Security is not an IT problem alone, it is also a management problem, said Kelvin Lim, regional manager, SEA, Check Point Software Technologies Ltd. It is therefore critical that every organization has a proactive endpoint security strategy that is defined by IT security policy.
According to Lim, who was speaking at Computerworld Singapore Security Forum last week, a security policy is a formal statement of rules by which people who are given access to an organization"s technology and information assets must abide.
?Basically it determines who can access what, who can do what. The management decides the policy and IT people deploy it.?
The policy should begin with assessing the risk to the network and building a team to respond. The team, he said, should include management members who have budget and policy authority; technical group who knows what can and cannot be supported; and legal experts who know the legal ramifications of various policy choices.
However, Lim cautioned that a security policy should not determine how a business operates.
The nature of the business should dictate the security policy. Therefore, it is important to define the policy before choosing security methods, technology and tools.
?It?s human nature you will tend to bend your security policy in such a way that your security solution can be deployed. That may be a very big loophole for hackers to come in,? he explained.
Furthermore, the same security vulnerabilities are found in all sizes of businesses ? government, enterprise or SOHO and security is at least as important as building availability and fault tolerance or sizing servers and WAN bandwidth.
Commenting on business drivers for security, he said, enterprises should adopt solutions that can help them realize revenue and profitability and increase business lines and routes to market, through cost effective communication structures.
Enterprises need to make the investment in solutions that can reduce business disruptions caused by worm breakouts and attacks, outage of equipment with no high availability capability and denial of service attacks on key systems.
The solutions should be able to protect IT systems in remote locations and allow rapid deployment of data communication.
To add to the challenge, the growing sophistication of threats is driving the need for internal security. For example, blended works can exploit multiple vulnerabilities and malicious code can bypass traditional perimeter defenses. Internal security, which addresses this, involves capabilities such as internal segmentation, internal firewalling, server hardening and system patching.
?Security itself is as important as infrastructure. Users spend hours and many days defining the infrastructure but spend very little time deploying the security solution.?
?It?s as good as building a house and furnishing it with a $2-million budget but going to the market to buy a $5 lock to lock the house,? Lim said.