Page 77 - Security Today, July/August 2019

tory is to make sure there’s visibility into all Active Directory activi- ties. An Active Directory auditing solution can assist with this and help administrators be proactively alerted to suspicious activity be- fore a full-blown attack. For every enterprise network, there should be a complete Active Directory Disaster Recovery plan in place to minimize the impact of an attack, and all for damage to be reversed within just a few hours.
Lost and Stolen Asset Devices
There are vulnerabilities everywhere, and much is dictated by the number of system endpoints. The number of PCs on a network used to be the main concern, but the primary concern now is all the IoT and edge devices—including cameras and all types of sensors—that connect to a network.
It is critical to secure all device communications with the backend systems and make it difficult for someone to access the network from the outside world, through a lost or stolen device. Keep in mind that if it’s easy to access a network, it’s probably vulnerable. Administra- tors have to strike a balance between security and usability and make sure we err on the side of assuring security.
The practice of Network Segmentation is a useful security layer within an overall security system design. It’s surprising how many video management software (VMS) systems don’t use any network segmentation methodology. Through network segmentation best practices, we can add difficulty in accessing parts of a network.
Insider Threats
An insider threat is a security threat that originates from within the organization being targeted, often by an employee or officer of an or- ganization. An insider threat does not have to be a current employee, but can also be a former employee or anyone who at one time had access to the network. Logic Bombs are a type of malicious software that can be left running on a system by former employees, which can cause a wide range of problems.
Contractors, business associates, and other individuals or third- party entities who have or have had access to protected networks or databases also fall under the umbrella of insider threat. Network seg- mentation, robust password policies, and a pro-active, on-going review of all network activity is critical in protecting against internal threats.
Ransomware
Ransomware is a type of malicious software that threatens to publish the victim’s data or perpetually block access to the data unless a ran- som is paid. User education and awareness are critical when it comes to defeating ransomware. Treat suspicious emails with caution. In- spect email domain names and hover over links to see where they lead. Extending security through the use of anti-virus, anti-spyware on devices at the network perimeter is critical.
Most ransomware will try to spread from the endpoint to the server/storage where all the data and mission-critical applications re- side. Segmenting the network and keeping critical apps and devices isolated on a separate network or virtual LAN can limit the spread.
Sandboxing technologies can provide the ability to quarantine suspicious files for analysis before they can enter the network. The files are held at the gateway for evaluation. Adopt a layered approach to stop ransomware by avoiding a single point of failure in the securi- ty architecture, and have a robust backup and recovery plan in place.
Physical Layer Compromise
Many company server rooms and data centers have easy-to-exploit physical vulnerabilities that don’t require digitally hacking into the network. Intruders simply looking to vandalize the servers can create a huge and costly level of damage.
void spaces in the walls or above false ceilings, and “tailgating” into the building by posing as a contractor or vendor.
A major physical design flaw with server rooms is with the drop ceilings and raised floors where the walls don’t go up to the real ceil- ing or down to the subfloor. Intruders need to simply remove a ceiling tile from a nearby area and then crawl to the server room from above. And raised floors and crawl spaces—built for cabling and cooling purposes—can also be physically exploited.
For optimum physical protection, a combination of multiple se- curity strategies is needed, including the use of professional-grade access control systems and locks requiring authentication, proper wall and structure design that reduces void spaces and presents physi- cal barriers. Alarm sensors placed within potential access points is a good strategy as well. Of course, clear and detailed, documented security and access polices must be established, communicated with employees and strictly followed.
ISO 27001 and the Risk Assessment
The days of system and network isolation are over. Organizations must adopt policies and best practices that allow decision makers to have clear insight into security all practices. These policies must reach across network design, information system use, product development and, in many cases, the entire supply chain. Successful integrated so- lutions are the ones that withstand the test of time and are built with the cooperation of users and administrators with proper processes and technology.
The ISO/IEC 27001 information security standard, being the most widely accepted framework for the development and improve- ment of information security management systems, belongs to the consistently growing ISO 27000 family of best-practice security frameworks—an assembly of resources that make for seamless inte- gration of disciplines and sub-systems. Among the others are the ISO 27005 standard, which speaks specifically to information risk man- agement, offers a pragmatic mapping to enterprise risk management following standards like ISO 3100.
Also, the recently updated ISO/IEC 27004:2016 provides system- atic guidance on how to develop and operate measurement processes for the effectiveness of security controls of products and services, as well as how to assess and report the results in the form of functional information security metrics for continuous improvement.
Whether you are an engineer or consultant responsible for secu- rity and reporting to management or an executive who needs bet- ter information for decision making, security metrics have become an essential vehicle for communicating the state of an organization’s cyber-risk posture.
To mitigate risk, comply with legislation, and assure the confi- dentiality, integrity, availability, and accountability of information for your company, employees, and customers—create a written data security policy based on established guidelines, enforced through regular training, reviews, and assessments.
Milestone Systems Cybersecurity Technical Forum
A critical component of defending against cyber-attacks and vulner- abilities is to stay informed. IT and security managers need to be aware of issues that affect software and hardware, including operating sys- tems, mobile devices, cameras, storage devices, and network devices.
A reliable point-of-contact should be estab- lished for all system components, with reporting procedures to track bugs and system vulnerabilities. It’s important to keep current on common vulner- abilities and exposures for all system components and to communicate with manufacturers often.
Moses Anderson is the founder of Shield IS. WWW.SECURITYTODAY.COM 69
Some of the ways of gaining access simply include accessing im- properly installed doors or windows, picking locks, crawling through