|By RealWire News Distribution||
|September 7, 2011 08:19 AM EDT||
Ian Kilpatrick, chairman of IT specialist Wick Hill Group, examines the range of Internet security threats faced by companies today and advises on how to protect against them.
How to use the Internet while staying secure has always been a concern for businesses. Over the last couple of years there have been many changes in the Internet threat scenario. Most notably there has been a significant increase in the 'access anywhere/anytime culture' with a growth in social networking, a move to convergence solutions such as VoIP, a major increase in smartphone use, a growth in cloud computing, plus the 'consumerisation' of systems (i.e. the use of personal devices for company data).
2. OVERVIEW OF INTERNET THREATS.
The range of security threats includes
* Malicious threats, such as viruses and other malware
* Fraud threats such as phishing emails, spyware and toll fraud
* Unauthorised access from hacking, data leakage, botnets, unsecured wireless, and user name/password insecurity, etc.
* Operational threats, such as distributed denial of service (DDoS) attacks, attacks on VoIP, the failure of cloud computing suppliers to secure your network, or security risks from remote workers.
* Newer threats such as social networking insecurity, web application threats, smartphone insecurity and poor security for converged voice/data applications on the network
3. HOW TO PROTECT AGAINST INTERNET THREATS
The basics that companies need to protect themselves in today's internet environment include:
Risk assessment/risk management.
A risk assessment should be carried out BEFORE implementing additional aspects of internet use, to identify the risks and determine what, if anything, needs to be done to minimise them. It is important to regularly review all security policies. Recent history has shown that it is less expensive, easier and more efficient to deploy security at the beginning of any project than to try to "backfill" it. Oh yes, and it's more secure!
Educated staff are the first and main line of defence. Staff need to be brought on board, where security is concerned. The impetus needs to come from the top and be maintained.
Staying up to date
A basic and key way of staying secure is to make sure you rapidly deploy software updates, such as operating system and browser updates. Make sure too that patches, particularly security patches, are installed as soon as available.
As a first line of defence, users should be educated to not open unknown attachments, which are a common source of viruses and spyware, and to be very cautious about clicking on any links.
Anti-virus systems should be behaviour-based and updated automatically in the background. Many anti-virus solutions also incorporate anti-spyware elements, to help cope with problems such as the theft of user names and passwords. Suppliers include Kaspersky Lab, VIPRE Business, Norton, McAfee and Symantec. Anti-spyware suppliers include Barracuda Networks and WebRoot. Free anti-spyware solutions, such as Spybot, are also available.
Firewalls are now almost universally deployed. All messages entering or leaving the network pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria.
A huge range of firewalls is available today from companies such as Check Point, Nortel, Nokia and WatchGuard. Firewalls are also available as part of a unified threat management appliance (UTM) or an extensible threat management (XTM) appliance, where a firewall is combined with other security functions, including (in many cases) web application firewalling (WAF), sometimes also known as deep packet inspection (DPI).
The best way to prevent unauthorised access is through authentication.
Single factor authentication involves the use of passwords only, ranging from weak to complex. It has a number of insecurities and is highly vulnerable to the same password being used for multiple applications (including social networking), increasing the risk that your business applications security could be breached.
Strong two factor authentication comprises something you know (a password) and something you have (e.g. a hardware token, which can produce a time limited one time password, a soft token (for example a PIN sent to a mobile phone) or a swipe card). Companies including VASCO, RSA and CRYPTOCard provide strong two factor authentication solutions. While there are still risks with this approach, it provides significantly improved security at a comparatively low cost
Biometric authentication, involving personal elements such as fingerprint or iris recognition, is more appropriate for high security applications, such as financial or defence.
Remote user security
Encrypted virtual private networks (VPNs), either IPsec or SSL, are the typical solution for secure branch to head office communications, for communications between companies and third parties such as suppliers, and for secure communications between remote/mobile workers and head office/branches. This should be done, using a minimum of two-factor authentication.
Branch offices can install low-cost remote UTMs which incorporate VPNs and these can be centrally administered, typically by the head office. Companies such as WatchGuard, Check Point and NETASQ provide remote, centrally manageable IPsec and SSL VPN solutions.
Another method of securing remote and mobile users is endpoint security (EPS). Coupled with central management, it can ensure that firewall, anti-virus and security patches are used. A range of solutions is available from companies such as Check Point, GFI Software, Kaspersky Lab and Citrix.
With the growth of remote working, managing the remote worker network securely has become increasingly difficult and costly. To complicate matters, many employees are using their own PCs, laptops and smartphones to link to the company.
This carries a significant risk of these devices being infected by spyware, etc. and introduced to the network. Additionally, data on them could be unprotected. Coupled with this, there is the high cost of providing, supporting, patching and managing company supplied devices.
One solution is for the employer to give the employee an allowance to buy their own PC or laptop and to supply them with a secure, hardware encrypted flash drive with embedded security software.
This creates a secure tunnel, stronger than an SSL VPN, between the remote worker's PC and the applications on the home network. File transfer between the PC hosting the flash drive, and the corporate network, is strictly controlled. The use of applications and programmes too is subject to the applied security policy.
These types of solutions essentially provide a secure, virtual environment, irrespective of the security status of the users PC/Laptop. They include solutions from Check Point (Abra) and IronKey, as well as the different approach of virtual desktop infrastructure (VDI) from Citrix and VMware.
Smartphone growth presents another remote access security risk. Staff are increasingly using them to retrieve email and use other applications on the move.
But they remain largely unprotected and have the potential to put the whole network at risk through unauthorised access, particularly as they are so easily lost or stolen. Wi-Fi roaming out of the office, creates a number of security risks, including the risk of identity and security credentials being lost or stolen.
Because of the dangers, smartphones should be treated just like PCs, when it comes to securing them.
A lot can be done through carrying out a number of simple preventative actions. For example, use the PIN function to secure the phone, install data wiping facilities, employ time-out policies, and install GPS tracking so the phone can be located if stolen. Authentication to the network from smartphones is essential.
Specific smartphone security solutions are also available from suppliers such as Kaspersky Lab, Sipera, CRYPTOCard and Check Point.
The use of wireless has grown significantly in the last few years and is now endemic, with smartphones increasingly being used to connect to wireless.
Authentication is absolutely crucial in this environment and strong two factor authentication should be used for access to all confidential internal data, from wireless pcs, laptops and smartphones. Sensitive data should not be held on a smartphone or wireless laptops, unless encrypted.
IPSec or SSL encrypted VPNs should be used for all wireless communications between head office and remote locations, such as branch offices, mobile users or home workers.
When employees leave a company, and their access to wireless hasn't been managed, then the risk of them causing problems through unauthorised access is significantly increased.
Wi-Fi roaming and Bluetooth are other risks, with many users leaving their devices Wi-Fi roaming and Bluetooth-enabled. This leaves them vulnerable to attacks resulting in access to the devices and the company network, particularly if authentication is not strong enough.
If your organisation is using unencrypted wireless in the office, all the information held on your network can be at risk. If your existing solution supports WPA2 or even the discredited WEP encryption, switch it on (it will have arrived with the default off). It is a good idea to encrypt all relevant confidential files, data, internal e-mails and network attached storage (NAS).
Wireless security providers include companies such as Aruba Networks, Check Point, Ruckus, SonicWall, and WatchGuard.
Encryption (including laptop and smartphone encryption)
The easiest and most effective way of stopping sensitive and critical data being read by unauthorised personnel or outsiders is to encrypt it.
Loss or theft of data stored on laptops or smartphones is a particular problem.
However, this can be easily and inexpensively protected using comparatively low-cost encryption software for laptops from companies such as Pointsec, Utimaco and PGP, and specific mobile security software for smartphones.
The use of unified encryption management (UEM) means encryption can be easily managed across all data risk areas including desktops, laptops, PDAs, USB sticks, mobile phones and other removable media.
* Converged systems security
Security convergence is different from normal data security, because the link between phone systems and the Internet makes both voice and data more vulnerable to problems such as toll fraud and the total loss of both voice and data communications, if VoIP is hacked. However, there are security products available specifically tailored for a unified communications (UC) environment. These include solutions from Sipera, Panasonic and Samsung.
* Cloud computing/hosted systems security
If you put your network into the cloud or use hosted systems, then you are making someone else responsible for your security and need to ask your supplier a number of questions. These could include:
- what security and authentication procedures are in place for remote staff access?
- how is data secured against leakage?
- what protection is there against DDoS attacks?
- how can you guarantee your staff won't access my company's data?
- what is the service level agreement for availability and what is the recourse if it is breached?
- in what jurisdiction is my data held and stored?
4. MULTI FUNCTIONAL SOLUTIONS
Unified threat management systems (UTMs) are designed to provide a range of security solutions in a single appliance, reducing costs and simplifying the whole process of security systems management and installation. The minimum requirement for a UTM is a firewall, VPN, anti-virus and intrusion detection/prevention. Some UTMs may also provide anti-spam, web content inspection spyware protection, centralised management, monitoring, and logging capabilities.
Extensible threat management systems (XTMs) are a development of UTMs, which combine fast throughput with advanced networking features to handle high-volume traffic. They are suitable for 50-10,000 or more users.
Popular UTM and XTM solutions include those from WatchGuard, Check Point, Fortinet, Barracuda Networks and NetASQ.
Web Application Firewalling (WAF)
Web application firewalls apply rules to HTTP (essentially web server and browser) conversations. This is sometimes also known as deep packet inspection (DPI). Dedicated devices are available such as SecureSphere from Imperva, ModSecurity (open source) and the Barracuda Web Site Firewall. WAF is also included in many UTM and XTM solutions.
A variety of other multi-functional solutions, incorporating various security product mixes, is also available from companies such as Kaspersky Lab, Symantec, McAfee and Computer Associates.
The latest important IT security concerns include the increasing amount and variety of remote access, and the growing use of converged systems such as VoIP and smartphones. However, these and other ongoing security risks such as malware, fraud and data leakage, can all be adequately protected against with a strong commitment to security and the deployment of appropriate solutions.
Ian Kilpatrick is chairman of Wick Hill Group plc, specialists in secure IP infrastructure solutions for e-business. Ian has been involved with the Group for more than 30 years. Wick Hill is an international organisation supplying most of the Time Top 1000 companies through a network of accredited resellers. Contact www.wickhill.com, 01483 227600.
Ian looks at computing from a business point-of-view and his approach reflects his philosophy that business benefits and ease-of-use are key factors in IT. He has had numerous articles published in the UK and overseas press, as well as being a regular speaker at IT conferences.
Cloud computing delivers on-demand resources that provide businesses with flexibility and cost-savings. The challenge in moving workloads to the cloud has been the cost and complexity of ensuring the initial and ongoing security and regulatory (PCI, HIPAA, FFIEC) compliance across private and public clouds. Manual security compliance is slow, prone to human error, and represents over 50% of the cost of managing cloud applications. Determining how to automate cloud security compliance is critical to maintaining positive ROI. Raxak Protect is an automated security compliance SaaS platform and ma...
Nov. 28, 2015 08:00 PM EST Reads: 430
The Internet of Things (IoT) is growing rapidly by extending current technologies, products and networks. By 2020, Cisco estimates there will be 50 billion connected devices. Gartner has forecast revenues of over $300 billion, just to IoT suppliers. Now is the time to figure out how you’ll make money – not just create innovative products. With hundreds of new products and companies jumping into the IoT fray every month, there’s no shortage of innovation. Despite this, McKinsey/VisionMobile data shows "less than 10 percent of IoT developers are making enough to support a reasonably sized team....
Nov. 28, 2015 01:00 PM EST Reads: 478
Just over a week ago I received a long and loud sustained applause for a presentation I delivered at this year’s Cloud Expo in Santa Clara. I was extremely pleased with the turnout and had some very good conversations with many of the attendees. Over the next few days I had many more meaningful conversations and was not only happy with the results but also learned a few new things. Here is everything I learned in those three days distilled into three short points.
Nov. 28, 2015 12:00 PM EST Reads: 337
With major technology companies and startups seriously embracing IoT strategies, now is the perfect time to attend @ThingsExpo 2016 in New York and Silicon Valley. Learn what is going on, contribute to the discussions, and ensure that your enterprise is as "IoT-Ready" as it can be! Internet of @ThingsExpo, taking place Nov 3-5, 2015, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with 17th Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. The Internet of Things (IoT) is the most profound cha...
Nov. 28, 2015 12:00 PM EST Reads: 553
DevOps is about increasing efficiency, but nothing is more inefficient than building the same application twice. However, this is a routine occurrence with enterprise applications that need both a rich desktop web interface and strong mobile support. With recent technological advances from Isomorphic Software and others, rich desktop and tuned mobile experiences can now be created with a single codebase – without compromising functionality, performance or usability. In his session at DevOps Summit, Charles Kendrick, CTO and Chief Architect at Isomorphic Software, demonstrated examples of com...
Nov. 28, 2015 11:45 AM EST Reads: 406
As organizations realize the scope of the Internet of Things, gaining key insights from Big Data, through the use of advanced analytics, becomes crucial. However, IoT also creates the need for petabyte scale storage of data from millions of devices. A new type of Storage is required which seamlessly integrates robust data analytics with massive scale. These storage systems will act as “smart systems” provide in-place analytics that speed discovery and enable businesses to quickly derive meaningful and actionable insights. In his session at @ThingsExpo, Paul Turner, Chief Marketing Officer at...
Nov. 28, 2015 11:15 AM EST Reads: 416
In his keynote at @ThingsExpo, Chris Matthieu, Director of IoT Engineering at Citrix and co-founder and CTO of Octoblu, focused on building an IoT platform and company. He provided a behind-the-scenes look at Octoblu’s platform, business, and pivots along the way (including the Citrix acquisition of Octoblu).
Nov. 28, 2015 11:00 AM EST Reads: 515
In his General Session at 17th Cloud Expo, Bruce Swann, Senior Product Marketing Manager for Adobe Campaign, explored the key ingredients of cross-channel marketing in a digital world. Learn how the Adobe Marketing Cloud can help marketers embrace opportunities for personalized, relevant and real-time customer engagement across offline (direct mail, point of sale, call center) and digital (email, website, SMS, mobile apps, social networks, connected objects).
Nov. 28, 2015 10:30 AM EST Reads: 314
We all know that data growth is exploding and storage budgets are shrinking. Instead of showing you charts on about how much data there is, in his General Session at 17th Cloud Expo, Scott Cleland, Senior Director of Product Marketing at HGST, showed how to capture all of your data in one place. After you have your data under control, you can then analyze it in one place, saving time and resources.
Nov. 28, 2015 10:00 AM EST Reads: 199
The Internet of Everything is re-shaping technology trends–moving away from “request/response” architecture to an “always-on” Streaming Web where data is in constant motion and secure, reliable communication is an absolute necessity. As more and more THINGS go online, the challenges that developers will need to address will only increase exponentially. In his session at @ThingsExpo, Todd Greene, Founder & CEO of PubNub, exploreed the current state of IoT connectivity and review key trends and technology requirements that will drive the Internet of Things from hype to reality.
Nov. 28, 2015 08:45 AM EST Reads: 441
Two weeks ago (November 3-5), I attended the Cloud Expo Silicon Valley as a speaker, where I presented on the security and privacy due diligence requirements for cloud solutions. Cloud security is a topical issue for every CIO, CISO, and technology buyer. Decision-makers are always looking for insights on how to mitigate the security risks of implementing and using cloud solutions. Based on the presentation topics covered at the conference, as well as the general discussions heard between sessions, I wanted to share some of my observations on emerging trends. As cyber security serves as a fou...
Nov. 28, 2015 08:45 AM EST Reads: 332
With all the incredible momentum behind the Internet of Things (IoT) industry, it is easy to forget that not a single CEO wakes up and wonders if “my IoT is broken.” What they wonder is if they are making the right decisions to do all they can to increase revenue, decrease costs, and improve customer experience – effectively the same challenges they have always had in growing their business. The exciting thing about the IoT industry is now these decisions can be better, faster, and smarter. Now all corporate assets – people, objects, and spaces – can share information about themselves and thei...
Nov. 28, 2015 06:00 AM EST Reads: 251
Continuous processes around the development and deployment of applications are both impacted by -- and a benefit to -- the Internet of Things trend. To help better understand the relationship between DevOps and a plethora of new end-devices and data please welcome Gary Gruver, consultant, author and a former IT executive who has led many large-scale IT transformation projects, and John Jeremiah, Technology Evangelist at Hewlett Packard Enterprise (HPE), on Twitter at @j_jeremiah. The discussion is moderated by me, Dana Gardner, Principal Analyst at Interarbor Solutions.
Nov. 28, 2015 05:30 AM EST Reads: 735
Too often with compelling new technologies market participants become overly enamored with that attractiveness of the technology and neglect underlying business drivers. This tendency, what some call the “newest shiny object syndrome” is understandable given that virtually all of us are heavily engaged in technology. But it is also mistaken. Without concrete business cases driving its deployment, IoT, like many other technologies before it, will fade into obscurity.
Nov. 28, 2015 05:00 AM EST Reads: 365
Discussions of cloud computing have evolved in recent years from a focus on specific types of cloud, to a world of hybrid cloud, and to a world dominated by the APIs that make today's multi-cloud environments and hybrid clouds possible. In this Power Panel at 17th Cloud Expo, moderated by Conference Chair Roger Strukhoff, panelists addressed the importance of customers being able to use the specific technologies they need, through environments and ecosystems that expose their APIs to make true change and transformation possible.
Nov. 28, 2015 04:00 AM EST Reads: 543
The Internet of Things is clearly many things: data collection and analytics, wearables, Smart Grids and Smart Cities, the Industrial Internet, and more. Cool platforms like Arduino, Raspberry Pi, Intel's Galileo and Edison, and a diverse world of sensors are making the IoT a great toy box for developers in all these areas. In this Power Panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists discussed what things are the most important, which will have the most profound effect on the world, and what should we expect to see over the next couple of years.
Nov. 28, 2015 03:30 AM EST Reads: 476
The cloud. Like a comic book superhero, there seems to be no problem it can’t fix or cost it can’t slash. Yet making the transition is not always easy and production environments are still largely on premise. Taking some practical and sensible steps to reduce risk can also help provide a basis for a successful cloud transition. A plethora of surveys from the likes of IDG and Gartner show that more than 70 percent of enterprises have deployed at least one or more cloud application or workload. Yet a closer inspection at the data reveals less than half of these cloud projects involve production...
Nov. 28, 2015 03:00 AM EST Reads: 483
Microservices are a very exciting architectural approach that many organizations are looking to as a way to accelerate innovation. Microservices promise to allow teams to move away from monolithic "ball of mud" systems, but the reality is that, in the vast majority of organizations, different projects and technologies will continue to be developed at different speeds. How to handle the dependencies between these disparate systems with different iteration cycles? Consider the "canoncial problem" in this scenario: microservice A (releases daily) depends on a couple of additions to backend B (re...
Nov. 28, 2015 03:00 AM EST Reads: 453
Growth hacking is common for startups to make unheard-of progress in building their business. Career Hacks can help Geek Girls and those who support them (yes, that's you too, Dad!) to excel in this typically male-dominated world. Get ready to learn the facts: Is there a bias against women in the tech / developer communities? Why are women 50% of the workforce, but hold only 24% of the STEM or IT positions? Some beginnings of what to do about it! In her Day 2 Keynote at 17th Cloud Expo, Sandy Carter, IBM General Manager Cloud Ecosystem and Developers, and a Social Business Evangelist, wil...
Nov. 28, 2015 02:00 AM EST Reads: 583
PubNub has announced the release of BLOCKS, a set of customizable microservices that give developers a simple way to add code and deploy features for realtime apps.PubNub BLOCKS executes business logic directly on the data streaming through PubNub’s network without splitting it off to an intermediary server controlled by the customer. This revolutionary approach streamlines app development, reduces endpoint-to-endpoint latency, and allows apps to better leverage the enormous scalability of PubNub’s Data Stream Network.
Nov. 28, 2015 02:00 AM EST Reads: 331