Getting NetSmart - Keeping up with security

Security: A tough nut to crack
Security is more about politics than technology

Network World, 06/12/02

I just wound up my four-city stint with Network World's State of Security Town Meeting (the tour itself has two more cities to go) and I have learned a very critical lesson: security is more about politics than technology.

The IT managers who attended the seminar were alike in one respect: they all had issues with security that stemmed from corporate culture rather than integrating technology.

Their biggest challenge was getting together with the "pure" network guys to hammer out a cohesive security strategy. Time and again, the issue came up that network guys want to work with their vendors, such as Cisco, etc., and the security guys want to work with their mainstays like Check Point. So, how do you get the two to see eye to eye and put in the technology that's best for the company?

You have to open the lines of communication, the panelists said. One attendee asked if pure-play security companies will become obsolete as more and more technology is thrown into other net gear. The Cisco rep on the panel jokingly said that'd be great, but the quickly added that competition is needed in the security field. That without it, things would stymie.

Joel Snyder, moderator for the event and founder of Opus One, said that you have to convince upper management that security is important and that will then force dialogue between the various factions of the IT staff. Having buy-in from your superiors is key to making security a priority for the business.

The panelists, who represented Cisco, Foundry, SSH, AppGate and Top Layer, agreed that without the support of corporate executives security cannot be a comprehensive endeavor. To get the attention of upper management, they recommended putting together a "scare" package that shows how much other companies suffered after being attacked by viruses, worms and denial-of-service slams. Then, do an audit of your system to show where the holes are. If you have firewalls, temporarily remove them to see what traffic is going where and document what your weaknesses are. Show them your strategy for shoring up the network and what mission-critical data you'll be protecting. Then show them the dollar figures of a catastrophic loss vs. the cost of a reinforced network. The math will not be difficult and you'll be a hero.

A note about cost, though, that I found interesting. I've always been in the camp that believed it when vendors told me a virtual private network, by virtue of riding over the 'Net, will save you money every time. However, Snyder pointed out to attendees that VPNs can save you money, but may not, and that shouldn't be your over-arching reason for using them.

Error 404--Not Found

From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:

10.4.5 404 Not Found

Error 404--Not Found

From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:

10.4.5 404 Not Found

Error 404--Not Found

From RFC 2068 Hypertext Transfer Protocol -- HTTP/1.1:

10.4.5 404 Not Found