Beyond the firewall

This year, with all of its data breaches, has certainly proved that network security is much more complex than at past times, when firewalls were viewed as premium defense collateral. What are some methods/policies I should be aware of as I look to spend time (and security budget) in 2008?

The CSO's job has gotten more difficult recently as the focus of risk management has shifted from simply protecting their organization's network and server infrastructure to ensuring the Intellectual Property (IP) that is housed within and communicated across that infrastructure is not getting into the wrong hands.

A company's IP may be more valuable than its physical infrastructure. This is obviously the case in industries such as high technology, pharmaceutical, and biotechnology where the essence of competitive advantage and profits is intellectual property. But even in a number of 'lower tech' industries such as entertainment, retail, and financial services, proprietary content and know-how are keys to success and must be closely guarded.

Two fundamental requirements for the CSO charged with protecting this IP are 1) Knowing what his organization's IP is, and 2) Who should be allowed to receive it. Meeting these requirements pose significant challenges.

According to a recent Enterprise Strategy Group (ESG) report, Extending Intellectual Property Protection Beyond the Firewall (sponsored by Reconnex), about half of the 109 companies surveyed did not have standard policies for identifying and classifying IP. Furthermore, IP classification is a bit of an organizational "hot potato" with responsibility for that classification spread across legal, line-of-business management, IT, and executive management in most organizations. This study also confirmed that more large organizations are sharing their IP with an increasing number of business partners (both domestic and international) in conjunction with outsourcing and offshoring relationships. In fact, about two-thirds of the organizations surveyed reported sharing moderate-to-substantial amounts of IP with their business partners today. Yet, less than half of those surveyed have a formal process for determining which IP can be shared with business partners.