security and Risk Management.

For example,  my team and have been working with cloud providers and recently stood up some fresh images for a new project. After a few minutes of exposing the new image to the internet, it was infected. We did not even have a chance to load any management utilities or even perform a vulnerability assessment since the default image provided by the vendor had only service packs applied and did not contain any security updates since the last service pack was issued.  From an enterprise security and risk management perspective, you would never stand up a new production server and make it available until it was fully patched, properly configured, and past quality assurance checks. So why would depending on a cloud resource be any different knowing that the vendor providing the image is not keeping it fully patched in the first please. Consider if you would let a rooted smart phone on your network as well. Both of these technologies have access to information, represent changes to the technology landscape, and can not be controlled with current documented and enforceable security procedures for enterprise security and risk management.

The definition of enterprise security and risk management is incredibly diverse. As we introduce new technologies to increase efficiency, lower cost, make us competitive, and provide easier access to information, we potentially introduce new risks and attack vectors that can compromise our most confidential information. Current procedures and tools for these technologies are just emerging and will add another layer of security management to implement and manage. This does not need to be another vendor and with yet another solution. It can just be an expansion of the toolsets you have to meet current challenges or the introduction of one vendor to manage all of your unified vulnerability management needs. For more information on how eEye meets these needs, please click here. Our technology and solutions are addressing these emerging problems and can provide the relief and products your organization needs to safeguard your information.

Additional articles

BI-Qualys-Connector-IMG1

Getting More Value from QualysGuard Vulnerability Data with BeyondInsight v5.1

If your vulnerability assessment scans can’t produce meaningful and actionable reports, performing a scan does no good for anyone. If you’ve read my other blog posts, you know I have no qualms about stating that BeyondTrust provides the best vulnerability reporting in the industry. Ask your favorite analyst and they’ll tend to agree. Of course,…

Post by Morey Haber April 18, 2014
Tags:
, , , , , , , ,
insider-threat-fed

Mitigating Inside Threats to U.S. Federal IT Environments

Recent high-profile cases have increased the perceived risks that go along with disclosure and usage of confidential information. One of the most difficult security threats to mitigate is an attack from the inside. When an over-privileged user, such as an unhappy current or former employee, contractor, or consultant, begins navigating your network, how will you…

Post by BeyondTrust Software April 17, 2014
Tags:
, , , , ,

Are you a Target? Investigating Security Breaches with Kevin Johnson

Last week, over 1,000 IT security professionals watched as Kevin Johnson, CEO of Secure Ideas, presented his expert opinion on lessons learned from recent, high-profile retail breaches. Here’s a summary of key takeaways from the webcast plus an on-demand recording of the full, 60-minute presentation. Understanding the “why” behind attacks According to Kevin, the primary…

Post by Chris Burd April 17, 2014
Tags:
, , , , ,