 |
 |
 |
 |
 |
 |
 |
Home ›› Security Updates  |
| Virtualisation: What are the key steps?
For those of us who grew up praying in the temple of the mainframe, the concept of virtualization is nothing new. Maximizing resources by the use of virtual machines on a single platform has always made good sense. For years the economics of personal computing pushed us to a distributed model. The PC was cheap and if we could use all of the desktop resources we could avoid central processing. Unfortunately this ideal was ruined by reality: the concept of so much information being distributed in an uncontrolled manner through an organization became a security nightmare. Equally, the cost of managing the applications and licenses across so many desktops was prohibitive. The development of web technology allowed us to return to a more controlled and centralized model. Unfortunately most server farms are built from traditional PC technology on a one- application-to-one or –many-machine basis and this is wasteful of space, resource and power. Blade technology provides a good first step to solving this problem, enabling the consolidation of a number of individual servers into a smaller rackspace and less power consumption. This provides many cost benefits as well as controlling the speed with which we need to extend or renew datacentres. However longer term, new virtualization techniques will provide us with much better utilization and a reduction of space and power. This can either be implemented on individual severs, blade technology or more likely the new generation of super servers. However there is much more to virtualization than just consolidation. Virtualization delivers the capability to deploy, move, or clone an application from one platform to another over a network, even when it is running. Live migration of applications at this speed and scale demands new levels of performance, reliability, and standardization from networks. That’s why thoughtful planning of network architectures is the first step toward virtualization's full value. Fortunately, virtualization's requirements are evolutionary - natural extensions of capabilities that networking solution providers have been improving for years. But large-scale virtualization initiatives should take a close look at their networks early in the planning process, to assure that they offer capabilities like these: Link aggregation and virtual chassis - link aggregation, or trunking, bundles multiple links to deliver more bandwidth and higher availability. Long used as a cost-effective way to build internal Ethernet backbones, link aggregation is an attractive alternative to hardware replacement when a network needs bandwidth to meet new requirements. Unfortunately, standard IEEE 802.3ad link aggregation won’t work unless ports reside on the same switch - a restriction that greatly complicates network topography and introduces delay, complexity, and risk. New network virtualization techniques like virtual chassis allow link aggregation between two switches, even at separate locations. The result is more bandwidth where it's needed, freed from the constraints of physical switch locations - an ideal complement to server virtualization. Wire-rate high-density core switching - at the data-center core, server virtualization can raise demands on network bandwidth and latency. Wire-rate network performance allows processing of sustained and bursty traffic without dropped packets, avoiding TCP retransmissions that increase application latency. Architecture counts most at the core, and dense wire-rate 10GbE ports can help weed out multiple layers of switching - in all but the largest enterprise networks, it can even eliminate the aggregation layer entirely. Simplification of the core cuts latency, complexity, and cost, and improves reliability: all key elements for a successful virtualization initiative. Security without latency - virtualization providers have done an excellent job of addressing user concerns about security - most users now see virtual machines as no less secure than the physical machines on which they run. But live migration of virtual machines and the applications they carry creates new network security tradeoffs. Firewalls that protect sensitive network legs or sub-networks may introduce latencies that can cripple a running application on a virtual machine, even though they might be invisible to a physical server. And the risk of failure creates an incentive for removing protection, with obvious risks. Here, there is simply no substitute for performance. Rather than play a dangerous game trying to balance availability against security to defer a hardware purchase, it's time to upgrade critical firewalls, focusing on latency and throughput metrics. Network operating environment consistency - server administrators rarely think about the operating systems of network infrastructure - but they should learn more. Most data center networks today run between six to ten different network operating systems, adding complexity, inconsistency, and delay in qualifying new features. Optimizing network performance for virtual environments is difficult enough without the challenge of a different operating system on every switch, router, VPN appliance, firewall, and more. When you standardize on a single operating system (not OS “family”) for network hardware, you’ll get faster project turnaround, better network performance, and more reliable operation of applications running in virtual environments. Virtualization - and beyond Virtualization is a great reason to upgrade the performance and reliability of corporate networks - but not the only one. Up-to-date, optimized networks deliver business benefits that not only support the latest technologies, but unlock your organization’s ability to: * stay in the race - with networks that deliver basic IT services with utility-grade reliability, to support business users, satisfy regulators, and delight customers * outpace the competition - with technologies that improve productivity, cut costs, and lock your competitors in a never-ending struggle just to keep up * change the game - using innovative technologies to craft new services that redefine your competitive landscape Your organization’s decision to adopt virtualization signals its intention to compete - and win - using the most advanced technology available. But even a powerful new approach like virtualization doesn’t perform in a vacuum. Careful consideration of the bandwidth, latency, security and consistency of your network environment will help you overcome hurdles and delays on the way to your virtualization goals - to create a network that supports your virtualization targets, maintains your quality-of-service and availability commitments, and exceeds the most demanding requirements of your business future. read more › › ...............................................................................................................................................................................................................................................................................................................................
|
| Top 5 Essential Log Reports
The SANS community has banded together in order to create the "Top 5 Essential Log Reports" consensus. This list is not intended to be a complete review of all the potentially useful log reports. Rather, the focus is on identifying the five most critical log reports for a wide cross-section of the security community. The Top 5 Essential Log Reports
...............................................................................................................................................................................................................................................................................................................................
|
| The #1 PCI Compliance Issue today
There is an ancient proverb (largely believed to be Persian in origin) that goes a bit like this: He who knows not and knows not that he knows not is a fool; avoid him. In today's world of PCI compliance, the biggest problem many organizations have is very similar to that held by the individual in the first line - they don't know that they don't know. Let me explain my thinking here. I've consulted with and audited a number of organizations for PCI compliance, both large and small. On the surface, the PCI standard is well-written and generally more explicit in terms of describing what you need to do to achieve compliance. However, no compliance mandate or information security guideline can help organizations fix what they don't know is broken. Particularly in large or more distributed organizations, there are some "gaps" that just don't get addressed. By and large, these aren't the "big things" - organizations know when they have undertaken a massive storage or encryption effort. Likewise, organizations know what brand of enterprise-class antivirus software they have deployed. No, the biggest headache for many organizations is not a particular technical control or product. It's the lack of a truly proactive attitude. This alone can significantly affect the overall security posture of an enterprise, and the state of PCI compliance efforts as a result Most organizations are doing something about vulnerabilities. Patches are being monitored and deployed, some internal scans are probably run every now and then, and some degree of log monitoring is probably going on. Host-based firewalls or IDS/IPS might be deployed, well-configured images might be the standard, and so on. However, things change. People miss that one box when patching. The new Windows co-op might have screwed up the configuration. Would you know? When's the last time you performed an assessment I'm a firm believer in the notion of "continuous assessment" for a few reasons. First, over a period of time, this mentality offers companies the best chance to develop a sound and measurable baseline of activity in their environments. This baseline is then monitored constantly - you know those kids' puzzles with the two identical pictures that ask you to "spot what's wrong" in the second one? Right, of course you do. Well, that would be an impossible puzzle without the first picture, wouldn't it? Yep - that would be one seriously frustrating puzzle, alright. The second major reason I believe in the notion of continual assessment is straightforward - based on my experience I can vouch for it because it works. There, it's that simple. By being proactive, and learning a) what you have, b) how it's configured, and c) when something changes, you can create a truly effective security regimen that is much easier to monitor and maintain. So many people think that running a vulnerability scanner means clicking a button on a scanner, coming back 10 hours later and printing out the 478-page PDF file that now tells you exactly what is wrong in every nook and cranny of your infrastructure. That's a bit old-school: the new breed of tools can assess a LOT of things with a more automated approach, all of which can tie to a solid security program and a sound PCI compliance strategy. Here's a few: Determining whether your patch management program is effective Continually assessing risks and exposures and discovering vulnerabilities is a program worth establishing. By learning what your issues are, fixing them, then continually assessing your own environment, you will quickly find that you are not a fool at all - you might just be on your way to being a wise person. ...............................................................................................................................................................................................................................................................................................................................
|
| Selecting an UTM
While information security has became the most important aspect for any form of business process, the mushrooming of vendors in the space of security management tools has also became a noticeable aspect. Even in today’s financially tough phase, security infrastructure is one such priority of users that has shown resistance. There are certain security tools which security managers have patronized over a past couple of years. Among them UTM appliance is one. Factors like low cost of UTM solution coupled with the ease of deployment make it more popular among the SMBs. While UTM vendors claim that it takes off the pain of managing security by controlling multiple security tools like firewalls, spam filtering, etc, there are a few security managers who are not happy with the performance aspect of this swiss-knife approach to security. The only reason for such an experience is their lack of planning and weak pre-deployment process of the UTM appliance. To avoid this kind of experience, security managers should take a systematic approach while shopping around for an UTM. This systematic approach entails a complete understanding of what these solutions can do and what they actually want from their UTM. This sounds very easy, but if ignored, it could change the entire deployment experience. Network security is no longer just about keeping viruses, worms and other threats at bay. In an era of highly complex and blended threats, organisations have a very short window of time to respond to threats before it bring down network, leak critical data and tarnish the reputation beyond repair. Therefore, the decision to deploy an UTM should be well informed and thought out. So what should you be really looking for while deploying an UTM for your infrastructure? To start with, security managers should look at getting a complete integrated solution that should have firewall, VPN, gateway anti-virus and anti-spyware, gateway anti-spam, intrusion prevention system, content filtering, as well as bandwidth management and multiple link management – all over a single platform. Organisations can choose and zero in on the best productivity and security features that match their needs. In a scenario where mainly threats are from internal than external, centralized reporting and management also become vital features that security administrators should look for in an UTM solution. Organisations with branch offices and remote locations need to maintain the same levels of security in these locations as the central office. While the threats faced by these locations are at the same level as the central office, organizations need to maintain high security while keeping expenses under control. The standard advice is to choose a UTM solution that meets your security needs. There is a raft of solutions in the market that claims to defend against a variety of threats. It becomes essential for enterprises to judge “Critical Impact Value” of a particular threat and the corresponding ROI from the appliance. However, that will differ from organisation to organisation as there are significant differences between verticals in terms of business pain points and drivers and concerns for deployment in a particular security. For example in educational institutes the UTM suite of features must include the Content filtering which effectively fulfils the need to shield young minds from viewing unwarranted and malafide content on the net. Similarly, for segments like government and defence there is a pressing need to protect sensitive data and the inclusion of IDP is in the feature suite is a must. While talking of these many points, getting proper post sales support from the vendor is also very critical for a successful deployment. Yes, in the UTM deployment there is a need to check vendor credibility over the issue of a support as well because security devoid of good support is bad choice. The vendor support system should be able to rapidly scale its support capabilities in step with the growth of their customer base. Only then customer satisfaction and responsiveness will be effectively addressed and by reducing business impact due to incidents through quick resolution time. read more › › ...............................................................................................................................................................................................................................................................................................................................
|
| IT and Business Alignment
Strategy and budgets are two key topics that came up during my various conversations with CIO's from across the MEA region in the past 12-15 months. While most enterprises have not changed their 'overall' plan as a result of the crisis, alignment of IT and business seems to be the dominant strategy.
This said, there is a strong focus on cost cutting and short-term 'wins' - however this is not their main strategy. Organisations are demanding strong and well-documented business cases for their IT solutions, and are also taking the businesses' need for adaptability and flexibility plus business process efficiency as the starting point for discussions about how IT can enable this agenda before deciding on investments.
ICT providers therefore will need to strike the balance between adding value to clients by helping to create flexibility and agility in IT and business, while providing strong business outcomes, and providing short-term cost reductions through efficiency gains.
The importance of business and IT alignment has never been greater. Although the economy is expected to recover in 2010, the need for organizations to continue evolving products and services while improving operating efficiency will remain a central leadership challenge. For IT leaders, the ability to rapidly correlate IT project spending with critical business priorities is essential. The trouble with most technology adoption plans is that they do not indicate what the business value is, and what strategic or tactical business benefit the organization is planning to achieve. The simple matter is that your IT plan needs to have a strong business metric, not only an IT related metric that examines delivery of application in isolation. While IT-business alignment may in the future be the natural state in which we operate, it doesn't mean that it's easy to achieve. Being close to the business means being close to your customer, and this is critically important to being able to deliver what the company needs. This happens in big ways, like having yearly IT strategic plans approved by a board of business leaders; and it happens in small ways, like having each IT person sit close to the business teams he works with on a day-to-day basis. This enables IT colleagues at every level to be conversant in the explicitly stated needs of the business and to have insights into latent or unstated needs as well. Furthermore, being able to explain how and where IT is adding value is a critical but frequently under appreciated skill.
IDC believes that IT will have to reorganize in the coming years, as:
read more › › ...............................................................................................................................................................................................................................................................................................................................
|
| Importance of Web Application Firewall Technology For Protecting Web-based Resources
Web-based applications and services have changed the landscape of information delivery and exchange in today’s corporate, government, and educational arenas. Ease of access, increased availability of information, and the richness of web services have universally increased productivity and operational efficiencies. These increases have led to heavier reliance on web-based services and greater integration of internal information systems and data repositories with web-facing applications. While motivations of attackers against a victim’s corporate and organizational assets remain the same (financial, IP, identity theft, services disruption, or denial of service, for example), web applications enable a whole new class of vulnerabilities and exploit techniques such as SQL injection, cross-site scripting (XSS), and cross-site request forgery, to name a few1. The complexity of services, potential severity of breaches, and mounting sophistication of attacks requires additional functionality beyond the capability of traditional network-based security products. The emergence of dedicated web application firewall technology provides a comprehensive and focused solution to help increase the security of web-based services and protect valuable information assets. read more › › ...............................................................................................................................................................................................................................................................................................................................
|
| How to Build a Culture of Security
Security isn't a Band-Aid, a patch that can be casually applied to fix a specific problem. For an organization to be fully secure in its IT systems and processes, security must become an integral cultural element, a quality instilled into every part of an organization - including its employees. The first step toward building an enterprise-wide culture of security is to understand that security begins at the top, with executive management. At Cisco Systems Inc., for example, security starts with CEO John Chambers, who lends his name and rank to security initiatives and follows the same security practices and procedures as all other employees. Top Gun Security is much too important of a concept to be treated at the departmental level or placed into the hands of an indecisive committee. To ensure that security measures are implemented and maintained, a single person must be placed in charge of security programs. Many organizations, including Cisco, General Motors Corp. and Amazon.com, have a CSO (chief security officer) or a CISO (chief information security officer), whose primary job is to ensure that IT security initiatives are launched and completed and that no portion of the enterprise is left vulnerable to internal or external threats. Training and Talking A training program is vital for creating and maintaining corporate security. Training materials come in many different forms, including brochures, newsletters, emails, seminars, Webinars and videos. Companies that strive to drive security into their culture use a variety of approaches. Offering an array of education tools will make it virtually impossible for employees to escape the company's security message. Security information also has to be easily accessible. Starbucks Corp., for example, has built an electronic-policy library that's designed to help employees know how protect company systems and data. Employees are encouraged to use the system to find information on topics ranging from email practices to data encryption. Communication is also crucial tool for creating a successful security culture. It's most important to make security relevant to all employees. No one likes to take extra, time-consuming steps just because it's "company policy." Managers must take the time to explain why certain practices are required, answer employees' questions, and seek support in implementing and updating security policies. Good communication also means targeting security messages. While many security instructions and warnings can be applied enterprise-wide, some departments require special treatment -such as reminding traveling employees how to secure their laptops. When used on bulletin boards and in company publications, catchphrases are useful tools for reinforcing a security culture. At Cisco, for instance, employees are urged to "Keep Cisco Secure" and "Be a Security Champion." To drive home security's importance, managers need to establish a rewards and recognition program. At Cisco, employees who make a significant contribution to enterprise security are rewarded with a plaque and cash. The company also gives away "Security Champion" T-shirts to employees who have made lesser contributions to the company's security. All winning employees are publicly recognized at mandatory company meetings. Staying Loose An enterprise security culture must be flexible in order to accommodate new technologies and emerging threats. Security policies should also be periodically reassessed to make certain they are keeping pace with ongoing trends and enterprise growth and to ensure that current practices aren't impeding productivity. Additionally, all employees should be urged to think creatively and to contribute in whatever way they can to the organization's security strategy and policies. At that point, you can be sure that security is truly an integral part of your enterprise's culture. ...............................................................................................................................................................................................................................................................................................................................
|
© 2008. Paramount Computer Systems, All Rights Reserved.