Download as PDF - Secunet

More documents

Recommendations

Info

National PREVENTIVE SECURITY #1 Preventive security is in this respect a key concept: specific organisational, infrastructural, technical and staffing strategies that are tailored to individual circumstances and to constructing a defence that kicks in before something bad happens. In subsequent issues of secuview, you can read interesting and sometimes even amusing case studies (anonymised, of course) compiled by our secunet experts. FIFA World Cup Shoots Holes in IT System Directives from above defeat even the best technical defences There are many IT systems that, technically speaking, are well protected. But unfortunately, these too fall victim to elementary attacks because individually appropriate organisational processes have not been implemented or upheld. “How could they overcome the formidable barriers that we now have in place The way they were bypassed makes us look like amateurs!” Unfortunately, this quote is genuine and the circumstances that permitted this successful IT attack are by no means exceptional. The technology and the administrators really were high calibre. The problem lay entirely elsewhere. The vulnerability was caused by the instruction issued by a senior executive to allow certain IT services during the World Cup so that he could follow games live on his PC. Although the administrators expressly advised of the associated security risks, the desire of this senior person to watch the matches live at work obviously outweighed the concerns of the lower-ranking technical staff. The expert in this case – i. e. the system administrator – had no recourse against the decision. This real-life scenario is by no means exceptional. secunet is often called out to deal with emergencies that have been caused by the absence of organisational security measures. In the case cited above, a clearly defined and auditable documented process that gave the administrator suitable veto rights would have helped to uphold the high level of security afforded by the systems in place. It would then have been possible to take secure and responsible action, overriding the personal preferences of the boss. Security must be integral to corporate culture Experience has shown that, although many government agencies and private businesses have put appropriate security measures in place, these are not upheld rigorously due to the organisational aspects of information security. At the same time, however, there is no shortage of standards and best practices to provide support here. For example, the IT security management standards typified by the ISO 27000 family and those implemented in accordance with BSI baseline protection or the recommendations of ITIL (IT Infrastructure Library) and COBIT (Control Objectives for Information and Related Technology). secunet experts with many years of experience are available to support any appropriate customisation or tailored implementation. More information: René Seydel rene.seydel@secunet.com IN THE NEXT ISSUE: Well confi gured – one click for enhanced security 12 » 1 | 2013
Neben dem Beruf zum Bachelor & Master Bachelor-Abschlüsse: Europäische BWL (B.A.) Wirtschaftspsychologie (B.A.) Finance & Mangement (B.Sc.) Logistikmanagement (B.Sc.) Wirtschaftsrecht (LL.B.) Master-Abschlüsse: Wirtschaftspsychologie (M.Sc.) Business Coaching & Change Management (M.A.) MBA Hochschulkurse mit Zertifikat Jetzt 4 Wochen kostenlos testen! Jederzeit starten Freie Zeiteinteilung Ortsunabhängig per Fernstudium Jetzt informieren: www.Euro-FH.de 0800 / 33 44 377 (gebührenfrei) Infos anfordern: 600 AA
Page 1 and 2: The IT Security Report by Issue 1 |
Page 3 and 4: National Local High-Quality IT Prod
Page 5 and 6: National effect on cyberspace secur
Page 7 and 8: National Bavaria creates own Trust
Page 9 and 10: News in Brief HACKERSTORY #2 Budget
Page 11: National What a PKI does PKI involv
Page 15 and 16: International secunet’s face reco
Page 17 and 18: News in Brief secunet on Twitter, X
Page 19 and 20: Dates SINA meets the Secretary of D

Download as PDF - Secunet

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?