We have developed an excellent - Teletimes

Businesses must shore upsecurity processesArcSight CTO says companies must implement fivekey processes to ensure tighter securityBusinesses across the worldare facing an ever-increasingbattle to keep their IT systemsfrom being broken into bycyber-criminals and, accordingto Dr Prescott B Winter, CTOPublic Sector for cybersecurityand compliance company Arc-Sight, no enterprise can ever befully secure from cyber-attacks,particularly when human erroris thrown into the informationsecurity mix."Nobody is ever going to be100% secure in this domain,especially if you want to beopen, exchange information withcustomers, do all the things thatevery company and governmententerprise around the worldis trying to do. Human error isinevitably part of the picture,that is why you have to be sodiligent, you have to go back toinspecting to identify the departuresfrom policy rather that justexpecting people to do it right,"Winter said.Winter identified five keyprocesses that must be undertakenby corporations to rendertheir security systems almostwatertight.The first of the key processes isunderstanding what the principalbusiness risk issues are andwhy the enterprise exists.Corporate security decision makersmust know what informationassets are most important forthat mission, whether it is ina business sense, to sell goodsand services, or whether it is ina government sense to executesome kind of government missionas a service."So the first question is to getthe business risk managementissues out on the table andto identify those and identifywhat has to be protected," saidWinter.The second key security processis to have a reasonably goodunderstanding of the currentattack structures and the natureof the threats so businesses canunderstand how that set of attackvectors is likely to manifestitself when going after key businessassets.The third key point is thatcompanies must have the rightsecurity sensors and instrumentationin the network to detectattack vectors."As these attack vectors comein, can I actually see them? CanI see them reliably and confidentlyand be virtually assuredof picking them up when theycome inside. These attacks dotake time, they are not instantaneousand it takes a long timeto introduce this stuff, to get itproperly deployed. In most casesyou have weeks to months tostop it," said Winter.The fourth key process, accordingto Winter is absolutelyessential, and that is to correlateall the security information froma business or enterprise and geta holistic picture of the securitylandscape within the corporation."As I see it that is the most importantthing after you get yourbusiness risk management issuesstraightened out. How do youactually see what is happening.You cannot protect what youcan't see and the only way tosee it is to bring it all together,all this tremendous welter of information,millions of logs a day.Bring it into a coherent picture,"said Winter.The fifth process essentialto securing any business orcorporation is quick responseand remediation of any securityissues that may arise."This is where you begin toGeorgina Enzermerge your security operationcentre and your network operationcentre which gives you anideal insight into configurationsand status and operation of yourIT and from your security operationcentre, side informationon what is attacking all thosesystems and what is a priorityand how you have to fix it," saidWinter.Only a very small number, in thesingle digits in terms of percentage,have implemented thesevital security steps, according toArcSight.Winter said that sharinginformation about threats orattacks between companies isessential to help create a sharedknowledge and understandingof potential and actual cyberthreats."Last fall there was a break inin three of the big New Yorkbanks and it was essentially thesame kind of attack and on alittle bit of inspection, it turnedout that a fourth bank had seenan earlier version of that sameattack. Not quite as well developed,not quite as powerful, notquite as effective. The first bankhad managed to get it stoppedbefore it caused any seriousdamage, but nobody in the otherthree banks heard about this sowhen they got hit by a betterversion of the attack aboutthree weeks later, it succeededon all three of them and did alot of damage," said Winter.This is a very clear exampleof what this kind of threatContd. on page 5352 www.teletimesinternational.com15Jun - 14Jul 2011