Importance of a Security Policy
In an attack, competitive secrets such as engineering details can fall into the hands of rival organisations; information can be altered or destroyed and digital assets like customer details and account receivables can be compromised.
A sound security strategy should look into four main areas of a network - protection, extension, acceleration and management, all intrinsically bound by a comprehensive security policy closely aligned to a corporate's business strategy.
Network Protection
Instead of shutting people out, network protection creates a secure environment that is conducive to conducting trusted business transactions.
As the first line of defence, firewalls protect a corporate's internal network and is the essential foundation of a company's Internet security strategy. A firewall examines information "packets" entering or leaving the company's network - lets a packet enter or otherwise, depending on what it finds during its examination.
Recent high-profile email attacks have shown that desktop anti-virus solutions and individual users cannot solely prevent the infection and spread of viruses and Trojan programmes. What is required, in addition, is a perimeter defence mechanism, whereby viruses are blocked before they can enter the network. It reduces the probability of damage to the IT infrastructure and the high costs of recovery.
Intrusion detection systems (IDS) monitor networks and raises alarm when there is an attempt at an unauthorised entry into the network. These systems are key to detecting unauthorized internal activities such as internal users accessing systems, data or resources to which they have no right of access. When a Trojan programme or virus has penetrated a perimeter defence, IDS spots suspicious activities and provides alerts so that measures can be deployed to stop the threat. IDS track the intrusion path thereby exposing the security gaps, which can then be plugged.
Network Extension
The next pillar of a security policy is network extension. Virtual Private Network (VPN) technology in essence, makes an insecure medium, like the Internet, extremely secure since the Internet was built for open communications and not for security. VPNs are secure "pipes" crossing over the Internet, allowing businesses to connect resources to core information assets, regardless of whether the connection is across-the-street or across-the-globe. VPNs enable authorised users to be mobile and still form virtual teams, exchange key information and conduct business transactions without worries of security compromises. This electronic form of communication, compared to traditional solutions such as leased lines, helps save connectivity costs by up to 80%. By replacing international calls with only local ISP connection charges, companies no longer have to pay high costs to allow remote employees to access the corporate network.
Network Acceleration
Adding robust security to the network can result in sluggish site performance or connection breaks. In an e-business environment, this could mean costly delays and lost revenue. Internet Traffic & Content Management (iTCM) solutions manage, control and optimize Internet traffic and content, making sure critical applications as well as firewalls are able to handle more Internet traffic, running at maximum availability and at faster speeds.
Network Management
The final point to look at is security management - the ability to manage the appliances deployed in an enterprise network, and ensuring that they operate at maximum effectiveness. Unlike ordinary network devices, security appliances have to be armed with the latest software patches for guarding against ever evolving security threats. A centralised software management remotely upgrade, backup, restore applications running on security appliances such as operating system, firewall, virtual private network and intrusion detection all from one location. While the whole upgrade process being done within the protection of Secure Shell (SSH), appliances information are not compromised.
Management systems available in the market today are simple to use yet highly sophisticated. SSL-enabled browser management tools enable the security administrator to monitor, manage and configure a network securely from any location. In a company, where there may be hundreds of employees situated anywhere in the world, being able to update security policies on all access points from a single location is efficient and cost-effective.
Workers Are More Mobile
Mobility will redefine many aspects of a company's operations, both internal and external. As organisations try to secure their networks in an 'open' world, security policies need to be implemented and mandated universally, without any exception. Companies must look beyond initial firewall deployments and look at technologies and mechanisms that will enable them to maximize the Internet opportunity. Companies must feel confident in conducting secure business irrespective of whether the infrastructure is wired or wireless.
Jeff Ratzlaff is Director for marketing, Asia Pacific Nokia Internet Communications