Security is arguably the single most important issue for business and the public sector in the 21st century. Its importance is even more apparent in government, where the need to safely store, access and share highly confidential information is paramount.
And yet it’s becoming increasingly difficult to address this need. Assaults on security have become widespread – whether in the form of malicious code sent by e-mail, unauthorized access to network infrastructure, or damaging actions of disgruntled (or simply foolhardy) employees.
While threats are pervasive, protection is not.
The price of neglect
Many public sector organizations have not taken adequate measures to effectively shield themselves from security attacks.
Workstations and networked devices are not kept current with the most recent security updates, making them the weakest link in what could otherwise be a strong security chain.
Attention of security administrators (in organizations that have them) is split between identifying and forestalling intranet-related threats on the one hand and those originating from the Internet on the other. Cyber crime continues to wreak havoc. In the U.S. in 2004, financial losses from information theft totaled more than $140 million, according to a survey of 494 U.S. businesses conducted by the Computer Security Institute and the FBI. Combined with virus attacks, financial fraud, insider network abuse and other attacks, security breaches cost businesses billions of dollars each year.
Here’s a statistic that should put the issue in perspective: At the start of this decade, losses from the average bank robbery amounted to $2,500. For the average computer crime it was $500,000. And that’s probably an understatement, given that more than half of all computer crimes go unreported or cannot be quantified. In the public sector, where public trust demands greater integrity, IT security breaches can be so much more destructive – doing far more than just fiscal damage. In an increasingly information-centric world, the potential for both loss of face and lawsuits is greater than ever.
The antidote to this is a security strategy that delivers, but does not force organizations to dramatically overhaul existing systems or incur massive additional expenses. This can only be accomplished with a new networking paradigm, where security is embedded in the network itself. In other words, much like the alarm system in a new car, security should be standard equipment on a new network – not something that’s bolted on later. The surprising truth is many public sector organizations today continue to deploy networks based solely on the metrics of connectivity, capacity and cost.
With that mindset, it’s easy to lose sight of far more critical elements – continuity, context, control, compliance and consolidation.
Securing ROI
The focus on cost forces many system administrators and CIOs to justify security spending in terms of ROI. That’s not necessarily a bad thing. However, at a time of budget scrutiny, few organizations – both in the public and private sector – truly grasp the true ROI potential of security investments.
From where is that ROI derived?
Leaders from the top down need to understand that the security system is part of a well thought-out risk management strategy. The principal question then is not what is the ROI, but rather what is the value of the network? And, more to the point, what services and applications use it? The focus of many network vendors – and their customers – on simply building lower-cost, faster networks misses the most important objective for today’s CIOs: business continuity. High capacity networks aren’t going to be the driver for the next wave in networking, because they don’t respond to the inherent problems in today’s world.
Fortunately, integrated security does. Leaders in both government and business also need to consider what is being used over the network, and its function. With every device now connecting to the network – from workstations, laptops and PDAs, to surveillance cameras, printers, copiers and IP phones – vulnerability increases exponentially. Many of these devices were never considered in the original network design, and most organizations struggle to understand how to control them on the network. This challenge is compounded by the ongoing trend towards convergence. Most networks cannot properly classify devices such as an IP phone. Is traffic on that device to be treated as IP or phone traffic? What privileges should it get? What safeguards should be applied?
Automating defences
Overcoming the challenge of handling security on all of these disparate endpoints requires enterprise-level security throughout the network, but especially at the end system. There must be an automated method for determining the trust level of every end system that ensures only devices with correct and up-to-date security configurations access the corporate infrastructure.
End systems – such as applications in use, operating system patch levels and antivirus signature revisions – that fail to meet security parameters would then be quarantined, while automated corrective action targets the end system device. Such a scenario stops vulnerable or dangerous systems in their tracks and eliminates disruptions and privacy risks. I’m not suggesting for an instant that the cost and capacity of network architecture are not important factors. Instead, I’m saying higher performance and lower cost are givens in order to really leverage the network – but not without addressing security.
Consider the Road Accident Fund (RAF) of South Africa for example. A government agency funded mostly by a fuel tax, the RAF acts as the insurance company responsible for processing all road accident claims. The organization handles compensation for personal loss or damage wrongfully caused by motor vehicles, covering medical expense and loss of support costs for all of South Africa. With more than 1,000 employees, the company found it needed increased capacity to meet network traffic demands. Bottlenecks severely affected the performance of many of its branches, making it virtually impossible for the RAF to achieve its “uptime” goals. A cost-effective, high-performance network was required. While recognizing the importance of bandwidth, the IT manager also knew the new network had to be manageable and completely secure.
As the types of data transported over the network include medical claims as well as human resources, payroll and other financial information, security was essential to prevent unauthorized access to the network, which processes and controls several hundred million rands (hundreds of thousands of Canadian dollars) in payouts each year. Not only was the addition of security and firewalls necessary but, like many public organizations, the RAF also wanted to implement the service without incurring additional costs. At the same time, the organization sought to deploy a stable, reliable network that could grow to meet evolving requirements.
The answer was an easily manageable network infrastructure that offers greater bandwidth and handles all of the RAF’s networking needs, but has integrated security and control on the LAN and to the WAN edge. Numerous government organizations today find themselves in the same situation as the RAF, reaching the end of their bandwidth rope or, in some cases, faced with immediate network security concerns. Fortunately, CIOs and executives at all levels are becoming increasingly aware of the new threats and demands on the network – and understand that the solution lies in intelligent networks with integrated, embedded security.
John Roese is chief technology officer at Andover, Mass.-based Enterasys Networks Inc.
