Extending the Radar Lessons

As we become increasingly dependent upon the Internet as a global network in order to conduct business, we are increasingly opening ourselves up to the inherent security risks of being connected.

Emerging and disruptive technologies add to our increasing level of vulnerability. We are encoding more of our business processes and intellectual assets into software solutions and are increasingly opening these up to employees, customers, and partners. Even if the threat level stayed constant, we are increasing our risks due to exposure substantially.

The basic concept behind prevention is to protect corporate networks, applications, and data by putting up perimeter defenses, validating the identity of users, controlling access, encrypting communications, and securing applications and content.

The strongest form of authentication occurs when systems combine techniques in order to achieve "three-factor" authentication. This technique combines what a person knows, such as a user name and password, with what he or she has, such as a hardware key fob, with who he or she is obtained via biometrics.

With mobile devices such as cell phones and PDAs gaining ever more functionality, it is critical for businesses to secure their devices to the same level as their wired computing infrastructure.

Businesses often do not understand the full scope of the normal working interactions of their own applications and processes, let alone the patterns of network activity or changes to data that may signal an attack. Intrusion detection software provides an alert mechanism for security breaches and can also help to protect data and network integrity in real time.

A well-prepared and well-rehearsed incident response plan can help minimize the damage caused by attacks. During an attack is no time to be determining who to call for help. Upfront planning is critical to business continuity and disaster recovery efforts.

Return on security investment = Tangibles + Intangibles = (Minimized business disruption + Increased IT productivity) / (IT costs) + Increased business resiliency