Security Back to Basics - Part 3a (Managing the Threat)

In previous blogs we talked about needing to educate the end users and knowing the details of what activity is occurring on your enterprise’s systems.  In part 3, we’re going to talk about managing the threats that occur with a layered approach. Good security doesn’t stop at the endpoint with just an antivirus client (link to symc sep), it doesn’t stop with just a perimeter firewall.  It starts with good knowledge of your environment, and grows out to each layer (Network, Endpoints, Client Hardware, Storage, etc) we’ll talk about each one in the next paragraphs. Starting from the lowest layer of the endpoint, we look at endpoint encryption.  For an increasingly mobile workforce the need to secure the data that is located on their removable storage devices and local disks.  Using a product such as Symantec’s Endpoint Encryption or their recent acquisition of PGP you can securely protect the physical bits and bytes on disks.  An example of this is a contactor or high level employee running to a meeting or airport.  This person goes through the standard security procedures like taking off their shoes, putting their laptop in a bin to be X-rayed, then picking up his bag but not his laptop.  This laptop can contain anything from personally identifiable information like employee social security numbers, addresses, confidential data or credit card numbers.  Encrypting the whole disk and any removable devices helps to add the protection from having that data compromised. The next layer of the stack is Endpoint Protection. This is your traditional antivirus and network IPS product that protects the endpoint from viruses, malware, and malicious traffic.  This has been a key component of security in enterprises for over 25 years.  Over the years as threats have gotten increasingly more complicated and sophisticated, the products that protect against them have also become more sophisticated.  Where even 5 years ago antivirus was maybe just good enough, now Endpoint Protection products include IPS at the network layer, firewalls, device control, and application control.  These protect the client from malware that exploits known vulnerabilities in products like Microsoft Windows and Adobe Acrobat.  Performance of the clients have also increased significantly as well. In next month’s blog we’ll be talking about Compliance and Endpoint Management.  Two months from now, we’ll talk about the Network layers with Network Access Control and Email/Web Security.