Enterprise Security and Risk Management

Searching the internet finds a plethora of definitions, services, products, solutions, and even training classes for Enterprise Security and Risk Management. The topic is so broad that almost every security vendor falls into this category. At the middle of almost all the definitions (excluding physical security theft) is the protection of an organizations most treasured resource: Information.

Corporate information can generally be divided into three categories:

• Public: Accessible to everyone in the company. This is commonly displayed as an intranet bulletin board or even through Human Resources.
• Sensitive: This data is sensitive to only the individuals, groups, and departments that need it. It is vast majority of data in an organization and is sensitive to the users that created it and need it for daily operations.
• Confidential: This data contains everything from personal information, passwords, credit cards, and even company secrets (new products, employee salaries, etc.)

Confidential information is the most valuable to an organization and generally the target for an attack and extraction for illegal monetary gain. This information can come from a wide variety of computing resources as we move outward from the center of the diagram. Protecting servers and workstations is a mature discipline with plenty of tools and solutions to assess vulnerabilities, risk, and data. Other categories such as the proliferation smart phones and emergence of cloud computing represent untested security models for users, business transactions, and other physical devices that may interact with them. Attacks on these new technologies are currently challenging the traditional solutions for Enterprise Security and Risk Management. For example, my team and have been working with cloud providers and recently stood up some fresh images for a new project. After a few minutes of exposing the new image to the internet, it was infected. We did not even have a chance to load any management utilities or even perform a vulnerability assessment since the default image provided by the vendor had only service packs applied and did not contain any security updates since the last service pack was issued. From an enterprise security and risk management perspective, you would never stand up a new production server and make it available until it was fully patched, properly configured, and past quality assurance checks. So why would depending on a cloud resource be any different knowing that the vendor providing the image is not keeping it fully patched in the first please. Consider if you would let a rooted smart phone on your network as well. Both of these technologies have access to information, represent changes to the technology landscape, and can not be controlled with current documented and enforceable security procedures for enterprise security and risk management. The definition of enterprise security and risk management is incredibly diverse. As we introduce new technologies to increase efficiency, lower cost, make us competitive, and provide easier access to information, we potentially introduce new risks and attack vectors that can compromise our most confidential information. Current procedures and tools for these technologies are just emerging and will add another layer of security management to implement and manage. This does not need to be another vendor and with yet another solution. It can just be an expansion of the toolsets you have to meet current challenges or the introduction of one vendor to manage all of your unified vulnerability management needs. For more information on how eEye meets these needs, please click here. Our technology and solutions are addressing these emerging problems and can provide the relief and products your organization needs to safeguard your information.