download issue 24 here - Help Net Security

While I'm of the opinion that the economy is done bleeding for the most part,
it does not mean that I believe weʼll be back to the glory days anytime soon.
That produces a big challenge in 2010 for CIOs, who are trying to piece together
a series of legacy, new and specialized network systems to optimize
data and productivity without sacrificing their security posture in the process.
While easier said than done, it is by no means
impossible. What's more, CIOs are not alone,
and there are plenty of best practices to do
this. That's because the issue is not new, despite
the negative impacts to an organization's
competitiveness, manpower requirements and
operational risks. The upfront capital and personnel
costs to upgrade systems become difficult
to justify. So while the goal of implementing
new, integrated platforms is still on the
wish list of many IT departments, here's how
companies can deal in reality, and systematically
ensure that all its systems are working
together in the most secure and efficient manner
possible.
Review goals before setting policies
Security policies are usually modified and updated
when an organization implements a new
system, setting certain rules and guidelines for
that particular piece of software or equipment
without much regard to their relevance to today's
environment or impact to other networks.
In fact, many policies over time can be
so conflicting as to make them practically useless.
This is why CIOs need to take the time to
conduct a thorough review of their policies for
such issues. The best way to do this is to first
determine what their overall goals and objectives
are in preserving and protecting their organizationʼs
precious data. As daunting as that
sounds, there is help at little to no cost. For
example, the well renowned SANS (SysAdmin,
Audit, Network, Security) Institute offers a
Security Policy Resource page on its Web site
(www.sans.org/security-resources/policies/).
The free program is a consensus research
project of the SANS community, and is designed
to offer small to medium-sized
www.insecuremag.com 45