Many companies, suddenly realising that they`re falling behind in the e-business race, take seemingly decisive steps to rectify the situation. They install an Internet link to an ISP and host their e-commerce website either at their premises or at the ISP.
And then they`re hacked or received virus infected e-mails - and that`s when they realise they`ve overlooked a vital component of their e-business investment: security!
And what about the company`s internal network? Networks are dynamic - they grow and change as new users, servers and network equipment is added. They cannot be installed and forgotten about because, if there is one constant in network operations, it`s change.
Whether a network or systems administrator is adding new applications for the World Wide Web, addressing the needs of business partners, or improving remote access capabilities for the company`s employees, the network is constantly changing to meet organisational requirements.
However, while this process aimed at improving business productivity is underway, organisations inadvertently increase their network security risks. And just one security vulnerability can result in an irrecoverable loss of revenue, confidential information, or credibility in the marketplace.
To avoid these scenarios, companies must have effective security in place. However, security isn`t something you can simply go out and buy off-the-shelf like browser software. You can`t just install and forget about it. Effective security is a continuous process of planning, securing, monitoring, testing, improving, and then - starting the whole process again.
At the heart of this is the company`s security policy, which must reflect changes and additions to the network. It must be rigorously applied and updated whenever necessary.
But how does a company go about implementing effective information systems security? Just follow the six step plan illustrated in figure 1.
Six steps to corporate network security
- Setup a Corporate Security Policy.
- Secure the network by installing a firewall, encryption, authentication and content inspection.
- Continuously monitor the network using an Intrusion Detection System (IDS) and respond to any alarms.
- Test the network by performing vulnerability tests, penetration test and audits.
- Manage and improve the network by using the results from step 4)
- Repeat the process.
During all these steps, ensure that everything implemented or changed complies with all aspects of the corporate security policy.
Corporate security policy
The greatest difficulty in establishing an effective information systems security policy is the lack of understanding about the exact nature of security problems facing the company.
Successful implementation of a meaningful information security policy depends on the support of top management. Until and unless the company senior managers understand and concur with the need for such a policy, its ultimate success remains uncertain. A good information systems security programme must always start with a security policy, and it must involve top management`s direction, commitment, and concurrence.
Why Have a Company Security Policy?
Policy statements create employee awareness and also clarify responsibility. Sophisticated security hardware and software will not, in itself, provide adequate protection. Every employee should understand the importance of security and what is expected of all staff.
Additionally, a company has a firmer case to terminate or prosecute an offender if the company`s policy has been published, read, understood, and endorsed by every employee. Finally, the internal communication required to develop such a policy will help everyone understand what is needed, what is possible, and what they are responsible for.
SECURE the network by implementing Firewalls, Encryption, Authentication, and Content Inspection. A firewall is considered a first line of defence and is also known as perimeter security. It is a system designed to prevent unauthorised access to or from a private network. Firewalls can be implemented in both hardware and software, or a combination of both. They are frequently used to prevent unauthorised Internet users from accessing private networks connected to the Internet, especially intranets.
All data entering or leaving the intranet pass through the firewall which examines the data and blocks those which don`t meet the specified security criteria.
Monitor and respond
In the last three years, the networking revolution has finally come of age. More than ever before, the Internet is changing computing as we know it. The possibilities and opportunities are limitless; unfortunately, so too are the risks and chances of malicious intrusions.
And that`s why every company with a network linked to the Internet needs Intrusion Detection - to know when someone is knocking on the company`s door.
It is vitally important that the security mechanisms of a system are designed to prevent unauthorised access to system resources and data. However, it`s unrealistic - at present - to expect to completely prevent breaches of security.
What is possible, is to detect intrusion attempts and prevent them or take action to repair any damage later. Processes and systems must then be put in place to secure these vulnerabilities.
An intrusion attempt or a threat can be defined as a potential, deliberate unauthorised attempt to
- access information,
- manipulate information, or
- render a system unreliable or unusable.
Test
Vulnerability scanning, penetration tests and independent audits are vital components in the security process. This ensures that the security measures implemented are installed and configured correctly. It will also highlight any other vulnerability in the security system which may have been overlooked.
Manage and improve
Network Operations and Security Professionals skills are very scarce. It`s therefore important for companies which don`t have these skills in-house to keep the security process in place, and partner or a have a support contract with a reputable security company which has the skills to address vulnerabilities in the security system.
Share
