Traditional approaches to security need a re-think

Security used to be so simple. It was physical, obvious, tangible. And for generations, this comforting process was sufficient for most businesses – and for most business owners to sleep well at night. With data now shockingly easy to steal, chances are they aren’t sleeping as well these days. In the days before computers changed how we perceive and use data, the physical paradigm ruled. At the end of the day, the last one out of the office locked the door. Data, such as it was, sat safely in paper-based files inside the building, accessible only to authorized employees who knew where to find it and had the right keys to access the right rooms and filing cabinets. Times have obviously changed. Data no longer live exclusively on paper. Instead, they live virtually, online, unseen in networks and storage systems that are available 24/7 to anyone with an internet connection and a password. Are companies doing enough to keep business critical data away from prying eyes? Better yet, are their leaders able to fall asleep at night? Chances are they aren’t and they can’t, because in most cases data are shockingly easy to steal. Aside from the usual technical gaps – including, but not limited to, improperly configured firewalls, lax updates to antivirus signatures, inadequate protection against emerging forms of malware, and weak or non-existent wireless network protection – haphazard adherence to process continues to make data more vulnerable than they deserve to be. How haphazard? From what I’ve seen over the last few months, quite: Employees sending sensitive corporate data over unsecured public Wi-Fi hotspots; teleworkers using unencrypted public networks to connect from home; IT operators losing backup tapes during the evening commute; and HR folks loading employee databases onto flash drives to work on over the weekend. In the ideal world, the IT department would do what it’s always done: Throw technology at it. Buy some hardware or software, implement it over or in place of whatever’s currently there, and hope that fixes it. Unfortunately, security doesn’t quite work that way. As promising as today’s security appliances, suites and services are – and make no mistake, they’re exceptionally robust – they’re virtually useless if the organizational culture isn’t security-tuned as well. If IT forces a new technology on the rest of the company, expect indifference at best and mutiny at worst. These days, IT needs to make it easier for everyone else to get on board the security bandwagon. Let’s look at our laptop-toting employees working out of a coffee shop. On the one hand, they deserve our thanks for being so dedicated outside of working hours. On the other hand, they deserve a slap on the wrist – or worse – for working with sensitive files over an unsecured hotspot. Or do they? As many red flags as this behaviour raises, it’s not entirely fair to blame the employees in question. After all, are they aware that their use of public wireless access points puts sensitive organizational data at risk? Did the company take the time to educate them? Or is it simply assuming they know this stuff. Given my general dislike of the word “assume”, allow me to propose the following rules for improving organizational security: Rule 1: Never assume. Rule 2: It’s the company’s responsibility to ensure employees are well aware of security best practices. Security without accountability is anything but secure. Rule 3: Technology can only go so far. Sustainable, rational, easy-to-follow processes are crucial to wringing value out of security solutions. Rule 4: IT can’t force security on the rest of the company. IT and business areas must partner up to ensure any solution fits the underlying business need. Rule 5: See Rules 1 through 4. Repeat as necessary. An IT department that views security as a socio-cultural opportunity stands a much greater chance of success than an IT department that clings to the outdated notion that only technology can solve the problem. From an internal and external perspective, business is becoming too complex for the average leader or employee to follow. Worse, the rate of change continues to accelerate. Add a grinding economic downturn – and the budget-cutting corporate conservatism that goes along with it – and you have all the ingredients for headline-generating data loss. Companies need coaches, advocates and teachers to help them navigate this strange new landscape. Who better to take the lead than the good folks of IT? They speak tech, they understand the business implications of the systems they implement and manage, and they also lose sleep worrying about keeping the virtual doors locked and organizational data secure. The comfort of physical security may no longer exist, but technologists who speak the language of business can fill the gap quite nicely. Maybe it really can be simple, after all.

Traditional approaches to security need a re-think

News | 05/28/2009 1:21 pm EDT

To keep reading, get a free trial.

Already a Subscriber?

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us