3 Imperatives For Rock-Solid Information Security Compliance In The Enterprise

1. Opportunities for Improvement

As the years are progressing, the volume of data is increasing. Attacks and threats are becoming more sophisticated.

The traditional approach was mostly reactive in nature (i.e. when the incident would take place, the appropriate controls will be applied). Organizations should take a proactive approach where the technology environment eliminates the possibility of an incident. Imagine building an application that has inbuilt security rather than applying separate software to protect the application. On similar lines, I can think of a couple of good examples which I observed during my internal audits at Bitwise. The most important of them was MAC binding of devices on the network. This eliminates the possibility of an unknown or a rogue device getting connected with the network.

Another solution applied to many clients of Bitwise is a combination of solutions that have significantly eliminated the risks related to malicious activity by users. The desktop solution to users is a combination of zero compute thin client and virtualization. This solution has ensured that all compliance requirements of BFSI clients are met. The beauty of this is that there is no possibility of any manual oversights in the policies and no malicious activity is possible at the user end. Apart from security, this solution has also reduced the cost on electricity bills by 60%

These proactive approaches ensure that the information security team focuses not only on known risks but also on unknown risks. Another advantage of this proactive approach is that it significantly decreases internal audit costs as the scope is limited and centralized. Adapting to solutions like preventing data leakage and virtualization are efforts towards this direction. The advent of Big Data will play a significant role in this approach as analysis of information security data will help organizations understand the hidden vulnerabilities and addressing them in a timely fashion.

2. Vision for the Future

Cost plays a vital role in information security solutions. Surveys allude to the fact that there is always a gap between the current level of information security and the necessary level of information security. This gap will depend how closely information security goals are aligned with business goals.

New digital forces like social networking and wireless devices are business priorities for most organizations. The vulnerabilities and risks associated with these forces are best handled when security teams are involved at the conceptualization stage of these initiatives. This way the team is provided a sufficient window to include these risks in their existing plans; working with infrastructure teams to create a roadmap that will set the foundation for safe implementation of these modern-day concepts. Rather than a one-time investment in the security of these apps and tools, the cost is spread across many years and often are “piggybacked” onto other capital investments.

Hardware refresh or upgrade is a very common practice for an IT organization and the decision for the new hardware dictates the future of the environment for at least the next 3-4 years until the next refresh takes place. This standard practice by itself is a good example of how information security can be included in decision-making and future planning. By drawing up the business vision along with the Information security team the associated risks from the envisioned environment can be included in the process of decision making while working with the infrastructure team during hardware refresh policies. The same applies for physical security where business goals like new facilities, data centers can be included while deciding the capacity of new equipment.

3. Innovativeness in the Security Model

With social networking sites and blogs, enough personal and corporate information is moving to the internet to act as fodder for cybercriminals. Standard security features with standard options are implemented to reduce the associated risks. This at times can be the weak link in the cat and mouse race with the bad guys who often tend to observe and exploit vulnerabilities. An organization can allocate certain efforts for security in its innovation center which will allow a certain degree of uniqueness in the security setup of the organization. It could be a simple training or a tweak in the process which will make things more efficient.

For example, while dealing with a unique compliance requirement from a client who did not want RSA tokens to move outside Bitwise premises there was a lengthy workflow associated to keep a track of a single key. The innovation center suggested attaching a wooden block to each RSA stub and label it. The size of the block was in itself a discouragement for people to carry the RSA token with them. Moreover, even if they carry it outside the floor area, there were CCTV cameras can clearly capture the event.

In another training initiative, the information security team conducted an event on security incidents where users of social networking sites were impacted. This resulted in wide acceptance of locking down these sites on certain sensitive terminals. The effect was so prominent that the security team received responses coming back from employees on terminals where these sites were not blocked and were missed.