Secure-IT:

Securing your network/data against unauthorized access is much like securing your home against intruders. There are obvious points of entry (such as your front door, back door and windows), and there are sometimes not so obvious points of entry (like that small window/vent that goes into the basement/crawl space), out of sight and out of mind points that may have been secure at one point, but then for one reason or another become unsecured.

Additionally, who of us doesn’t check to make sure that all doors/windows are locked before we leave the house? Why? Someone may have opened a window and not closed it all the way. Or a garage door that is ALWAYS locked may have been left unlocked by the last person who used it.

Now lets add another factor to the equation: keys. Keys represent authorized entry to the house.  You would assume that whoever has a key to your house has it because they have been given one by you or your family.  But what often happens?

Keys are left under the door mat or in a “safe” place convenient for multiple users.  If your house is not brand new, chances are someone who lived in it in the past still has a key.  Or perhaps someone in the family “lost” a key.  And then add to that the fact that most brands of locks only have so many different keys, and there are also Master keys available.

If that isn’t enough, most locks can be picked in a relatively short time by someone who has the tools and the know-how.

And if someone wants to get into your house badly you can’t stop them. They can use a brute force attack: an axe on the door, a rock through a window, or a chainsaw through the wall.

Finally, if someone is frustrated by their attempts to get into your house, and they have something against you, they can just burn it down.

Now all of that might sound a bit excessive, but it happens all of the time. You may be thinking: "Well, I have never had any of that happen to me." Statistically speaking, most people will never experience someone breaking into or trying to break into their house unless they live in certain neighbourhoods, or if they are known to have very valuable goods inside.

How does all of this apply to your network?  Each of the types of attack mentioned have corresponding attacks in the IT world.

 

 

Example	Represents	Is Complicated by
House	Network
Doors, Windows	Access points such as Desktops, Laptops, Servers, Routers (wired and wireless), modems	Windows PC’s have 65,535 TCP ports and 65,535 UDP ports which can be used and locked for use by applications
Locks, Alarm Systems	Network protection such as firewalls, access protection	Software conflicts
Keys	Authorized access such as usernames and passwords
Lost or “Hidden” keys	User accounts that have been compromised, or where passwords are overly simple or hidden in an accessible location (i.e. under the keyboard or mouse-pad).
Pre-owned keys	User accounts that have not been properly de-activated after an employee leaves the company.	Especially dangerous are old administrator accounts that have not been deleted because certain service requires the account to run.  i.e. backups etc
Master Key	Administrator accounts/passwords
Lock Picks	Available tools for gaining unauthorized access without alerting the owner
Forced Entry	Brute force attacks that can overwhelm a system and allow exploits.	On computers and networks, forced entry is not always obvious the way physical forced entry is on your home.
Burning down the house	Attacks that compromise data, wipe drives etc.	Uneducated users who employ unsafe mail/internet practices
Valuables	Your data, ERP systems, reports, credit card information etc.	Certain regulations govern the way your data is handled.  For example HIPAA, SOX,  Canadian Privacy Act, ICFR and ISO/IEC 27000x *

 

With all of these variables to take into consideration two questions arise:

Question:   If there are so many factors to take into consideration in truly securing a network, maybe we should just do the best we can and be content with that?

Answer:  What would you do if your network was compromised and you lost some or all of your data? The fact is, according to global data, some 80% of businesses fail within 18 months of a major data loss/interruption incident.

Question:  To what extent should we go to protect the integrity of our network/data?

Answer:  How valuable is your business to you?  To illustrate:  If you wanted to protect a physical item of great value, you might place it in a secured building with a large wall around it and armed guards with guard dogs.  Entry/exit might be severely limited and controlled, with the item being under continuous surveillance etc.  The greater the value of the item, the more steps are taken to protect and secure it.  Additionally, you would likely take out some kind of insurance against loss.  With that in mind then, the amount of time and money you spend on data protection, integrity and insurance should be proportional to its value to you.  Some businesses can lose thousands, tens of thousands, or even hundreds of thousands an hour during network down-time, and, if the down-time is long enough, well that can lead to the business having to close its doors.

So, how should you proceed?

1. Hire a company to analyze your company’s security.  Even though your IT department may be doing an excellent job, there are almost always weaknesses that need to be addressed.
2. Act on the recommendations you receive, and lock down your network to the best of your ability.  Make sure that all of the management and employees buy into the lock-down.
3. Protect the integrity/continuity of your data by storing back-ups off-site.
4. Actively monitor your network for intrusion attempts.
5. Periodically have your network re-assessed by an outside group to make sure that it has remained secure.

 

With the down-turn in business and economy globally, you may be tempted to consider this an unnecessary expense, but in reality the opposite is true.  A down-turn in the economy makes it VITAL to protect your main business asset: your data.  Otherwise an unexpected loss of data might just mean the loss of your business edge, and ultimately, your business.

 

Our competitive rates make us a 'brilliant' choice for all of your consulting needs.

For more information, contact us.

 

 

* Definitions:

HIPAA - The Health Insurance Portability and Accountability Act Privacy Rule is the first comprehensive Federal protection for the privacy of personal health information.

SOX - The Sarbanes-Oxley Act enacted July 30, 2002, also known as the Public Company Accounting Reform and Investor Protection Act of 2002 and commonly called SOX or Sarbox.

Canadian Privacy Act - The purpose of this Act is to extend the present laws of Canada that protect the privacy of individuals with respect to the collection and handling of personal information

ICFR – Internal Control Over Finance Reporting – the Canadian version of SOX

ISO/IEC 27000-series (also known as the 'ISMS Family of Standards' or 'ISO27k' for short) comprises information security standards published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

 

 

 

Please contact us to see how we can help you!