Effective Security Policy: Emphasis On Execution

With the release of each new vendor- or service provider-sponsored cyberthreat report detailing dramatic increases in attack volume and virulence comes an inevitable wave of widespread panic. This immediate alarm gives way soon enough to general resignation that escalating threat levels are inevitable.

The publication of the latest Symantec Internet Security Threat Report is no exception, with stomach-churning statistics such as the fact that 5.5 billion malicious attacks stopped by Symantec alone in 2011 represent an 81 percent increase versus 2010, and that hacking attacks resulted in 187 million personal identities being breached just last year.

But beyond raising the collective blood pressure of IT departments and executives, what purpose do these studies serve if they don't prompt organizations to re-evaluate whether they have adequate protections in place to defend against the current threat environment?

Vendor and service provider-sponsored threat reports yield not only fascinating -- and often scary -- facts, but they can also shed light on where the next threats may be coming from and what type of entities are in the cyberattackers' sights. To this end, the Symantec research found that more than 50 percent of all targeted attacks were leveled against organizations with 2,500 or fewer employees. The same report also pointed to some good news, noting that recent spambot takedowns had cut spam volumes from 88.1 percent of all email in 2010 to 75.1 percent last year.

This kind of information can be helpful in assessing the overall threat landscape and prioritizing defensive efforts. Unfortunately, too often the deer-in-the-headlights effect takes over, and overwhelmed enterprises continue business-as-usual practices when what they really need to do is stop and carefully assess whether their current security posture is adequate.

This process starts with taking a very careful look at current policies to make sure these are aligned with corporate governance and compliance requirements.

There is a long list of policy elements organizations should consider. These components include everything from classifying data and encrypting the most sensitive files, to ensuring consistent and thorough update patching policies, to instituting clear security best practices around Bring Your Own Device (BYOD). Are users allowed to connect directly from enterprise resources from their own mobiles and other computing devices, or will their connections be limited to a guest network? Enterprises also need to address common elements, such as whether and when to allow data to be downloaded to removable peripheral devices.

In defining these policies, IT organizations have to strike a balance between sufficient protective measures and overkill. In other words, effective security relies on organizations to find a way to institute security measures that don’t interfere with performance.

Unfortunately, far too many organizations have well-defined security policies that sit unused in an unopened binder somewhere on a shelf in the IT department. Clearly the best-designed security policies are completely ineffective if they aren't consistently implemented throughout the organization.

Effective security practices start with fundamental communication about what corporate policies are around things like data handling and encryption, and continue with ongoing programs to educate users on things like the potential danger of opening attachments from unknown sources and which websites might harbor malware.

This continuity and vigilance in both communications and implementation is critical to effective security. As we see in so many studies, the nature of the threat environment is always evolving.

Amy Larsen DeCarlo is a principal Analyst, Security and Data Center Services, for Current Analysis