ASK AWAY
NETWORK SECURITY CHECKLIST
HOW DO I SELECT THE MOST APPROPRIATE SOLUTION FOR MY NETWORK?
A
s bandwidth becomes more affordable, enterprise net- works are becoming extremely fast. However, this means that employees are demanding access to an increasing number of applications, such as Google Apps, Facebook and bandwidth-intensive video streaming apps such as YouTube.
Along with these new apps come complex security threats that are able to circumvent today’s standard firewalls. Most companies recognize the need to invest in security upgrades, but there are so many solutions to choose from. Below are the top 10 attributes enterprise businesses need to evaluate before investing in, or enhancing, their current net- work security solutions: 1. Speed. Will the solution introduce latency into your net- work? Addressing today’s blended threats requires com- plete content assembly and scanning. If this process is not hardware-accelerated, network speeds will be significantly reduced. At higher network speeds of 100Mbps, 1Gbps, etc., most solutions simply will not function.
2. Support. What support options are available (e.g., 8x5, 7x24, advanced warranty replacement, etc.)?
3. Cost. Is it less expensive to purchase multiple appliances from multiple vendors with multiple support contracts and devices to manage or migrate over time to a fully integrated security solution from one vendor?
4. Performance. Does the solution catch all of the threats it says it does and is that list extensive enough?
5. Footprint. How much power and space will a multi-threat solution consume in your data centre?
6. Features. Does the solution have all of the features you need, including anti-spam, anti-virus, anti-malware, IPS, WAN optimization, application control, web filtering, fire- wall, IPSec VPN, SSL VPN, contained in one easy-to- manage and deployed device?
7. Scalability. As your company grows, can the solution grow with you?
8. ROI. How quickly will the solution pay for itself? 9. Updates. Does the vendor have its own global threat analysis and engineering teams and will it automatically update every deployed device with the latest signatures, including variants, without human intervention or any dis- ruption of service?
10. Intellectual Property. Does the vendor own all of its intel- lectual property, thus allowing you to avoid integration, sup- port and accountability issues?
More often than not, large enterprises are only interested in adding one or two new security features, but by satisfying those requirements with a unified security appliance, more services can be evaluated and turned on, at no additional cost, as service contracts on existing stand-alone solutions expire. The results in ever-decreasing operating expenses, total cost of ownership and management complexities.
Graham Bushkes is the vice president of sales, Canada for Fortinet, a worldwide provider of network security appliances and unified threat management (UTM) solutions.
DATA LOSS PREVENTION
WHAT SHOULD I CONSIDER WHEN IMPLEMENTING A DATA LOSS PREVENTION STRATEGY?
Cases like this are a major concern, not just for client-sensitive data, but for com- pany sensitive data as well. Many times, these problems can be traced back to a simple user error, rather than a deliberate act by a disgruntled employee. Implementing an effective data loss prevention (DLP) strategy is not as simple as turning on a firewall or installing an anti-virus solution, but it doesn’t have to be overwhelming either. Here are a few key points to keep in mind: • Be very clear in defining what information you are trying to protect and why. When creating your policies, keep in mind the role of the person handling the infor- mation, and what they should be allowed to do with it.
W
• Set priorities. Work with your lines of business to define what information must be protected first. Defining the most critical information to your business will help in creating an effective protection policy. Develop your plan from there.
• Solutions must be flexible. Working in a “warning mode” is often a great step. A warning to users that what they are about to do is in violation of a policy is often as effective as outright prevention in many cases.
• Regular monitoring and automated enforcement of your DLP solution is very im- portant. Being able to go back and perform historical analysis of past violations is critical to fine tuning your policies.
• Integration with your role and compliance along with identity management solutions is also important. As users change roles in a company, access rights will change with them. Your DLP solution must be able to recognize this change and apply the proper policy to match the new role. Your data ranks among your most important assets, and a pound of prevention is worth an ounce of cure.
Amandio Pereira is director of security sales at CA Canada (
www.ca.com).
LP TRAINING
HOW CAN MY LOSS-PREVENTION EFFORTS BE EFFECTIVE IF MY EMPLOYEES AND CUSTOMERS ARE NOT AWARE OF THEM?
any business owners make the mistake of thinking that loss prevention is a game of “cat and mouse” between themselves and those who would steal from them. They go to great lengths to keep their loss- prevention programs and tactics a secret in the belief that they cannot be effective unless employees and customers are unaware of those measures. In fact, the exact opposite is true. The more employees are aware of loss- prevention efforts, the less likely they are to steal themselves. Enlightened re- tailers communicate frequently with employees about their loss-prevention initiatives. They make it clear that they maintain a “zero tolerance” policy to- ward theft and have clearly defined procedures to deal with the problem. No matter what loss-prevention programs you deploy — CCTV, point-of- sale reporting and analysis systems, in-store audits, physical alarms or live surveillance — make sure your employees and customers are aware of your efforts.
M
Most often, people steal because they believe they won’t get caught. The mere knowledge that you actively work to prevent theft will deter most from even trying. It is a simple, low-cost way to increase the effec- tiveness of your overall loss prevention initiatives and keep your operations secure.
Serges Pregent is director of loss prevention for Garda (
www.garda.ca).
e’ve all seen the headline: “Data leak exposes company’s customer info.” These incidents can destroy a company’s credibility when it comes to keeping clients’ private information safe.
24 SECURITY MATTERS • JULY/AUGUST 2010
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32