Print Article for : Threats To Information Security

Your Online Guide » Online Security » Online Internet Security

[T893]Threats To Information Security

by Nirmalya, Nir

Forthe sake of efficiency, cost effectiveness and to focus on the core businesscompanies world over are switching to outsourcing of IT security. It makeseminent sense too as the information security consultants are the experts of their domain and hiring them is much more economicaloption than maintaining a whole army of in-house IT security experts.

This cost and efficiency factorscombined with the ever growing threat from hackers and exploding onlineshopping and e-commerce market has made sure that more and more companies arelooking for information security consultants to take care of their IT securityconcerns.

All these factors have made the career ofinformation security consultants quite promising. But before you get ready tojump on the bandwagon, wait and contemplate as to why a company would go foroutside IT security experts. This would help you understand the industrybetter.

Basicallythere are following three reasons which make a company go for outsourcing.

1. Therequired services are not available in-house and getting expensive newemployees is costly and time consuming option.

2. Companyis facing a tight deadline to finish a highly technical project and it is notpossible to hire, train new employees and expect the project to be finished intime.

3. Companiesneed an independent and objective perspective which is not mired in thecorporate politics and infrastructure.

Whenyou are clear about these basics you can start the process of being asuccessful information security consultant which isas following.

Go wholeheartedly ? There are no half measures when it comes to making acareer. And certainly not when you are entering a field as fluid as ITsecurity. The job outlook and growth is better than average and there aretraining programs and schools which offer specific curriculum, certificates anddegrees in computer security.

Do proper Research ? Since this field is relatively new, the programs are newand not yet established. So go for a recognized and reputable institute whichoffers all encompassing curriculum in information technology (IT), consistingof but not limited to penetration testing, systems analysis,computer information systems, programming and networking.

Steer clear of frauds ? As with any growing field, IT security educationfield is replete with fly-by-night operators which are there just to make moneyand offer illegitimate courses which are not recognized and can't get you a jobafter graduation.

Don't be limited to just curriculum ? As extensive the curriculum mightbe, there is always space for more. So don't just be limited to the coursewareand keep on adding to your knowledge of vulnerability analysis, firewallmanagement, virus protection, network and software safety, IT forensics etc.

Add to you certifications ? After or during your graduationyou can opt for industry recognized certification such as "Cisco"Network Security certification, those offered by Microsoft etc. They will addvalue to your knowledge and empower your resume.

Gain experience ? Once you have graduated you should get industry exposurethrough school-sponsored IT internships and with entry-level IT jobs. They willhelp you understand the IT security threats in real time practical environment.

According to security specialists, "Security practitioners must escape the ineffective, reactive loop of traditional approaches by proactively engaging with business units, getting involved earlier in the information technology (IT) development lifecycle, and including more deterrence and preventive measures in the protection posture."

The best method to achieve this is to be pro-active dealing with today's information security challenges. To be pro-active means acting in advance to deal with an expected difficulty.

1) Proactivity is the key.

Mass collaboration is a new social, business and technology trend that has changed the global market place, but at the same time it has also opened up a host of non-traditional security threats.

An "open" global marketplace, however, has a profound effect on IT security. According to a specialized research report recently released, "Attacks are quieter and more targeted than they used to be. They tend to be better crafted and more effective than broad-spectrum virus or worm attacks ... and the level of damage is greater."

The best way to protect yourself is to integrate security into all technologies and devices and create a secure infrastructure. Chief Security Officers need to become more proactive, starting with business planning and by ensuring that information security is a priority on boardroom agendas.

2) De-perimeterisation.

Wikipedia defines De-perimeterisation as "a concept/strategy used to describe protecting an organisation's systems and data on multiple levels by using a mixture of encryption, inherently-secure computer protocols, inherently-secure computer systems and data-level authentication, rather than the reliance of an organisation on its (network) boundary to the Internet."

2.1) Proactive steps to address de-perimeterisation

2.1.A) Use perimeter control points to surround sensitive collections of resources.

Create control points where they are needed: on the network, hosts or sometimes around the content. Also create perimeters around various subsets of the user population on the network level, or around the data centre in specific geographic locations, or even virtual perimeters around business unit IT resources.

2.1.B) Deploy your control points depending on your business requirements.

Adopt a combined architecture approach to security by including an appropriate balance of perimeter, identity, endpoint and content control points.

2.1.C) Develop a holistic architecture that includes an appropriate balance of perimeter, identity, endpoint and content control points.

Organisations need to develop their own architectures and models, and insert products as necessary when they are good fits.

3) OS Security

Operating systems are no longer a specific entity with constraints that we can think about in simplistic security terms. Their complexity comes from layering and embedding functionality and sharing libraries and device drivers.

3.1) Proactive steps to address OS security

3.1.A) Slow down your patching.

3.1.B) Push for more information sharing among anti-malware vendors, and between customer organisations and vendors, to build better, real-time active lists of malware and other problems out there.

3.1.C) Consider host intrusion prevention systems (HIPS) and application control.

3.1.D) Consider deploying NAC, TPMbased volume encryption and other protection technologies that will move into the mainstream over the next few years. Think management of assets and configurations instead of compromised systems.

4) Information-centric security

An information-centric architecture requires proactive discovery and classification, engagement with the business, as well as layered protection. The real issue is "Which users have access to information, and what are they supposed to do with it?"

4.1) Proactive steps to address information-centric security

4.1.A) Engage business and legal teams to understand specific information characteristics and life cycles.

4.1.B) Encryption should be targeted and well managed.

5) Compliance

Regulations are in some respects similar to an attack on the enterprise, and are indistinguishable from other types of threats in that they create a negative impact. A compliance response tries to control the risk created by the regulation. The response drives up costs and places pressure on competitiveness.

5.1) Proactive steps to address compliance

5.1.A) Create a strategic security programme that is inherently compliant.

5.1.B) Change compliance processes slowly and rules may change as quickly as necessary.

5.1.C) Engage the legal team early and intimately, and create a defined communications channel and escalation process between legal, compliance and IT groups.

6) Creating a Secure Infrastructure

Security solution providers should utilise in-depth knowledge of the converged network and all its vulnerabilities, opportunities and challenges, to plan, build, support and manage a secure infrastructure for their clients - an infrastructure that is secure and adaptable enough to support clients' business applications, core network and information, today, tomorrow and beyond.

To achieve a Secure Infrastructure, you are recommended to consider the following areas:

6.1) Perimeter Security

6.2) Intrusion Management

6.3) Content Security

6.4) Access Management

Article Source : Pg. 9

About Author

Both Nirmalya & Gregory Smyth are contributors for EditorialToday. The above articles have been edited for relevancy and timeliness. All write-ups, reviews, tips and guides published by EditorialToday.com and its partners or affiliates are for informational purposes only. They should not be used for any legal or any other type of advice. We do not endorse any author, contributor, writer or article posted by our team.

Nirmalya has sinced written about articles on various topics from Online Security. Information security consultants are much in demand these days and so is the demand for authentic courses offering IT security curricula. This article discusses how one can become an IT security expert.. Nirmalya's top article generates over 880 views. Bookmark Nirmalya to your Favourites.

Gregory Smyth has sinced written about articles on various topics from Types of Cancer, Luxury Hotels and Family Travel. Datacraft is the leading independent IT services and solutions company in Asia Pacific. Datacraft combines an expertise in networking, security, Microsoft solutions, s. Gregory Smyth's top article generates over 201000 views. Bookmark Gregory Smyth to your Favourites.