For more info on a specific newsletter, click the title. Details will be displayed in a new window.
Subscribe to
Computerworld 40 years of the most authoritative source of news and information for IT leaders.
Five steps to audit-proof your IT infrastructure
or
Other Security Stories
|
|
|
|
May 13, 2004 (Computerworld) -- The word audit usually makes security and IT staffs either groan or quake with fear. Failing an audit is everyone's worst nightmare because of the potential damage to the organization's reputation and its ability to transact business.
Yet with the increasing importance of regulations and standards such as Sarbanes-Oxley, ISO 17799 and Visa's Cardholder Information Security Program (CISP), the number of audits is increasing. Also increasing is the time it takes to perform the audit and the cost to the organization. Companies are being told by regulators to control key IT information processes and to clearly demonstrate such control through rigorous systems and audits.
A critical element in passing audits is demonstrating control over network and security staffs. However, this requirement remains largely ignored. A Yankee Group survey showed that 70% of companies use shared password access control techniques somewhere in their infrastructure, an inherently insecure situation given that there's no direct accountability and little way to prevent passwords from falling into the wrong hands. Further, the survey found that 58% of large retailers used access control techniques that wouldn't pass Visa's CISP standards. Several organizations are known to have failed industry-mandated audits recently because they lacked operator access controls over device and server settings.
When auditors ask IT staffs, "Who's guarding the guards?" the answer "The guards themselves" clearly isn't good enough.
Manual approach has limits
Beyond the issue of simple access control, there's the question of the basic correctness of the security systems deployed, including router access control lists, firewall rules and server privilege settings. For most organizations, demonstrating that these settings are correct usually involves tedious configuration audits performed manually every few months. One major retailer recently estimated that its quarterly audit of device access control settings required the work of two operators for three days each, or a total of six days of their time.
Manual audit reporting also raises a question of ongoing governance. If an event occurs between audits, will it be detected or will it leave the organization exposed until the next audit cycle? If operators leave the organization or a personnel matter arises, are there facilities in place to demonstrate an audit trail as required? Does each new audit request mean yet another one-time expenditure?
Five key steps in audit-proofing your infrastructure
Of the many steps required to comply with an audit, the following five in particular are often overlooked. They represent great ways to help audit-proof the infrastructure as well as increase overall IT quality.
- Enforce operator access control standards with a flexible and granular permissions model for role-based access control to all network devices and servers. If there is an unauthorized attempt to gain access to the network infrastructure, security and IT staff should be able to detect it and alert the appropriate personnel. The same access controls may be required for technology service providers or outsourcers. Watch out for weak areas where you may have administrative passwords that are shared by multiple operators. These commonly arise in securing Unix servers and network devices, particularly legacy gear that doesn't easily support a central authentication server.
- Keep an activity trail with real-time auditing, including a who, what, where and when of all operator activity and infrastructure changes, especially those that could be inappropriate or malicious. Making IT staff responsible for reporting their own activity won't cut it.
- Demonstrate a strong change management process by being able to confirm that infrastructure changes go as planned with a real-time, live-network change review.
- Automatically verify compliance with both external best practices and internal standards. When IT staff members change critical server or network device settings, managers must be able to ensure that they comply with industry best practices and organizational standards. Instead of yearly manual audits, IT staffs should be able to perform daily checks across their infrastructure so they can show they are looking for configuration settings that violate security policy.
- Make available on-demand historical reports that security and IT staff members, as well as auditors, can view upon request to demonstrate that controls and standards have been continuously enforced. The more easily IT can generate these reports, and the less that human input is required to collect the data, the more reliable the results typically will be in the eyes of an auditor.
Who benefits the most"
These steps are a tall order with the traditional manual approach of tracking activity and handling audits. Packaged solutions are available and although they aren't suitable for every enterprise, they can be pivotal in:
- High-transaction volume networks, such as in retail and financial services industries and outsourced service providers;
- Highly regulated industries such as financial services, health care, pharmaceuticals and governmental organizations;
- Medium to large enterprises sized by either the number of network operators or the number of devices. For example, organizations with only two security administrators covering 2,000 devices face the same imperative for automated operator access control as organizations with 500 operators and 100 devices;
- Publicly held entities whose results are subject to Sarbanes-Oxley and who are looking to Cobit as a model for IT compliance.
With a rigorous, well-documented approach to operator access control and audit response, organizations will be in a good position to survive their next audit and assure their customers, executives and business partners of the integrity of the infrastructure that runs the enterprise.
|
Print this Story |
|
Send Us Feedback |
|
E-mail this Story |
|
Digg this Story |
|
Slashdot this Story |
|
|
|
|
|
 |
|
All Zones Application Performance Zone Business Continuity Zone Data Center Management Zone Enterprise-Class Security Zone The File Data Management Zone Grid Computing on Windows Zone Security Management Zone ITIL Best Practices Zone The SAS Zone Storage Virtualization Zone Business Intelligence and Analytics Zone |
 See your link here
|
 |
||||||||
| ||||||||
| ||||||||
| ||||||||
|
Why SaaS is Vital to Email and Web Security
Download this Executive Bulletin (a $49.95 value) for free, compliments of MessageLabs.
Get this white paper now!
Read up on the latest ideas and technologies from companies that sell hardware, software and services.
- Microsoft promises four patches next week
- Google gives away home-cooked Web application security scanner
- Storm botnet stages Fourth of July attacks
- More top stories
Security Management ZoneSecurity management is the process of developing a comprehensive data protection plan. It takes into account all potential threats, the existing network environment, the future needs of the organization, and lays out a multi-tiered blueprint to integrate the security technology needed to combat these threats. CDW can help keep your network and data secure. Visit the CDW Security Management Zone now See All Zones
|
 Fired up about IT? Join Sharkbait and share your true tales of IT. SharkBait is the place for you to sound off about everything IT – the good, the bad, and the rest of the weird stuff you deal with every day.New baits 
|
"Security Directions" virtual trade show2008's Code-Red Security Issues for Protecting the EnterpriseWebcasts, white papers, demos, and more. Presented in a unique 3-d environment. Enter our show right now! Click here to enter
|
 In SecuritySecurity's important, and risk must be addressed, right? Sure, but watch for four signs your policies go a bit overboard. Click here to read the latest column by Jon Espenschied |
CIO
Computerworld
CSO
DEMO
GamePro
Games.net
IDG Connect
IDG World Expo
Infoworld
The Industry Standard
ITworld
JavaWorld
LinuxWorld
MacUser
Macworld
Network World
PC World
Playlist
Copyright © 2008 Computerworld Inc. All
rights reserved. Reproduction in whole or in part in any form or medium
without express written permission of Computerworld Inc. is prohibited.
Computerworld and Computerworld.com and the respective logos are
trademarks of International Data Group Inc.
|
