Corporate security

Corporate security:

Companies today are facing to many area’s were they have to try and protect against.  Web sites like Facebook and youtube that allow you to upload files from any computer which in turn is very hard to protect against, unless you block the site’s from being allowed through your firewall, then the staff of these companies start to use the proxy web servers that are out there.

This then gets into the debate about the social networking that is the new buzz word out in the field this year.

Importance of Corporate Security Policy
Defining corporate security policies, basing them on industry standards, measuring compliance, and outsourced services are keys to successful policy management.

In today’s high-tech and interconnected world, every corporation needs a well thought out security policy. Threats exist from both within the walls of each enterprise as well as from external sources such as hackers, competitors and foreign governments. The goal of corporate security policies is to define the procedures, guidelines and practices for configuring and managing security in your environment. By enforcing corporate policy, corporations can minimize their risks and show due diligence to their customers and shareholders.

Why Have A Security Policy?

Information security is a business issue, not just a technology issue. The reason organizations want to protect information should be for sound business purposes. Corporate knowledge and data are arguably the most important assets of any organization. Corporations must ensure the confidentiality, integrity and availability of their data. These three security objectives answer the questions: “Who sees the data?”, “Has the data been corrupted?” and “Can I access the server or data when I need it?”

Corporate Security Policies provide several benefits. They provide a standard baseline of security policy modules and checks, based on the organization’s information security policies and standards. They establish a solid, scalable basis for an enterprise-wide product deployment such as ESM. Policies heighten security awareness of company personnel. They also help organizations demonstrate their commitment to protecting their vital information assets.

Having a security policy that is easily measured and enforced is key. Tools, such as Symantec Enterprise Security Manager™ (ESM) are designed to measure enterprise-wide security policy compliance. It answers the question “How secure are we?”

Where To Start

The first step toward implementing information security is to formulate a security policy. Identify the key assets to secure, and which assets will be extended to whom. The role of the policy is to guide users in knowing what is allowed, and to guide administrators and managers in making choices about system configuration and use. This process will help you establish specific security goals and a plan to tackle them. Before you can manage security you have to have a way to measure its effectiveness. Your corporate security policy provides the acceptable baseline standards against which to measure compliance.

There is no need to start from scratch. Rather than analyzing every risk, look at what others are doing. Meet standards of due care by using existing standards and industry “best practices”. Pay attention to regulations and requirements from government, industry and partners.

Some small organizations have the tendency to define security policy from the bottom up, starting with the capabilities of the tools at hand. Medium and large enterprises know that sound security policies begin from the top down.

As the policy pyramid shows, the best security begins with upper management creating an actual policy or mandate to implement security. The policy should be based on industry standards and regulations such as ISO 17799 and HIPAA. Procedures, guidelines and practices form the basis for all security technology. Products such as ESM measure policy compliance with modules and policies for operating systems, databases and applications. These then interact with the actual computer environment.

A thorough security policy doesn’t stay static. It is a living document, changing with corporate needs. It evolves to guard against perceived threats and changing system architectures.

Organizations must also maintain a “best practice” level of compliance, in order to pass audits measured against standards and regulations.

Standards And Regulations

A host of information security standards and government regulations have been published over the years providing a great foundation for corporate security policy.

Standards are often based on user consensus or international adaptation. The ISO/IEC 17799 international standard is based on security requirements established by the British Government form BS 7799 Part I. Its stated purpose is to “give recommendations for information security management for use by those who are responsible for initiating, implementing or maintaining security in their organization”. The Center for Internet Security (CIS) is an emerging worldwide standards consortium developing benchmarks to determine if minimum standards of due care are taken. The SANS/FBI Top 20 Internet Security Threats combines top 10 lists from multiple security vendors and experts.

Regulations are developed by U.S. and foreign governments to address specific industries such as finance and health care. HIPAA defines security and privacy standards for the health care industry. The Gramm-Leach-Bliley Act is legislation addressing financial services in the United States.

The table below lists several standards and regulations that enterprise customers and government agencies are required to adhere to.

A large portion of a corporate security policy is proactive in nature. Tools that help measure risk as well as security policy compliance are often grouped under the category of vulnerability management (VM) products. This is equivalent to the physical security analogy of “putting locks on the doors.” Intrusion detection products should also be deployed. These tend to be reactive in nature. This is equivalent to the physical security analogy of “sounding burglar alarms.” Both are needed. Both should work together and compliment each other.

Summary

Organizations need security policies, standards and procedures to enforce information security in a structured way. The choice of policies needed by the organization should be acquired through a thorough risk analysis, which includes security vulnerability assessments. The assessment results, combined with a proper policy framework and standards, should determine which policies are needed for your organization. Using tools such as Symantec Enterprise Security Manager can assist in measuring corporate policy compliance. Additional services can ensure the corporate policy is always up to date and implemented correctly. Corporate security policy is absolutely essential for securing an organization.