Security Manager's Journal: Did Someone Say 'Extra Money'?

Computerworld - How often do you hear, We have some extra money to spend, so tell me what youd like to purchase?

Those words are certainly rare in my company, so when my CIO asked his direct reports to draft wish lists, I was quick to spin up Microsoft PowerPoint and put together a set of slides. This wasnt a free-for-all, of course; it was a one-time windfall. The money had to be spent quickly, so there was no point in requesting the deployment of new infrastructure, which would require a dedicated project manager and tons of resources. I kept my list short, focusing on things that could be rolled out quickly and yet add value. Heres my list, and some of my rationale. n

Secure FTP. Currently, were using an old Solaris server thats sitting in our DMZ and running an old version of WU-FTP. Neither the server nor the operating system is supported any longer. Its far from a secure setup (all data is passed in cleartext), so its solely for internal use. We need something that we can let our customers and partners use and that would be acceptable to use during mergers, acquisitions and joint ventures. Id like to be able to accommodate various methods of FTP, including Web-based uploads and downloads. And I want encryption on the hard drive and for all transmissions and credentials.

SecurID two-factor authentication for Microsoft Outlook Web Access (OWA). It would cost us nothing to enable SecurID for our OWA servers, and its a trivial configuration. But we would have to issue $75 tokens to almost every employee. With 7,000 workers, that could be an expensive proposition. And then theres the overhead of additional head count to manage the deployment and take help desk calls.

A security policy compliance and confirmation tool. We have lots of security policies but no way to ensure that employees have read them. We place our policies on the corporate Web site, which is an improvement on three-ring binders only in that they dont collect dust on the bookshelf. The policies are available to all, but people dont know about them and arent strongly encouraged to read them. Policies that no one knows about dont accomplish anything, but theres another really good reason to be able to track employees awareness. As regular readers will recall, earlier this year we discovered by chance that one of our employees was forwarding source code algorithms to his personal e-mail account. The U.S. attorney was involved in the case, but in the end, we couldnt prove that the employee knew that what he had done was against our policy.