Proactive Security Management - Large Enterprise Business - HP

3–4
Protecting Against Increasing Threats
The threat environment is increasingly complex and rapidly evolving. Reports of security incidents are
rising, viruses and other attacks are spreading at faster rates, the complexity of attacks is ever more
sophisticated, and relatively sophisticated tools for unsophisticated attackers (so-called "script kiddies")
are widely available. This environment leads to a number of security management challenges.
As the number and type of incidents increases, distinct protection
technologies to prevent new attacks are deployed—for
example, firewalls, anti-virus tools, and intrusion detection systems
(IDSs). Each new protection technology or component
introduces additional complexity in the organization. Each
new component must be managed and integrated with the
other security protection technologies deployed in the environment.
This complexity represents a threat to the security of
the organization.
The increasing speed of attacks drives the need for a well-developed incident management program.
When attacks operate at computer speed rather than human-scale speed—that is, milliseconds rather
than hours—it is necessary to automate responses rather than contemplate actions. This move to a
proactive posture of security management also applies to underlying security enforcement technologies;
they must evolve to take proactive steps to protect against new, imminent attacks.
To balance security technology, people and processes must not be overlooked. Awareness and training are
essential. The more end users can learn about the actions they can and must take to mitigate threats,
the more secure the enterprise will become. And the more that the enterprise can capture, learn from,
and reuse (as appropriate) best practices in response to threats and attacks, the more efficient the process
will become. Unknowing actions can undermine the best-managed security infrastructure.
Enabling Changing Trust Models
The opening of business and organizational boundaries has changed old security models. With any
combination of partnerships, mergers, dynamic supply chains, online customer services, federations, and
changing user populations, it is very difficult to draw a line showing where an organization's intranet
stops and the Internet begins. The old concepts of inside (people inside the organization–employees or
contractors) and outside (everyone else) no longer hold. The reports of incidents involving insiders show
that this old, single–wall model of security is not adequate. Proactive security management must now
protect a larger set of users that change over time, including a changing set of privileges based on
roles, and a set of resources that can expand and contract. This protection must match the speed of the
changes. For example, when an employee is hired or fired, access to resources must be disabled in a
reasonably short time.
Combating Increased Process Complexity and Expense
When attacks operate at computer
speed rather than human-scale
speed—that is, milliseconds rather than
hours—it is necessary to automate
responses rather than contemplate
actions.
New types of attacks cause companies to deploy a growing number of security technologies. For
example, a corporate perimeter might use firewalls, routers, and gateways—each with a complex
set of rules to create and modify. Behind that might be some bastion hosts, which are server class
machines that provide Internet services. Other components of a company's IT infrastructure might
include an IDS, an anti-virus program, and a security patch management system.
From this quick example, the complexity of managing security technologies becomes apparent.
Correlating alarms and alerts, consolidating control, centralizing the reporting and management of
the entire security operation, and developing in-house expertise for each of these components are
significant challenges. Proactive security management solutions and services can simplify or completely
offload (if outsourced) the burden of this complexity.