Security is a process, not a destination, and as such it requires ongoing effort, Maeson Maherry, GM of Namitech security brand Namitrust, told delegates at the Futurex conference this week.
In his presentation, Maherry stressed the importance of security in the business environment. "Security is always IT`s 'other` job. It is difficult to find time to check for all the patches, but if you don`t, you`ve left a hole open for a worm."
Maherry also highlighted the need for companies to move away from the traditional method of security management - doing yearly updates to check for vulnerabilities. "Business needs to start auditing, in an automated way, vulnerabilities more frequently. If there`s one thing that you change in your approach to security, that will probably be the most important.
"The concept of security has always been mystified, but it`s not [a mystery]. Business just needs to take a practical approach, and focus their security on problems that can be solved." Maherry noted that 90% of all security threats strike by exploiting known vulnerabilities.
When dealing with security, businesses generally took two approaches. "Many companies choose what to invest in on a gut feel - on something they think needs to be done. This is fine, but try telling a board of directors to invest millions of rands in something because of a gut feel."
The second is the best practices approach, which gives businesses a framework to work in. "But they say you must secure everything, and this just isn`t economically feasible. You must only cover the areas that are critical to the business," said Maherry.
"In my opinion, the proper security solution lies somewhere between these approaches."
From a business perspective, Maherry identified three main security drivers. "Risk is the main one, then there is also regulation and accountability."
The challenge regarding regulation was for a continually changing business environment to remain within the regulatory and statutory frameworks set in place by government.
Understanding the significance of accountability was important for both business and individuals, said Maherry. "If something goes wrong, the company can abdicate and leave you on your own. Or, the company can be held liable and prosecuted. It is important that both parties understand the implications of accountability.
"We are approaching an area where you can be sued for being negligent."
Share
