Industry View

How to Combat Five Network Security Compliance Risks

Atchison Frazer and Brian Dennis provide practicals for ’court-proof’ security in areas of common corporate weakness.

By Atchison Frazer and Brian Dennis

CONCLUSION:

First, mandate privileged network security zones, using technologies that can block, log and create an audit trail for blended attacks and internally-spawned threats. By quarantining a department, you will mitigate outbreaks and potential losses on your network, due to theft, spam, viruses, and blended intrusions.  This is a common practice in physical security; so too should it be for virtual security in the network.

Second, provide layered security for your employees working remotely as well as extranet security for third parties who often represent the greatest threat of bringing down a network or stealing confidential information by exploiting the limitations in most flat networks from edge-based Remote Access Servers that generally lack application intelligence to perform contextual inspection of data packets. 

Third, create redoubted layers of secured access specific to the officers and senior managers in the company, and take responsibility for all data that passes from their computers and other digital communications devices – at corporate headquarters, home, or any remote location. All information coming from or going to the fiduciary’s various means of communications is highly privileged, so security controls should be pervasive where the business and network architectures converge.

Fourth, look closely at the court rulings as a guide to mitigate escalating cyber-insurance costs.  One possible formula to justify a reduction in cyber-insurance costs is SC= p(x)L + wx:
* Where p=probability of cyber-loss
* X=precaution level
* L=loss from cyber-attack
* w=precaution cost (per $ of unit)
* p’(x)<:chance of cyber-loss decreases with precaution

Fifth, implement corporate security policies that protect audit trails for IP going into and leaving company networks, as well as appliances that log and correlate events of malicious exploits, while establishing an enterprise architecture strategy to embed security intelligence throughout the fabric of the network.

Corporations rely on a combination of speed and accuracy to make financial information of a material nature publicly available.  This requires greater emphasis on reviewing your organization’s overall security risk management plan and devising a holistic compliance scheme that is resilient enough to adapt before the next sophisticated attack occurs.

Atchison Frazer is director of enterprise services strategy for Cisco based in San Jose, California. Brian Dennis is a legal analyst based in New York.

• Email
• Print
• Comments
• Digg This
• SlashDot