In recent years the world of IT security has undergone a revolution. It began with the professionalization of hackers, who ceased to be those legendary beings who fought for vague ideals until they developed a true industry based on defrauding the most significant number of unsuspecting people and thus obtaining more significant economic benefits.
As if we needed more, new trends such as BYOD do not make our work easier since we have to protect devices in the office and wherever they are.
We must consider complete security solutions since an unprotected area would ruin all the other measures we implemented. Below we define the four pillars on which your security policies should be founded:
Reduce attack area
Minimize risk by controlling everything that can pose a threat, such as vulnerabilities or applications. Consider security as a risk reduction; the smaller your risk fork is, the more secure your organization will be. To reduce this risk, consider controlling the following points: patches, vulnerabilities, applications, USB devices, email and internet browsing. Of course, I’m not talking about prohibiting them, much less about controlling their good use by establishing policies.
Some questions that will facilitate your work: What are the risk points of my organization? How can I reduce the risk of infection or data leakage? What information is exchanged by email or USB?
Protection Anywhere
Users must be protected wherever they are and regardless of their devices.
Today, more than ever, mobility is a challenge for all organizations, and how could it be otherwise? Security has to facilitate mobility, not hinder it.
A complete security strategy can only be effective if our users are protected at the same level inside or outside the company, whether using their desktop PC, laptop or smartphone.
Also, in this equation, you have to include new factors such as virtualization and the cloud; ask yourself some questions when you think about your security strategy:
Do my users have the same level of protection when connecting from hotel Wi-Fi? Can my solutions follow me if I decide to virtualize or go cloud? Are my users and my data protected when they use smartphones or tablets?
Stop threats and data leakage
Of course, in our strategy, we must have solutions capable of detecting and preventing threats and data leakage. If we talk about antimalware engines, we cannot stop at the use of signatures but proactive and real-time technologies, which means being able to prevent new threats, even unknown ones, automatically.
We can stop these threats at different levels: in the firewall, mail gateways, browsing, or workplace. We must have solutions that protect us at each of these levels.
Also, think that data leaks, your most important asset is your data and these leaks are a real threat. We should control email, USB devices, and applications capable of exchanging files (not only P2P but files can also be sent via Skype).
How secure do my 0-day threat solutions give me? Can my gateway solutions interact with those of the workstation to improve security?
Keep users working
This point, often forgotten, is one of the most crucial for the success of our strategy. Both users and our IT department must be able to work without security being an impediment. Deposit must be as transparent to the user as it should not hinder her work.
A good practice is looking for solutions that simplify the most common tasks, automating the maximum number of processes, such as malware disinfection or recovering a forgotten password.
We should consider how we are going to face our security strategy. These are some questions: How many solutions do I need to cover all my needs? Do these solutions allow me to create consistent policies across all my use cases? How much administration time will it take for my IT team?
With this article, I intend to refrain from entering into the debate on whether it is better to have a single security solution or it is better to have different solutions at each of the levels. My position is clear; now, I propose answering the questions that I ask you here and that you take into account your answers.
Also Read: Review the Security of Your Company and Vulnerabilities
