Small Business: Hackers' Low-Hanging Fruit

Small and medium sized business owners often find themselves between a rock and a hard place:

They have confidential information such as customer information, financial and employee information on-site but lack the resources to understand and address the risk. As this article points out: "...more than 75 percent of companies with fewer than 1,000 computers have an IT staff of less than 10, and 61 percent say they have never sought information about how to protect employee or customer data." Scary.

To address the risks, there are affordable options. In fact, in the long run, these options are not only affordable but could provide long term advantages such as:

• IT cost predictability
• Less money spent on emergency recovery services after a breach occurs
• Competitive advantage vs. larger, more entrenched organizations

The answer lies in being able to augment your existing capabilities where it makes - and do so for a price that is affordable. There are numerous organizations in the Toronto market that can help. The key is to select an organization that is right for you. Some things to look for:

1. Do these providers have the tools, expertise and processes to help you with their specific challenges?
2. Do these organizations provide remote support capabilities? On-site service capabilities? Typically most I.T. challenges can be addressed remotely increasing response times and decreasing cost due to less time spent traveling.
3. Will these companies provide advice on strategic issues: How should I.T. dollars be spent to best support your business objectives? What are your business priorities?
4. Do these third parties have access to a variety of skill sets? If you choose to work with an independent, this person cannot possibly know everything there is to know about I.T. - do they have resources available to augment their skill sets when they need help?
   

Finding a partner to help your small/medium sized business support it's I.T. needs is not only a viable option but may be the best option. It alleviates the need to hire full time time staff, provide training and retraining, purchasing the tools needed to properly manage I.T. and invest in the management framework necessary to prevent problems from happening in the first place, responding to the problems that could not be prevented and planning for future business & I.T. priorities.

NAC Gaining Momentum

The Challenge:

Permitting internal & external users with secure access to resources. Secure access mean:

• properly authenticated & authorized
• free of spyware and viruses
• access only to information users need to do their job

NAC: Securing access to information

The Network Access Control space has received much press over the past few years. Many companies have been leary of making the jump citing implementation complexities, lack of standards and the inability to source a product that met all company requirements.

However, a recent report by Network Computing based on a broad survey stated that; "most said NAC is easier to deploy, is less disruptive and requires fewer changes to network configurations, and has less of an impact on productivity than was expected."

This is not to say that there are no longer difficulties or complaints. There are over 30 vendors in this space with 4 - 6 competitors occupying the lions share. The proliferation of proprietary standards poses challenges to interoperability. Word to the wise, understand your requirements thoroughly before jumping in - NAC implementations can be expensive with the mean average of survey respondents having spent 12% of their entire enterprise IT budget on the project.

Additional NAC Points of Interest:

Infrastructure Impact:

• NAC deployments are notorious for demanding infrastructure changes - on average, respondents expected to have to change up to 30% of their infrastructure for NAC readiness
• Understanding what the impact on the network is is critical to accurate budgeting and product selection processes.
  

Productivity Impact:

• There have been concerns that NAC might keep legitimate users from doing their jobs - and add work for IT. These concerns may be unfounded given the opportunity for productivity enhancements, i.e. allowing infected systems to be quarantined and remediated in an automated fashion.

Interoperability, Frameworks & Standards:

• Here is a general pictorial of the NAC standard
• Cisco and Microsoft have announced an initiative to ensure interoperability between their platforms - putting a wrench into the Trusted Computing Group's attempt to create an open standard based on non-proprietary technologies.
• Cisco and Microsoft are coincidently "most trusted" in this space

In spite of their being numerous proprietary methodologies in place, there are a number of "common" enforcement techniques, as this article explains well.

Suggestions for NAC consideration:

• Measure twice, cut once: plan, plan plan first - this is critical to success. Understand exactly what you'd like to accomplish.
  

Choosing a NAC vendor is largely dependent on the primary issue you want address, since vendors now tend to be either good at posture assessment, quarantine, remeditation and ongoing threat assessment, or identity-based policy enforcement--but not both. If you're like most respondents, you want it all--in which case you may want to wait until best of breed solutions emerge.

• Set expectations with senior management: the ROI on NAC is difficult to quantify - but regarded by those who have implemented NAC as worthwhile
• Evaluate impacts to existing infrastructure

BotNet Armies Uncovered

It's disturbing to know that the FBI recently uncovered over 1 million computer systems under the control of botnet operators. Even more disturbing is that these are only systems that:

1. Have been found - surely there are way more.
2. These are only systems found in the U.S. - certainly a small proportion of the amassed botnet armies worldwide.

For the average citizen and small / medium sized company - the threat of being the recipient of such a botnet attack is small - unless of course, you are in the public forum - particularly a controversial one. However, as this article points out - the need for citizens, and anyone who owns a network for that matter, must be diligent about protecting their systems from being compromised - and exasperating the problem.

How you ask? Following network and security management best practices is a start. From a high level, here is how such a process might work:

1. Assess: the world around us changes constantly and so must our protection mechanisms. Continuous efforts to identify and assess the risk of new and existing threats leads us to an understanding of what needs to change and why.

2. Be Proactive: constantly assessing what is going on around us is a good first step. It is also 'best practice' to: (a) apply preventative maintenance measures to reduce the threat of exploitation; (b) monitor the network for unusual activity so that reactive measures can be taken immediately at the first sign of trouble.

3. Continuous Improvement & Change Management: by instituting a process that forces us to plan changes to our network we are able to make sure that security is taken into consideration early on. Secondly, the information we glean from monitoring and maintaining the network enables us to identify potential issues that might later cause grief - and address them ahead of time.

There is one additional benefit to following this approach: it costs less in the long run! Unnecessary downtime, lost productivity, emergency service calls and unplanned capital expenditures can all be reduced or eliminated leading to much improved returns on IT capital investments - not to mention less gray hair and aggravation.

Quick Ref: Identity Management Solution Components

Identity Management Components

Virtual Directories: A Disscussion - What is is? Who's supplies it? Who needs it?

Network Access Control: A Dissertation

How does NAC fit in? What are the key considerations? What is the framework? What are the risks, what are the potential benefits?

I.T. Automation: Identity Management Overview

Identity Management has received much - mostly bad - press over the past several years. It is not something to be taken lightly to be sure - and promises many benefits if implemented correctly. Potential benefits include:

• improvements in security / achieve cost reductions by automating activities associated with provisioning / deprovisioning
• improvements in security by reducing the number of passwords users have to remember across multiple applications
• improve help desk efficiency by automating password reset activities

While these benefits can be significant to many an organization, we must keep in mind, as this article points out, "there are many dead bodies along this highway". Identity Management initiatives are not to be taken lightly to be sure. They often require multi-disciplinary teams comprised of members of the I.T., Security, & Human Resources departments - to name a few.

This article by Network Computing is an excellent dissertation on the key issues, benefits and risks associated with Identity Management options.

What is your option? Please feel free to share your stories (both successes and failures) - as you are in a position to help others not make the same mistakes...

Excellent Source of Best Practices Information

http://www.sans.org/