If you want the best computer defense your precious dollar can buy, focus on fixing that one problem.
The best solution is to prevent end-users from installing random software (which is often secretly malicious). Many administrators tell me they can't do that -- their employees would revolt and the company would become unproductive. I understand; that's the reality in many environments. But not fixing that one problem means you have to do all the other things, which will probably ultimately fail you.
Does your senior management understand that? Do they know that essential truth? Would they be as reluctant to lock down end-user PCs if they knew that the money spent on all the other defenses addressed just a tiny part of the overall security risk?
If you have the green light to solve that one problem, how can you do it? First, don't let your users have access to elevated Administrator or root accounts that allow software installs. That means you'll need to install all necessary software with the base image and manage updates using controlled software install technology.
Second, use whitelisting software to control which applications users are allowed to run. Whitelisting is available in Windows 7 (AppLocker) and from vendors such as Bit9, SignaCert, and McAfee. InfoWorld's Test Center will be publishing a comparison of whitelisting products later this month.
[ Is your network in danger of a password-cracking attack? Test the strength of your password policy. ]
Of course, it doesn't hurt to implement all those other defenses if you do them correctly and thoroughly. When you patch, make sure you patch everything, and in a timely manner. By "everything," I mean every OS patch, every app, every browser add-on, every network device, every security appliance. I've yet to pen-test a network that had up-to-date code on its Cisco routers. And I'm not surprised that security appliances often go unpatched. An appliance is nothing but a computer running software, but it's software that is usually harder to patch.
The learning gap
I would love to believe that end-user education could work against the new line of Trojan threats. But after trying and failing to beat malware with end-user education for the last 20 years, I'm not particularly hopeful. I've gone from telling end-users not to boot from floppies, to don't run that macro, to don't open that file attachment, to don't run that fake anti-virus software, and no, Microsoft doesn't send patches or updates via e-mail.
It takes us three to five years to educate our end-user population against a particular type of threat, and the attackers only three to five weeks to make up a new social engineering vector. Time and human nature are working against us.
This whitepaper explains the terminology and concepts behind Data Replication technologies and establishes some sizing rules through worked examples. Learn the new paradigm in disaster tolerance—protect data anywhere.
Download now »
Server virtualization is a popular option for dealing with mounting datacenter costs. Another equally promising approach is the use of an Application Delivery Controller. Citrix NetScaler provides a low-cost way for organizations to reduce their server count and accrue cost savings from a reduction in space, cooling, power and personnel.
Download now »
The emergence of WLANs has created a new breed of security threats to enterprise networks.
Included in HP ProCurve WLAN solutions is security technology that alleviates threats from WLANs through:
* Monitoring wireless activity inside and out of the enterprise
* Classifying WLAN transmissions into harmful and harmless
* Preventing transmissions that pose a security threat to the enterprise network
* Locating participating devices for physical remediation
Effectively address data protection challenges, implementing solutions that help store and protect business–critical data while cutting costs and improving efficiency and reliability.
Download now »Which is just another way of saying, So true, Roger. So true!
Great article, Roger!
Sign up to receive InfoWorld Resource Alerts
This white paper provides guidance on how to develop a strategic approach to managing and monitoring logs, a key function required for compliance with many regulatory mandates and a critical defense against security threats.
Download now! »
Learn about the processes and technologies that support security information management (SIM) operations, as well as the business case for SIM. The series examines different options for implementing SIM and gives you evaluation criteria for selecting the best option for your organization.
Download now! »
Learn the strategies, actions, and capabilities that Best-in-Class organizations employ and technologies they choose to obtain superior performance against various security performance metrics. This report provides guidelines for identifying which security solutions to consume as a MSS and defines best practices for choosing and managing MSSPs.
Download now! »
909 Recommendations
