The concept of intelligent containment of risk is an important approach to overall IT security. In today’s environment, rapid and proactive containment of problems and breaches — in addition to just trying to keep the bad guys out of your systems — makes sense.
To find out what other approaches to data security are gaining traction, listen to today’s podcast featuring Kaivan Rahbari, senior vice president of risk management at FIS Global. The discussion is moderated by Dana Gardner, Principal Analyst at Interarbor Solutions.
Download the podcast (23:37 minutes) or use the player:
Here are some excerpts:
Dana Gardner: What’s different about the overall security landscape today, compared to five years ago?
Kaivan Rahbari: A lot has changed in the past five years. Two key economic trends have really accelerated our security changes. First, the U.S. recession pushed companies to consolidate and integrate technology footprints and leverage systems. New deployment models, such as software as a service (SaaS) and cloud, help address some of the lack of capital that we’ve been experiencing and the ability to push cost from fixed to variable.
The second major economic trend that has continued in the past five years is globalization for some of the companies. That means a network topology that’s traversing multiple countries and with different laws that we have to deal with.
We always talk about how we’re only as strong as our weakest link. When larger and more sophisticated companies acquire smaller ones, which is pretty commonplace now in the market, and they try to quickly integrate to cut cost and improve service, they’re usually introducing weaker links in the security chain.
Strong acquirers now are requiring an acquisition to go through an assessment, such as an ISO 27001 certification, before they’re allowed to join “that trusted network.” So a lot of changes, significant changes, in the past five years.
Gardner: Tell us about FIS Global.
Largest wholesaler
Rahbari: FIS is a Fortune 500 company, a global company with customers in over 100 countries and 33,000 employees. FIS has had a history in the past 10 years of acquiring three to five companies a year. So it has experienced very rapid growth and expansion globally. Security is one of the key focuses in the company, because we’re the world’s largest wholesaler of IT solutions to banks.
Transaction and core processing is an expertise of ours, and our financial institutions obviously expect their data to be safe and secure within our environments. I’m a Senior Vice President in the Risk Management Group. My current role is oversight over security and risk functions that are being deployed across North America.
Gardner: What is the nature of security threats nowadays?
Rahbari: Attackers are definitely getting smarter and finding new ways to circumvent any security measure. Five years ago, a vast majority of these threats were just hackers and primarily focused on creating a nuisance, or there were criminals with limited technology skills and resources.
Cyber attacks now are a big business, at times involving organized crime. These are intruders with PhDs. There could be espionage involved, and originate in countries with no extradition agreements with the U.S., making it very difficult for us to prosecute people even after we identify them.
You’ve also read some of the headlines in the past six months, things such as Sony estimating a data breach and cleanup of $171 million, or an RSA hack costing EMC $66 million. So this is truly a big business with significant impacted companies.
Another key trend during the past five years that we’ve seen in this area is that the nature of the threats are changing from very broad, scattered approach to highly focused and targeted. You’re now hearing things such as designer malware or stealth bots, things that just didn’t exist five or 10 years ago.
Other key trends that you’re seeing is that mobility and mobile computing have really taken off, and we now have to protect people and equipment that could be in very hostile environments. When they’re open, there’s no security.
The third key area is cloud computing, when the data is no longer on your premises and you need to now rely on combined security of your company, as well as vendors and partners.
The last major thing that’s impacting us is regulatory environment and compliance. Today, a common part of any security expert terminology are words such as payment card industry (PCI), Gramm-Leach-Bliley Act (GLBA), and Sarbanes-Oxley (SOX), which were not part of our common vocabulary many years ago.
Gardner: So how do we play better defense? Most of the security from five years ago was all about building a better wall around your organization, preventing any entry. You seem to have a concept that accepts the fact that breaches are inevitable, but that focuses on containment of issues, when a breach occurs. Perhaps you could paint a picture here about this concept of containment.
Blocking strategies
Rahbari: As you said, it’s easier to secure the perimeter — just don’t let anything in or out. Of course, that’s really not realistic. For a vast majority of the companies, we need to be able to allow legitimate traffic to move in and out of our environments and try to determine what should be blocked.
I’ll say that companies with reasonable security still focus on a solid perimeter defense, but companies with great security not only guard their perimeter well, they assume that it can be breached at any time, as you stated.
Some examples of reasonable security would include intrusion protection, proxies to monitor traffic, and firewalls on the perimeter. You would then do penetration testing. On their PCs you see antivirus, encryption, and tools for asset and patch management. You also see antivirus and patch management on the servers and the databases. These are pretty common tools, defensive tools.
But companies that are evolving and are more advanced in that area have deployed solutions such a comprehensive logging solutions for DNS, DHCP, VPN, and Windows Security events. They have very complex security and password requirements.
As you know, password-cracking software is pretty common on the Internet nowadays. They also make sure that their systems are fully patched all the time. Proactively, as you know, Microsoft publishes patches every month. So it’s no longer sufficient to upgrade a system or patch it once every few years. It’s a monthly, sometimes daily, event.
Loading ...
