Forrester security show stresses risk management
633524
Enterprise security decision makers have long been more likely to be swayed by flashy new technologies than by the notion of comprehensive IT restructuring to protect data and other corporate assets, but the situation is evolving rapidly, according to experts participating in Forrester Research's ongoing Security Forum.
281644
The head of information security at Toyota spoke candidly this week to an audience of press, analysts and IT bosses about his concerns over claims made by some security vendors and resellers.
266836
Across the security industry, experts are encouraging businesses to abandon piecemeal IT systems and data-defense efforts in favor of overarching risk management strategies.According to some customers, consultants, and vendors, the strategy is starting to prove particularly helpful in addressing issues of identity management and access control.Long identified by industry analysts as an area where businesses often end up "chasing rainbows" and getting involved in never-ending projects, experts contend that by adopting a risk-based model to drive identity management, customers' goals are actually being realized."When developing our architecture, it became very clear that one of the processes that was important to tackle before starting to change things in one region or business unit was to do risk assessment and integrate all the subjects related to access control," said Paulo Martins, enterprise identity and access manager at financial services giant ABN AMRO.In 2006, the banking company made a decision to rework its identity infrastructure as part of an effort to make access control an even more central focus of its enterprise security strategy.Rather than simply looking for a new technology to improve its standing, ABN AMRO found that by getting a fix on the areas of its business where controlling access to sensitive data was most crucial -- and then assessing the varying levels of efficacy within its existing operations -- it found a way to move its project forward faster and with a greater sense of direction."As companies get larger and the numbers of applications increase, and they grow through mergers and acquisitions, they find that they have different levels of maturity related to identity and access," said Martins. "We built our strategy considering all of these things. The first year was dedicated to process and access control reviews; the second year involved implementation of those processes and use of risk analysis for critical applications."Among the most valuable topics that ABN AMRO was led to consider as part of its process, he said, was where it made sense to automate identity-based control for its applications and where it did not.By gauging the number of users and criticality of the data involved in each area of its business, the company was able to set its priorities and get controls in place where the risk of information loss was most widespread or severe, said Martins.Using risk management to prioritize security As part of its project, ABN AMRO brought in consultants from PricewaterhouseCoopers (PwC) to help map out its areas of need and define where its greatest data and identity risks lay.Jerry Lewis, a principal and national identity management leader at PwC, said that his company is advising more customers to tackle their projects using a risk management strategy because it allows them to refine their plans and improve their security standing with greater alacrity."We're definitely seeing risk management becoming the next real extension of identity management," Lewis said. "Most large companies we see have spent a lot of time and money putting solutions into place to drive various requirements -- such as in addressing compliance regulations -- and once they have the infrastructure installed, they realize that they need to use more of a risk-based approach."Lewis said that more customers than ever are starting to adopt the risk-based identity management approach to get a better fix on handling applications and systems access from an enterprise-wide manner.Those companies' immediate goals tend to revolve around their desire to improve identity management reporting capabilities, and to create dashboards that garner metrics related to potential compliance audits, he said."People are looking at this issue from more of a broad perspective, based on regulatory drivers, and focused on very specific applications or needs," Lewis said."Doing so, these companies are able to take a step back and find out what they really need to address first," he said. "They want the company-wide view, but they're also realizing that they typically can't have a complete end-to-end solution across the organization that is one size fits all and that they need use this risk-based approach."As a result of the success that companies are having using the strategy, the consultant said that more customers have earmarked funds to buy products that apply the risk-based approach to identity during 2008.One of the vendors PwC works with in the space, and the software provider to ABN AMRO, is SailPoint, a startup founded in 2005 whose products are focused squarely on identity auditing and analytics as well as policy enforcement and the creation of automated controls.SailPoint executives said that customers are looking for a new generation of identity management tools that address the issues that will help them pass audits and give them more of a top-down view into where their organizations stand in terms of securing access."People began getting pressured to address issues of compliance and audit around Sarbanes-Oxley, but traditional identity tools were not designed to solve those problems, they were mostly about improving operational efficiency, and people have been stretching those technologies to do things they weren't designed to do," said Mark McClain, chief executive and founder of SailPoint."Most of these systems were initially designed to set up accounts and do password resets, but with compliance needs, it has to become more about governance and risk assessment," he said. "Customers are frustrated because they've spent all this money dealing with the terms of the regulatory audits, yet the breaches have continued because they haven't been able to address the real risks."
567263
A pair of Forrester Research analysts gave CIOs a passel of advice Thursday on how to deal with the possibility of a U.S. economic recession.
476986
Most large companies are struggling to protect themselves against security threats, a survey from security consultancy NetSec published today reveals.
665775
Arab Instrumentation and Automation (AIA), an Oil & Gas Show event, is bringing focus to bear on Health, Safety and Environmental (HSE) issues in oil and gas extraction, treatment and refinement.
185091
The plethora of security technologies on the market is enough to overwhelm even the most knowledgeable IT managers, but in sorting through all of the options, it may be helpful to look at what is not needed.
294488
Experts will rate potential severity of business security threats.
511321
One in four corporates plan to ditch maintenance contracts - Forrester Microsoft has hit back at criticism that its Software Assurance maintenance contracts offer poor value for money and may be dropped by many enterprise customers.â¦
374459
Risk-assessment techniques are yielding results at the Securities and Exchange Commission, as the number of enforcement referrals from SEC inspectors is up significantly in the last six months, senior SEC officials said.
681210
Tom Noonan, top exec at hosted security provider ISS, says more companies are considering letting outsiders handle their defenses.
352467
Insurance companies are using satellites to identify homes at high risk of fire damage because of their proximity to brush--a development that alarms some state regulators and privacy advocates.
519262
Review projects, set priorities, and tighten belts--just in case, Forrester Research analysts suggest.
697608
Business software maker's backing of event comes as company faces continued scrutiny over its security practices.
140038
Protect your portfolio from these destructive forces.
676651
(InfoWorld) - The more money that companies spend on securing their IT operations from external attack, the more it seems they become aware that the potential threat posed by their own employees remains their most significant risk. A new study published by consultants Deloitte on Tuesday finds that financial services companies -- among the most advanced and deep-pocketed consumers of security technologies in the world -- are still struggling with the concept of handling the insider threat issue despite all the cash they're dropping on security technologies. In the survey of 100 global financial services firms, Deloitte found that 91 percent of those questioned were concerned about their inability to respond to insider threats, while 79 percent were willing to cite "the human factor" as the root cause for a majority of their security issues. Despite that and all the different types of security tools companies have adopted, the survey found that 22 percent of the companies interviewed hadn't provided any new security training to their workers in the past year, and only 30 percent indicated a belief that their current employees were skilled enough to respond to an emerging security crisis. The apparent lack of faith in their ability to control the insider threat shows that many businesses are aware that they are only just beginning to tackle the problem, report authors said. "The contradictory findings highlight the security paradox financial institutions are facing," Mark Steinhoff, leader of the firm's financial security and privacy services practice, said in the report. "Security training and awareness, along with access and identity management -- of employees, clients, and suppliers alike -- are among organizations' top initiatives this year as they fight to keep pace with the ever-changing threat landscape." Beyond training, more companies are also enlisting the help of additional security systems aimed specifically at thwarting internal attacks and preventing mistaken data breaches. In addition to tools that offer the ability to track IT systems usage more comprehensively -- and create electronic paper trails that give forensics experts a string of clues when investigating any misbehavior or mistake -- enterprise organizations claim that they are also blending physical and IT security to stay abreast of what their workers are up to. "We've been putting cameras on all entrances and exits, looking at using badge numbers for tracking purposes, and keeping a closer eye on what people are doing and where they are going," said Adam Le, director of IT infrastructure at Alliance Imaging, a healthcare testing specialist. "We're also contemplating things like fingerprint scanners and other biometrics and looking at encrypting all data at rest on laptops." Companies walk a fine line in balancing the need to watch over their workers for security purposes and becoming too intrusive, the expert admitted. However, Le said that with businesses like Alliance facing mounting pressure from regulators to lock down every piece of patient data they record, employees must understand that the process is about protecting the firm and not about assessing personal work habits. In another effort to deal with the insider threat, Alliance, which provides outsourced medical imaging capabilities to hospitals and other healthcare organizations, has added new user authentication and monitoring tools made by ConSentry to its IT environment. By increasing security for remote workers and giving the firm a more detailed roadmap of file access activities carried out by its employees and customers, Le said he believes Alliance is finally getting ahead of the insider problem and arming itself with a way to keep everyone honest. One of the most significant issues the company has dealt with in the past are efforts by insiders to view the records of famous or high-profile patients, activities that are directly at odds with the Health Insurance Portability and Accountability Act medical data protection regulation. In some cases, the incidents have been the result of mere nosiness, while in others, the firm suspects that workers may have been looking to share sensitive data with outsiders for a profit. After conducting both technological and physical penetration tests on its operations, Le said that Alliance feels it is making the right moves to address the issue after augmenting its operations as such. "With the threat of data theft for identity fraud or to get information on our high-profile customers, we had to work to get a better picture of who was accessing what files," said Le. "Since putting the tools in place, we've been able to track people down when they do something wrong, and I think that type of response travels among workers by word of mouth; overall those types of issue have almost disappeared now that people know that their activities will be monitored." Data leakage prevention tools become more popular Another angle on preventing insider data breaches is being pursued via the use of so-called DLP (data leakage prevention) tools. At WebEx, the well-known online conferencing applications vendor, Security Engineering and Operations Manager Mike Machado said that the company is using advanced DLP technologies made by Reconnex to ensure that workers aren't walking out of the building with the company's next big idea. "Up until now, we didn't have anything in place that could capture everything that goes over the wire, but the ability to use technology do to do this type of testing, versus doing sampling in the past, has given us a much clearer picture of where data is going on the network and who is touching it," Machado said. "Most of the incidents we find today are people unaware of policies, it's only occasionally that we find something malicious, but typically the result is a simple behavior discussion, and that's helping people expand their own understanding of what they should or shouldn't do," he said. Another advantage to using DLP to keep an eye on all the data being transmitted out of WebEx's network is that the tools serve as another proof point to show external auditors when those groups are testing to see if the firm is employing comprehensive information protection. Perhaps the best use case for the technology yet, however, is when WebEx used the tools to catch an employee attempting to participate in a malware-distribution ring. In addition to joining sides with the malware gang, the employee had also agreed to allow the group to use excess WebEx network capacity to harbor potential attacks -- a problem that would have reflected poorly on the entire company if it were discovered and publicized, said the expert. "It's taught us that a lot that goes on that we know didn't about and verified things we suspected. Overall, it's been a valuable tool for detecting problems and putting us in position to prevent bigger problem down the road," Machado said. "In the rare case we find something to investigate, the technology gives us a much more credible case." The tools have also proven useful for helping the WebEx 's IT security team closer ties with the company's traditional security unit, which has helped the firm coordinate efforts to look for suspicious employee user behavior and policy violations. "Because we were able to help them shed light on some valuable issues, the technology has really closed the loop in that sense," Machado said. "The relationship wasn't always very good, but now, they're willing to be more forthcoming with us, and we can rely on each other more to reach our common goals, which is a big advantage." Some experts contend that companies will spend the next several years loading up on technologies that can help control insider threats now that they have invested so heavily in network defense protections. Brian Contos, chief security officer at ArcSight, an IT security management specialist, said that businesses must consider the insider problem as a dynamic, ever-changing issue, much like protecting against malware, if they hope to stay ahead of major incidents. "The network security side of things has increased at a much faster rate, but it's still the Wild West to a certain extent inside many large companies when it comes to protecting applications, databases, and other systems with a lot of rich data stored in them," said Contos, who previously authored the popular insider threat tome Enemy at the Watercooler. "To be successful, you can't ever be more concerned with internal or external threats. In reality you have the very real chance for either type of attack on a daily basis," he said. "The vast majority of employees, almost all, are not malicious, but you have to constantly watch for that one person who obtains employment deliberately to cause harm or who becomes disgruntled and decides to use what they know against you."
524147
(InfoWorld) - For years, Roy Bordes has been attending corporate security conventions, at which exhibitors push video surveillance, alarm systems or bullet-resistant glass. But since the terrorist attacks against the U.S. on Sept. 11, 2001, the American Society of Industrial Security's (ASIS) annual convention "has become a much more serious show,â said Bordes, a regional vice president for the trade group. The ASIS annual convention opens Sept. 25 in San Diego. Most of the 20,000 expected attendees, who make enterprise security buying decisions, are evaluating new applications to protect both their physical and virtual assets. There's a growing convergence of network, physical and building security functions, Bordes said. Enterprise spending on converged security projects in the U.S. and Europe is forecast to reach US$11.2 billion in 2008, from just $1.1 billion in 2005, according to Forrester Research Inc. Companies are deploying the fingerprint scanner technology that can admit employees into the building and allow them to log onto their computer, said Bordes, president of The Bordes Group Inc., a security consulting firm in Orlando. Converged network and physical security is getting C-level management attention, too, said Michael Corcoran, president of the California University of Protection and Intelligence Management, in San Jose, which confers degrees in intelligence management and management of personal protection. Some graduates become a company's chief security officer, guarding executives, protecting the building and, increasingly, also the computer network, Corcoran said. âThe CSO could be from the physical-security side or the network-security side. [Companies] want someone who is well-rounded in both areas,â he said.