Book Proposal Guidelines Archives Information Security Glossary Catalog InfoSecurityNetBASE Auerbach Publications Information Systems Security
Auerbach Publications

Information Protection Extends Beyond the Network

Matt Scherocman

It seems like only yesterday that a firewall and antivirus were all a company needed to protect its data. By current standards, yesterday's threats were slow-moving and predictable, and blocking them at the network perimeter kept their impact to a minimum.

It's not so easy anymore. In today's business environment, information is continually moving among employees, partners, and customers--few of whom operate within the controlled sphere of the enterprise network. Each endpoint represents a potential entry point for cybercriminals who are increasingly intent upon compromising sensitive information for financial gain.

At the same time, industry and government regulations, not to mention internal corporate security policies, have put organizations under greater pressure to make sure that online business communications and transactions are protected and that information remains secure and available.

Clearly, the network is no longer the perimeter. Today, people are the perimeter. Consequently, information protection is no longer about protecting the network. It's about protecting information wherever it resides.

Data, Near and Far
In the digital age, business data constantly flows among an expansive range of organizations and individuals whose security status varies. Organizations are dependent on these interconnections for the performance of their business for the on-time delivery of goods and services as well as their financial performance.

For example, salespeople connect to the corporate network through a hotel network. Guests access the Internet through the corporate wired or wireless LAN. Mobile workers at kiosks check e-mail and download attachments. Customers transact business online from home Internet connections and public wireless hot spots.

And what about partners? The typical financial services enterprise aggregates customer "trust" from thousands of partnerships; 50 to 200 new ones each year, by some estimates. And the business environment of online retailers is often characterized by a labyrinth of cyber-relationships with its own partners as well as with affiliates and subsidiaries, partners of an affiliate or subsidiary, and partners of an affiliate's or subsidiary's partner.

Valuable information is vulnerable to exposure over each of these connections. As a result, protecting information in such an environment requires the elimination of exposures not only inside the network but also across business boundaries. This includes endpoint enforcement through protection, configuration, and usage, as well as endpoint compliance-and that means securing all endpoints and all access points all the time.

Of course, simple user error can also put organizations, not to mention their customers, partners, and employees, at risk for a security breach. For example, U.S. Department of Veterans Affairs recently revealed that an employee's laptop was stolen, along with personal information on a staggering 2.2 million active-duty military personnel, as well as information on 26.5 million U.S. veterans.

While the repercussions of this event have yet to be determined, it has already been called one of the nation's largest security breaches to date. And the potential magnitude of its impact underscores the often tenuous line between information protection and information exposure in the interconnected environment in which businesses and individuals live, work, and play.

Then and Now
What a difference a few years can make, particularly where the Internet is concerned. In 1988, the first Internet worm was launched. It spread to just 6,000 computers, which represented one-tenth of all the computers on the Internet at the time.

By 1993, Internet traffic was expanding at an annual growth rate of nearly 342 percent. The following year, a virus writer took advantage of this growing communications phenomenon to spread malicious code and posted the Kaos virus to a newsgroup.

Those were the good old days. Where yesterday's threats were noisy and visible to everyone, today's threats are silent by design and often go unnoticed. After all, with the current price of a successful adware and spyware install at somewhere between five and 20 cents a pop, stealth pays.

That's not all. While earlier threats were indiscriminate and hit virtually anyone and everyone, today's threats are highly targeted and regionalized. Cybercriminals are in it for the money now, unleashing quiet but sophisticated, modular malicious code aimed at perpetrating identity theft, extortion, and fraud.

In turn, the task of containing, managing, and protecting data has gone from challenging to being vastly more difficult, complex, and critical. Information protection has clearly moved far beyond network security and now extends to protecting data regardless of where it is.

After all, lose the data and you lose the business.

Protecting Data Where it Resides
To reduce information exposure, organizations must secure both their managed and unmanaged endpoints because that's where the information resides. Since managed endpoints are within an organization's administrative control, persistent agents can be used to implement appropriate countermeasures. This is important, as these endpoints often have more extensive rights for accessing and storing information, which in turn signals the need for more robust security measures.

Among the most effective tools for protecting managed endpoints are antivirus, personal firewall, and intrusion protection technologies. While antivirus tools are ubiquitous today, the most effective protection comes from technologies that include anomaly or heuristic-based threat detection as well as antispyware capabilities.

Personal firewalls are another widely recognized countermeasure, although their effectiveness is limited to protecting at the network layer. Personal firewalls often cannot stop application layer attacks that utilize protocols and connections allowed by their rule base. Nevertheless, personal firewalls are a valuable component of managed endpoint protection as they permit only traffic that is explicitly allowed by policy.

Intrusion protection technologies offer another layer of security for managed endpoints. Host-based intrusion protection complements antivirus by guarding against unknown attacks that operate at the system and application levels. Network intrusion protection tools guard against network-based threats such as worms. While some network intrusion protection solutions rely on signatures and, therefore, guard against known attacks, other solutions provide more advanced mechanisms such as vulnerability-based signatures and protocol anomaly detection to keep unknown threats out.

Rounding out these more common security technologies are application control, host integrity checking, patch management, buffer overflow protection, and encryption technologies. Application control picks up where personal firewall technology leaves off and further defines allowable traffic. Host integrity checking evaluates various security attributes to ensure that the endpoint is defended against any threats it may encounter.

Patch management identifies and eradicates weaknesses in software code, while buffer overflow protection monitors endpoints for known and unknown threats that attempt to exploit buffer overflow vulnerabilities. Finally, file and disk encryption guards against information loss in the event that an endpoint such as a laptop is stolen or lost.

Protecting unmanaged endpoints is also critical in order to reduce the risk of information exposure. However, because these devices are outside an organization's control, they require "on-demand" protection that does not impose changes or restrictions beyond the duration of a specific interaction.

To that end, organizations can leverage a number of on-demand technologies, including host integrity checking, cache cleaning, malicious code protection, firewalls, and a secure virtual workspace. On-demand host integrity checking and on-demand firewalls provide much the same protection as their agent-based counterparts, while on-demand cache cleaning removes information remnants from browsers and application-specific caches when a session ends.

On-demand malicious code protection leverages behavioral analysis techniques to identify keystroke loggers and other malicious code that may reside on an unmanaged endpoint. Further, on-demand secure virtual workspace technology guards against information leakage by creating an encrypted workspace on the unmanaged endpoint.

Of course, no information protection solution is effective without the cooperation of the people who actually use the managed and unmanaged endpoints. While corporate and employee security responsibility and accountability is widely acknowledged as a vital yet challenging component of an information security strategy, its effectiveness can be greatly enhanced when organizations carefully codify requirements and responsibilities and apply automation to ease enforcement.

Although the days when just a firewall or antivirus provided adequate protection are long gone, organizations have a wide range of tools from which to choose as they look beyond the network to protecting information regardless of where it resides at any given moment.

Together with enforceable corporate and employee best practices for security, organizations can leverage technology to keep a handle not only on systems under their immediate control but also on the devices upon which their valued partners, employees, and customers rely to do business in a highly interconnected world.

About the Author
Matt Scherocman is vice president VP of Sales and Operations at PCMS IT Advisor Group.

© Copyright 2007 - 2009 Auerbach Publications