Download as PDF - Secunet

National
PREVENTIVE SECURITY #1
Preventive security is in this respect a key concept: specific organisational, infrastructural, technical and
staffing strategies that are tailored to individual circumstances and to constructing a defence that kicks
in before something bad happens. In subsequent issues of secuview, you can read interesting and sometimes
even amusing case studies (anonymised, of course) compiled by our secunet experts.
FIFA World Cup
Shoots Holes in
IT System
Directives from above defeat even the best
technical defences
There are many IT systems that, technically speaking, are well
protected. But unfortunately, these too fall victim to elementary
attacks because individually appropriate organisational
processes have not been implemented or upheld.
“How could they overcome the formidable barriers that we
now have in place The way they were bypassed makes us
look like amateurs!” Unfortunately, this quote is genuine and
the circumstances that permitted this successful IT attack are
by no means exceptional. The technology and the administrators
really were high calibre. The problem lay entirely elsewhere.
The vulnerability was caused by the instruction issued
by a senior executive to allow certain IT services during the
World Cup so that he could follow games live on his PC.
Although the administrators expressly advised of the associated
security risks, the desire of this senior person to watch
the matches live at work obviously outweighed the concerns
of the lower-ranking technical staff. The expert in this case –
i. e. the system administrator – had no recourse against the
decision.
This real-life scenario is by no means exceptional. secunet
is often called out to deal with emergencies that have been
caused by the absence of organisational security measures.
In the case cited above, a clearly defined and auditable documented
process that gave the administrator suitable veto
rights would have helped to uphold the high level of security
afforded by the systems in place. It would then have been
possible to take secure and responsible action, overriding the
personal preferences of the boss.
Security must be integral to
corporate culture
Experience has shown that, although many government agencies
and private businesses have put appropriate security
measures in place, these are not upheld rigorously due to the
organisational aspects of information security. At the same
time, however, there is no shortage of standards and best
practices to provide support here. For example, the IT security
management standards typified by the ISO 27000 family and
those implemented in accordance with BSI baseline protection
or the recommendations of ITIL (IT Infrastructure Library) and
COBIT (Control Objectives for Information and Related Technology).
secunet experts with many years of experience are
available to support any appropriate customisation or tailored
implementation.
More information:
René Seydel
rene.seydel@secunet.com
IN THE NEXT ISSUE:
Well confi gured – one click for enhanced security
12 » 1 | 2013