Threat of Internet security breaches increases as traditional systems become impractical

Ninety percent of high profile security breaches occur at companies with lavish security systems in place.

So said Clifford Katz of Information Security Architects (ISA) South Africa at a Sun Microsystems security seminar held in Durban, Cape Town and Johannesburg this week.

He added that misconfiguration of security systems is worse than no security systems at all, as it gives a false sense of security.

"If a company did not have any meaningful security infrastructure, they would at least understand their risks and manage them accordingly," said Katz. "By giving stakeholders a false sense of security, effective risk management is impossible.

"Without a practical security infrastructure - availability and posture - management security will not support business - it will hamper it.

"No amount of products will mitigate security. The reality is that management should understand the 'new-era' risks and manage them appropriately."

Katz also questioned how vendors explained system patches designed to address a weakness in a previous version of their product. Were they not secure before the patch?

He then presented some practical concepts that would drastically improve the organisational acceptance of "intrusive" information security strategies. This included changing the management paradigm from the traditional reactive process to a proactive cycle that would finally position businesses to maximise the upside of their Internet investment.

"The paradox is that while a security system would typically be configured to disrupt data flow on failure, system uptime is a critical success factor for security infrastructure management. For this reason, many organisations double up on their primary security infrastructure effectively creating a high availability environment where there can be no single point of failure.

"This investment is seldom questioned as management appreciates the intrusive nature of security and the business impact should a security system fail. Although an investment in high availability drastically improves system availability, one should also develop a process to pre-empt such a failure," Katz added.

A further vital aspect to effective security infrastructure management is the ability to retain system effectiveness. With the acceptance that security system effectiveness degrades over time, it's essential to micro-manage each system within enterprise-wide security infrastructure to ensure that degraded effectiveness is rapidly defined and corrected.

"The King II Report states that CEOs are now responsible not only for their companies' assets, but also their intellectual property. Relying solely on vendors' claims that they have the 'silver bullet' is simply a marketing spin. If it were true, would the system allow uninterrupted network traffic should it fail?" Katz concluded.