An Executive Overview Of Enterprise Security

The cold war was political. It's over. World War III isProactively preparing your busi­ness with a
an economic war. It's here - it's now. Information iscomprehensive security as­sessment and plan is
where the money is and theft is easy, safe, andfar less expensive. According to David Bauer, first
lucrative. Eavesdropping and other high techvice pre­sident, chief information security and
relat­ed crimes are difficult to enforce andprivacy officer at Merrill Lynch, a key component of
prove. Advancements in electronics and opticalany strategy is a dynamic risk assessment. By using
electronics have made communi­cationstools such as scanners, log analysis, risk metrics and
interception easy and cheap. Business ethics don'tasset inventory that produce a biweekly security
have the same value as they did in the good oldreport you can more quickly analyze and prioritize
days of the "deck of punch cards" computing.current or poten­tial threats. This approach
IT and business security is becoming more and moreallows organi­zations to move from a
critical in today's commercial environment. Every daycircle-the-wagons approach to intelligent risk
we are faced with new computer risks, viruses andmanagement.
new "ideas" from hackers on how to gainWith an intelligent risk manage­ment solution the
ac­cess to our network or other systems orpercentage of the IT budget that needs to be spent
physical locations. Fortunately, there are even moreon effective risk protection is actually far less than
sophisticated business solu­tions out there thatwhat your competitors will be forced to spend. The
can be implemented to secure us from theseanswer is not about how much you spend but how
dangers. These can be anything from simple firewallswell you spend it. This way about half the
up to very expensive encryption and biometricspend­ing is advisory, helping build secure
authentication solutions or remotesystems, while the rest goes toward risk
com­munication modules. These new businessmanagement, prevention and response. For instance
realities affect you as much as it does yourit is easy to get somebody's password, so the
competitor - no matter what your line of business.damage that can be done by an individual has to be
The question is how can you protect youras small as possible. William Farrow, CIO at the
organization, no matter how large or small, from theChicago Board of Trade, told how a woman cleaning
known and unknown security dangers and risks toa conference room be­came suspicious of a
remain as competitive, and therefore profitable aslaptop left running overnight. She reported it to
possible?security, and it was later discovered that
What about all the other business risks that are alsosome­one had left the laptop running port
getting more sophisticated? Have you considered allscanning software aimed at penetrating the
the risks that cannot he covered by technology?corporate computer network. In this case even an
What about the human side of business? No businessemployee at the lowest level of the corporate
can function without the human touch. Yet how dostructure was made aware of the potential damage
you know when that necessary "human touch" isthat can be done to the organization with a security
about to reach out and touch you in the form of anbreach. In corporate or IT security, emotional
"insider" attack? Have you thought about yourreactions, panic and legislation are counterproductive.
employees behind the technology? How about socialBut intelligent approaches can safe­guard your
re-engineering forces or disgruntled employees?organization or business from an uncertain future and
When did you have your last corporate risksubstan­tial financial losses.
assessment completed or even considered if ever?If you ask CEO's of large corporations, who have
As a person you are prepared for the unexpected:gotten even low-level employees to be savvy about
you face the unexpected several times a daysecurity, you get advice on employee education:
without giving it a second thought. You follow the"Make it a part of daily conversation in every project
rules of the road when you drive because you knowmeeting. Make it clear that every project has
it is the right thing to do. You pur­chaseresponsibility for security. You have to make it part
insurance for yourself and your car, carry healthof day-­to-day operations." Adherence to
insurance and life insur­ance because you knowclear­ly defined security principles should be a
it is the right thing to do for your family.part of each employees contract. It is also important
Unfortunately, with many of the business risks ofto publicize employee­ caused security incidents
today there is no "red light, green light" to tell usinternally, not necessarily naming the employee who
when to stop arid when to go. But how can you saymade a mistake, but doing it in a way that others
you are sorry enough to your customers, when youlearn from the error. Those organizations or
have to tell them some hacker has posted theirbusinesses that have evolved a system of process
credit card number on the hackers web site? When itimprove­ment as a natural consequence of their
comes to your organization or business, have youbusiness demands are those organiza­tions or
put the same level of consideration into how yourbusinesses that will excel and win the security wars.
employees and customers will continue to rely onThe main key be­tween companies that have
you should the unexpected happen?implement­ed a dynamic security plan and those
If you're like the Senior Executive or owner of mostwho have not is: preparation. Prepara­tion
companies, the answer may be a frightening "No, werequires a focus on risk manage­ment,
have never had any comprehensive business riskintelligence-driven identification, prevention and
assess­ment completed." Or worse yet, perhapsresponse. A good organizational or business security
you have a false sense of security in a plan that wasstrategy is built around these princi­pals: threat
developed several years ago. With all we hear aboutmanagement, including in­telligence, planning and
how high the price of security can be these daysinstant re­sponse; comprehensive security
you may find yourself saying, "Investing in a securityservices; attention to public policy, in­cluding
and privacy solution is expensive; too expensive foractive attempts to educate leg­islators; and an
our organization or business right now." But can youagile response to the changing risk environment.
afford to risk spending more than 15, times the costAfter all, as we have learned, an intelli­gent
of preventing a security breach or a communicationssecurity response needs to be everyone's
breakdown when the unforeseen does in factresponsibility and it is not always limited to technology
hap­pen?and IT se­curity that matters the most.