During last week’s information security Midwest InfraGard SuperConference, the FBI stressed concern about the growing problem of intellectual property theft from the United States via espionage. China accounts for 90% of that espionage so it was no surprise to learn that China was in the news for stealing information. Since over $250 billion worth of intellectual property is stolen annually from the United States, we must realize information security not only protects our businesses and organizations. It is also important to the United States government and our national economy.
Foreign governments and corporations target our government, corporate and academic organizations to obtain information that gives them military and economic advantages. Blueprints, price lists, marketing and sales information, new product information, electrical energy demand and capacity, manufacturing science, etc. can all be used to cut costs, fix pricing, flood markets, and leapfrog US trade, regulations and competitiveness. For this reason, information security across all sectors of our economy is imperative.
For the unlucky, zero-day exploits are available to the right buyer to successfully target just about anyone. This will always be the case. However, in most cases, breaches are preventable. For this reason, this post focuses on a few security basics, which make it difficult for most attackers to succeed. These include:
- Vulnerability management
- Identity management
- Security awareness
Vulnerability management, identity and access management, and security awareness form a trio of processes that must work efficiently to prevent attacks. Users are often targeted via phishing attacks, which make them the first line of defense against attacks. If user workstations, applications on those workstations or network systems have open vulnerabilities, you are susceptible to an easy exploit. Lack identity management leads to easily guessed passwords of current workers or even worse, enabled accounts of workers who leave the company.
There’s really no excuse to fall short in any of the three areas since these processes are promoted as keys to reduced risk. Unfortunately, security professionals often fail to apply the appropriate focus to improve security around vulnerability management, identity management and awareness.
Vulnerability management is an information security commodity.
Scanning tools are readily available and effective, and the importance of patching is widely known. Since vulnerability management can be treated as a commodity service, it even makes sense in some situations to outsource this capability to firms such as Avatier who have the tools and established processes designed to make remediation as efficient as possible.
Identity management is important to information security.
Following a phased implementation allows for quick preventative gains and reduced information security risks. A sound enterprise password management solution can be implemented quickly. An automated password reset tool improves security as well as reduces operational headaches when it includes self-service password management capabilities. Once an enterprise password manager is in place, you’re ready to automate user account provisioning for new hires and account disable capabilities for terminations. By focusing on strong passwords and real time de-provisioning of terminated employee, you prevent inappropriate access to your systems, applications and information.
Educate users to prevent information security breaches.
As shown during the InfraGard Conference, IT organizations can inexpensively perform phishing campaigns against their employees. Such eye-opening campaigns raise awareness and truly educate business users about information security risks.
While no computer network is completely safe from attack, the risk of compromise can be dramatically reduced when we focus on core security principles.
IT professionals and organizations can leverage news reports such as the Chinese hacking attacks to educate management about risks and obtain funding. InfraGard also stressed the most secure organizations reduce risks by improving processes, innovative thinking and strategic purchases focused on reducing risk.
Follow Ryan Ward, Avatier Chief Innovation Officer and Chief Information Security Officer, on Twitter at https://twitter.com/ryawarr
Watch Ryan describe how to return identity and access management to the business user with Avatier’s Identity Access Management software.
Get Our Free Identity Management Analyst White Paper
Learn the future of identity management and how IT automation combined with self-service administration create competitive advantage. KuppingerCole’s Assignment Management — Think Beyond Access describes the IT shift from tightly controlled identity management processes to more open business user administration.
