Security is arguably the single most important issue to business and the public sector in the 21st century.
And yet it’s becoming increasingly difficult to address this need. Assaults on security have become widespread – whether in the form of malicious code sent by e-mail, unauthorized access to network infrastructure or damaging actions of disgruntled (or simply foolhardy) employees. Much like the alarm-system in a new car, security should be standard equipment on a new network – not something that’s bolted on later. John Roese>Text
While threats are pervasive, protection is not.
The price of neglect
Many public sector organizations have not taken adequate measures to effectively shield themselves from security attacks.
Workstations and networked devices are not kept current with the most recent security updates, making them the weakest link in what could otherwise be a strong security chain.
Attention of security administrators (in organizations that do have them) is spilt between identifying and forestalling intranet-related threats on the one hand, and those originating from the Internet on the other.
Cyber crime continues to wreak havoc. In the U.S. this year, financial losses from information theft totalled more than $140 million, according to a 2004 survey of 494 U.S. businesses conducted by the Computer Security Institute and the FBI.
Combined with virus attacks, financial fraud, insider network abuse and other attacks, security breaches cost businesses billions of dollars each year.
Here’s a statistic that should put the issue in perspective: at the start of this decade, losses from the average bank robbery amounted to $2,500. For the average computer crime it was $500,000! And the latter figure is probably an understatement, given that more than half of all computer crimes go unreported or cannot be quantified.
In the public sector, where public trust demands greater integrity, IT security breaches can be so much more destructive – doing far more than just fiscal damage. In an increasingly information-centric world, the potential for loss of face and lawsuits is greater than ever.
The antidote to this is a security strategy that delivers, but does not force organizations to dramatically overhaul existing systems or incur massive additional expenses.
This can only be accomplished by means of a new networking paradigm, where security is embedded in the network itself. In other words, much like the alarm-system in a new car, security should be standard equipment on a new network – not something that’s bolted on later.
The surprising truth is many public sector organizations today continue to deploy networks based solely only the metrics of connectivity, capacity and cost.
With that mindset, it’s easy to lose sight of far more critical elements – continuity, context, control, compliance and consolidation.
Securing ROI
The focus on cost forces many system administrators and CIOs to justify security spending in terms of ROI.
That’s not necessarily a bad thing. However, at a time of budget scrutiny, few organizations – both in the public and private sector – truly grasp the true ROI potential of security investments.
From where is that ROI derived?
Leaders from the top down need to understand that the security system is part of a well thought-out risk management strategy. The principal question then is not: what is the ROI? But what is the value of the network? And, more to the point, what services and applications use it? The focus of many network vendors – and their customers – on simply building lower-cost, faster networks misses the most important objective for today’s CIOs: business continuity. High-capacity networks aren’t going to be the driver for the next wave in networking, because they don’t respond to the inherent problems in today’s world.
Fortunately, integrated security does.
Leaders in both government and business need also to consider what is being used over the network, and its function.
With every device – from workstations, laptops and PDAs, to surveillance cameras, printers, copiers and IP phones – now connecting to the network, vulnerability increases exponentially.
Many of these devices were never considered in the original network design, and most organizations struggle to understand how to control them on the network. This challenge is compounded by the ongoing trend towards convergence. Most networks cannot properly classify devices such as an IP phone. Is traffic on that device to be treated as IP- or phone-traffic? What privileges should it get? What safeguards should be applied?
Automating defences
Overcoming the challenge of handling security on all of these disparate endpoints requires enterprise-level security throughout the network, but especially at the end system. There must be an automated method for determining the trust-level of every end system that ensures only devices with correct and up-to-date security configurations access the corporate infrastructure.
End systems – such as applications in use, operating system patch levels, and anti-virus signature revisions – that fail to meet security parameters would then be quarantined, and automated corrective action targets the end-system device. Such a scenario stops vulnerable or dangerous systems in their tracks, and eliminates disruptions and privacy risks.
I’m not suggesting for an instant that the cost and capacity of network architecture are not important factors. Instead, I’m saying that higher performance and lower cost are givens in order to really leverage the network — but not without addressing security. Consider the Road Accident Fund (RAF) of South Africa for example. A government body funded mostly by the fuel levy in its country, the RAF acts as the insurance company responsible for processing all road accident claims. The organization handles compensation for personal loss or damage wrongfully caused by motor vehicles, covering medical expense and loss-of-support costs for all of South Africa.
With more than 1,000 employees, the company found it needed increased capacity to meet network traffic demands. Bottlenecks severely affected the performance of many of its branches, making it virtually impossible for it to achieve its “uptime” goals. A cost-effective, high-performance network was required. While recognizing the importance of bandwidth, the IT manager also knew the new network had to be manageable and completely secure.
As the types of data transported over the network include medical claims as well as human resources, payroll and other financial systems, security was essential to prevent unauthorized access to the network, which processes and controls several hundred million rands (hundreds of thousands of Canadian dollars) in payouts each year.
Not only was the addition of security and firewalls necessary but like many public organizations, the RAF also wanted to implement the service without incurring additional costs. At the same time, the organization sought to deploy a stable, reliable network that could grow to meet evolving requirements.
The answer was an easily manageable network infrastructure that offers them greater bandwidth and handles all of their networking needs, but has integrated security and control on the LAN and to the WAN edge.
Numerous government organizations are today find themselves in the very same situation as the RAF, reaching the end of their bandwidth rope or, in some cases, faced with immediate network security concerns.
Fortunately, CIOs and executives at all levels are becoming increasingly aware of the new threats and demands on the network – and that the solution lies in intelligent networks with integrated, embedded security.
John Roese is Chief Technology Officer at Andover, Mass.-based Enterasys Networks Inc. Roese is the technical visionary, responsible for the company’s strategic technical direction.