5 ways to make sure you aren't the next Wikileak
Network World - This vendor-written tech primer has been edited by Network World to eliminate product promotion, but readers should note it will likely favor the submitter's approach.
Government and intelligence officials around the globe have been caught off guard and in many cases embarrassed and compromised by disclosures of documents on the Web site WikiLeaks.
For security and IT professionals, these leaks serve as an important wake-up call to improve policies, procedures and safeguards. Here are five key tips to help your government agency or enterprise avoid being the source of the next Wikileak.
I. Security Policies and Procedures. Every government organization or enterprise must have policies in place to define who gets access to what information, and when. These policies and procedures must be actively maintained and updated and properly communicated. Then, the security policy can be administered by leveraging technology and putting the proper tools in place to secure, enforce, and mitigate risk to the organization.
In the October 2010 WikiLeaks case in involving some 400,000 U.S. military documents about the Iraq war, policy could have limited access to the systems that contained the sensitive information to those that had a "need to know."
In highly sensitive information environments the policy should require strict management, monitoring and control of access only to people who have a legitimate need to know. Governance, Risk and Compliance (GRC) tools allow organizations to automate some aspects of this task by overlaying security policies and controls over corresponding data sources from switches, routers, security platforms, servers, end points and applications, for a real-time view of their state of compliance.
However, no policy can be 100% effective, and many organizations will experience someone on the inside who has met the policy requirement, does have a legitimate need to know, but has illicit intentions. In these cases the security technology should provide the next layer of defense to meet these internal threats.
II. Implement Host-Based Security Solutions. Host-based security solutions include tools that allow an organization to protect and control laptops and desktop computers. Examples would be anti-virus/anti-malware products and software that prevents a user from using a USB drive or writable CD drive on a computer on a classified network.
Essentially, host-based security protects and limits what users can do at workstations. Host-based controls can disable, for example, simultaneous wired and wireless network capability, which can act as an entry point for a hacker.
Host-based security solutions can also be integrated with network access control (NAC) systems to create a first line of defense for systems that regularly go on and off of the network, such as laptops. If a laptop is infected with a virus, or misses an important security patch while disconnected from the organization's network, the host-based security solutions, in conjunction with the NAC solutions, can assure that effected systems is quarantined, and cleaned of the virus, or receives the proper security patch before it is allowed onto the network.
- Google I/O 2013's Coolest Products and Services
- 10 Star Trek Technologies That are Almost Here
- 19 Generations of Computer Programmers
- 25 Must-Have Technologies for SMBs
- A walking tour: 33 questions to ask about your company's security
- 15 social media scams
- The 7 elements of a successful security awareness program
- IT Certification Study Tips
- Register for this Computerworld Insider Study Tip guide and gain access to hundreds of premium content articles, cheat sheets, product reviews and more.
- Federal IT Innovation Caught in a Catch-22
- Fed resources shoring up old infrastructure, holding back new technologies.
- Manage Virtualized and Cloud Environments and the New Software-defined Data Center
- Analyst report by Enterprise Management Associates on the newly announced EMC Service Assurance Suite, and how well it addresses operational challenges and market...
- How Storage Resource Management Suite Meets Today's Storage Management Challenges
- This white paper outlines the common use cases Storage Resource Management Suite addresses including comprehensive monitoring, reporting, and analysis for heterogeneous block, file,...
- Sepaton DBeXstream Enhancements
- Silverton Consulting weighs in on why Sepaton is a compelling response to the data protection challenges inherent in today's large enterprise database environments...
- Sepaton Boosts Performance and Connectivity Options
- Read why Senior ESG analyst Jason Buffington and Research Analyst Monya Keane endorse the Sepaton S2100-ES3 Series 2925 data protection appliance (version 7.0)... All Government IT White Papers
- 3 Reasons Why Sepaton is the World's Fastest Backup Solution
- Leading analyst, Storage Switzerland learns how Sepaton backs up and deduplicates massive data volumes while maintaining the industry's fastest performance - all in...
- Enterprise File Sharing: All You Need to Know
- Security. Scalability. Control. These are just some of the many benefits of enterprise cloud file-sharing that you'll discover in this KnowledgeVault, packed with...
- Bridging HTTP and FTP with FileXpress Internet Server
- What if you could take an FTP server on your internal network, and allow external users (partners or customers) to securely access it...
- MFT and FileXpress - An Overview
- Business users and applications exchange files on a regular basis. File transfer is a core part of the flow of business activity.
- Content Analytics: Big Data Conquered, Customer Service Elevated
- For organizations looking to start a content analytics program or improve their existing capabilities, Aberdeen Group and IBM will lay out several recommendations... All Government IT Webcasts