An individual using a single workstation, a small business with two or three PCs connected to the Net through a high-speed cable modem, the team responsible for the security of an enterprise network: Regardless of an organisation's size, they all face the same security challenges â€" keeping intruders away from their private information.
Unfortunately, people tasked with security keep making the same basic mistakes. Since it's once again been a relatively quiet week in the security world, I'm taking this opportunity to list the five worst security practices found in businesses both large and small.
1. Failing to enforce policies
Number one with a bullet is failing to properly set security policies, neglecting to train anyone with access to computers, and especially declining to enforce an established policy.
It's a truism that you get what you reward for and don't see as much of what you forbid. So if your organisation wants good security practices, it must establish a clearly enunciated set of policies. Among other things, these policies must define basic usage rules, such as never opening strange e-mails, surfing random sites on personal business, or downloading files from the Web.
But security experts have been saying this for years, so why isn't it working? That's simple: Even when there are policies in place, there are seldom any real consequences for breaking the rules â€" or any reward for those who don't.
There are a few organisations, including Harvard Medical School and Beth Israel Deaconess Medical Center, where being responsible for a single security breach is grounds for termination for anyone at any level. However, this practice is extremely rare, and few organisations, if any, have established a point system tied to rewards for following good practices.
Consider the impact that a significant prize for the employee with the best security record could have on security. For example, everyone could start with 100 points, losing one point for every out-of-policy security mistake, even if it doesn't result in actual damage or loss.
Establishing security policies that are more than a stack of paper and providing employee incentives for such policies could go a long way to helping organisations improve security.
2. Ignoring new vulnerabilities
Second on my list of the worst security mistakes is failing to take appropriate action when new vulnerabilities surface.
Most security managers receive automatic notification of new patches and/or monitor at least one security Web site. A significant number even subscribe to security-related newsletters, such as IT Locksmith, which attempt to filter out the noise and focus on serious problems.
But there is simply so much information available that many people don't even bother to read the alerts they subscribe to. A far smaller number actually adjust policy or perform updates to fix the problems they do learn about.
3. Relying too much on technology
Another big mistake is relying excessively on technological fixes and paying too little attention to actually using them.
For example, if you tell upper management that you've installed the top antivirus software or the latest star in the firewall world, they'll think you've done your job. But unless you've carefully configured that firewall and maintained the antivirus software, you really haven't done much of anything.
Setting up a firewall properly in some environments can be as much art as science. It isn't a set-it-and-forget-it task any more than installing antivirus software ends all your malware worries. Instead, you have to keep tweaking the firewall to meet new needs, sometimes even blocking some ports for a few weeks after a new port scanning epidemic surfaces.
And that goes back to the second biggest mistakeâ€"you have to pay attention to new security updates and vulnerabilities as they emerge. For example, to keep track of the top 10 ports that would-be attackers are targeting, bookmark this SANS Web page. For antivirus programs, you not only need to update signature files; you must also monitor the need for patches to fix newly disclosed vulnerabilities in the antivirus software itself.
Anti-spyware software is much less complex than antivirus programs, so patches are seldom necessary. However, they require as much attention to downloading the latest database information as do antivirus programs.
Finally, don't forget that all these security utilities become worthless if you ignore the reports they generate.
