Enterprises Need to Rethink Network Security

IT’s security model is outmoded and broken with over-long patch cycles, all of which turn the classic central network into worm fodder.

But enterprises remain in denial when it comes to addressing vulnerabilities, according to Dr. Paul Dorey, chief information security officer of global oil company BP.

Dorey said the classic model, of a central network with clients and servers on a flat LAN structure with firewalls, is outdated.

The old perimeters of a corporation protected by a firewall no longer exist because companies can no longer define where their borders end, particularly when dealing with business partners.

“One moment an organization is a competitor, and the next collaborates on a project; not being able to determine the edge or perimeter is a ghastly problem for security people,” Dorey said, adding that firewalls are not the solution.

More enterprise desktops should be online because companies should not rely on the corporate network for security, he said.

“Clients should be put online with servers placed in armored, segregated areas separate from the network,” he said.

This is necessary to keep the network simple by avoiding application clutter so patch updates happen immediately, he said.

Dorey, who is also U.K. chair of the Institute of Information Security Professionals (IISP), delivered the keynote address at the Australian IT Security Summit in Sydney last week.

“Most corporations say they have a four-day patch cycle, but this should really be four minutes or four seconds,” he said.

“Companies patch 85 percent of their network really well, but a real challenge is to get that last percentage of clients.

“We have around 65,000 clients and 300,000 nodes globally, and it is hard to get a hold of [patch cycles].”

Increased wireless access points and nonexistent perimeter security make organizations more open to attack, he said.

“People see firewalls as just speed bumps to regulate traffic, not for protection,” Dorey said.

Three trends that will change Internet security over the next four years include the Jehrico Forum, (a global user community devoted to promoting open standards in security), accreditation through the IISP and the control systems certification.

By Michael Crawford, Computerworld Australia

Keep checking in at our Security Feed for updated news coverage.