Effectiveness of Security Control Risk Assessments for Enterprises: Assess Risks on the Business Impacts

The complexity of risks affecting the business has increased manifold and the need to gauge the Information Technology risks acting on the business operations has become paramount. As the technology is interfacing point for the exchange of information/data with entities & people, there is the need to build in the technological controls within the technology and at each of these interfacing points to ensure that the sensitive business information/data is handled appropriately.

The business managers who run business operations are looking how to contain the risks pertaining to the information technology. The need of any business operations is to operate securely and seamlessly leveraging Information Technology and ability to recover and resume the business without any loss of confidentiality, integrity and availability of business information/data in any event of a security incident. They also need to quantify the impact of the IT security risk on the critical business processes, and provide the business-level insight at the management level.

Hence there is pressing need to give the business managers the business perspective of security technology risks prevailing in the organizations business operations. The emphasis on the technology vulnerability shall be a priority only after there is an assurance that the required technological solutions exists.

Business and Technology Centric Security

Customers require solutions for two requirements
• Protect the FORTRESS (Business Operations) and bolster the defenses with the required FACADES (Technology Solutions)
• Strengthen the FAÇADE (Technology Solutions) for any weakness in its effectiveness
The above requirements has made us classify two types of Gaps in security controls
• Type I: Technological solution to be deployed for Business information/data controls: The business rationale of controls at any of the information/data interfacing points need to be understood and then the technology should be looked into as an enabler/solution provider.
• Type II: Vulnerabilities in the technology implemented which can be exploited: The technological vulnerabilities that exist which make the solution effectiveness less reliable.
The relevant business controls should be audited from the perspective of presence of technology solutions (Type I) and the effectiveness of the technology solution (Type II). It is imperative that both aspects are covered in the assessments for customers as this gives the comprehensive viewpoint to the customer of the security of its business operations.

Approach: Risk Assessments

It is recommended that a phased approach is followed to conduct Security Risk Assessments for Enterprise Business Operations. Risk Assessments are the first step in determining how to better safeguard an institution’s assets and reduce the probability that those assets will be compromised.
• Phase I: Business & Technology Landscape Overview includes the following steps:
o Identify the Business Services
o Understand the Business Operations
o Understand the Application Landscape
o Understand the Network and Server Infra Landscape
• Phase II: involves developing the Business Information/Data flow
o On the Physical infra landscape
o On the Logical Application Landscape
• As per the business data flows, phase 3 involves identifying the business controls required by business managers.
• Phase 4 involves identifying the weakness in controls’ IT landscape audits, including:
o Applications
o Infrastructure
• Phase 5, assess the risk for the weakness in control, involves assessing the business impact of risk and the prioritization of remediation for the business.
• Phase 6 includes recommendations for the risk treatment and implementation plan.

Risk Profiling: Business Driven Technological Controls

The Business operations of any small/medium/large sized company are supported by the IT Operations which need to operate at acceptable level of security for secure functioning. The business threats shall trigger the need for establishing the technological controls at the various interfaces.

“For the stock exchange operations, the need to secure the Very Small Aperture Terminal connectivity for access to trading terminal by the brokers from the remote locations is business requirement.”

“For a retail setup with multi locations geographical spread users accessing the business applications which has the critical business data, the solution for Identity and access management becomes a Business requirement.”
To ensure that the IT operations is operating securely the business requirements have to be clearly brought forward the Business Impacts can be done by assessment of the implemented Technological solutions.

Let’s take “Access Control” as a requirement for a Retail Business environment which is very critical from the Business perspective of ensuring the Risks of unauthorized access and modification of business critical data is minimum and controlled.

Access Control: The retail businesses have a distributed business and IT operations (HO-Head Office and Branch Network) with the users accessing the varied Business critical information Systems/Application. The user access has to be based on least privilege or consistent with job function. Such business and technology operations have a need to provide escalated privileges to resources at various instances and the controls need to be built in to establish accountability on access to various information resources.

The control to establish accountability to ensure that required users have the right permissions is a priority. This is critical with change of roles/branch transfers/department transfers/privilege escalation requirements/folder access changes/new users etc. The controls risk assessments cover the risks that may prevail in each of the business aspects of the access provisioning.
Opinion piece submitted by Satyanandan Atyam, B.E (I&P), M.M.S (Finance), CISA, LA ISO 27001, LA BCM 25999

Comparison of IP- and analog-based surveillance systems: Total Cost of Ownership (TCO)

(via Axis.com)

When the question is asked “Is a network camera more expensive than an analog camera” the answer is a resounding “yes”. It should be, since it includes more functionality than its analog counterpart. When the next question asked is “Is a network camera system more expensive than a DVR system with analog cameras?” the answer will depend on who is in the room. Some say “absolutely” while others “maybe”
and some “no”. Why is this?

To some extent it depends on lack of knowledge about the total cost of ownership for both analog as well as network video systems. Secondly it depends on what type of system that is being discussed; how many cameras, the location of the cameras, the facility the cameras are installed in, etc. In spring of 2007, research was conducted aiming at bringing some clarity in this area, which is presented in this
white paper. The research was conducted by an independent researcher focusing on measurable hard costs for the total cost of ownership. It did not factor in any of the additional benefits of network video such as better image quality, the ability to utilize the benefits of megapixel cameras or easier upgrades of additional cameras.

This white paper describes the procedures and findings of a total cost of ownership (TCO) study for two types of video surveillance systems:

> Analog surveillance system: Analog cameras and DVR based recording
> IP -based video surveillance system: Network cameras, IP infrastructure, Server, Software and Storage

Cisco Names Winners of 'Think Inside

SAN JOSE, CA--(Marketwire - October 8, 2009) - Today Cisco (NASDAQ: CSCO) announced the winners of its "Think Inside the Box" Developer Contest. Launched last fall, the competition challenged application developers around the world to develop applications that run on the Cisco® Application Extension Platform (AXP), which resides on the popular Cisco Integrated Services Router (ISR).

Cisco launched this contest to encourage collaborative development through the use of Web 2.0 technologies, promoting what Cisco calls the Human Network Effect. The winning teams were determined by a panel of seven industry experts who selected the following applications as the most innovative, implementable and relevant to businesses. More than 100 qualified teams from 75 countries entered the competition. The finalists demonstrated the business relevance of the AXP in solving real-world problems, in areas of unified communications, security, advertising, cloud architectures and energy management.

10 reason why Windows 7 could fail

The reviews of Windows 7 have thus far been favorable - so why does Jack Wallen think the new OS may tank? Here’s his take on the impending release.

October 22nd is the big day for the official release of the latest iteration of the Windows operating system. Many have dubbed it the savior that will bring the glory days back to Redmond. Many have said that it will pretty much wipe clean the foul stench left behind by Windows Vista. I, and a few others, think that Windows 7 will not be the success most pundits are proclaiming. How can I say that? I will give you 10 reasons why Windows 7 could easily fail.

Ensuring Security in the Cloud

Over the last several years, cloud computing has emerged from a promising concept to one of the most demanded IT hosting solutions. With a devastating recession in full effect, more businesses are coming to realize that they can tap into the cloud to access state of the art applications and infrastructures at a fraction of the cost. While the benefits cannot be denied, the security risks are becoming more of a scary reality everyday. Here are a few tips to help make sure your investment in the cloud is secure.

Wireless turns a greedy eye on PoE Plus

Grinding slow but exceedingly small, the IEEE has, since September 2005, been crafting a standard commonly known as PoE (Power over Ethernet) or, in its most recent official guise, 802.3at. It is a technology that integrates electrical power into a standard LAN infrastructure: it enables power to be provided to the network device (such as an IP phone or a network camera) using the same cable that is used for network connection. As a result, you do not need power outlets at the camera locations, for example, and makes the provision of 24/7 UPS (Uninterruptible Power Supply) easier.
PoE extends the power directly from the data ports to whatever network devices are connected, using two pairs of conventional Ethernet Category 5 cable. Plus takes PoE to a new level: ostensibly providing sufficient power for WiMax transmitters, pan-tilt-zoom video surveillance cameras, videophones and thin clients. The significance of a workable marriage of PoE and wireless applications is understandably causing a ripple of excitement.

For campus security, an integrated system is more than just technology

As potential attackers are becoming smarter and more brazen, it doesn't take long to become sold on the benefits of an integrated security system. That's especially true if you're the one charged with protecting high-traffic areas such as school campuses.

Now how to create one? For starters, it's important to realize that an integrated approach means a lot more than just ensuring technologies work seamlessly together. Rather, a real integrated system requires the entire organization and all its nuances to work as a cohesive unit.

Think about the electronic components of an integrated system. It is well-documented that being able to supplement security personnel with a system that seamlessly combines intrusion, access and video technology into a single interface improves situational awareness and enables faster response times.

It's not uncommon, for instance, for a large university to employ dozens of digital video recorders dispersed across campuses to support camera networks. The ability to manage those DVRs from a single location certainly streamlines operations. But a real integrated system takes it a step further and folds in access control to provide personnel with an all-encompassing platform that can tie access control events with relevant video.

Better Risk Management via Converged Security, IT and Business Expertise

For more perspective about what elements enterprises need to fully understand their real-time security posture as well as potential or emerging risks, Sharon J. Watson spoke earlier this month with Jasvir Gill, CEO, and Pan Kamal, director of marketing, for AlertEnterprise.

In addition to real-time event monitoring and automating employee on- and off-boarding, AlertEnterprise literally shows a company its risk. With a click, a business user can drill down to see the precise risk factors associated with an employee and her role and physical/logical access rights, such as access to ingredients in a warehouse plus ability to alter production controls that, in combination, potentially could enable the employee to sabotage the company's product.

Biometric Time Attendance System

In the era of Science and Technology, Biometric Technology is becoming more and more useful with it’s bunches of applications. Now a day there are very rare areas where biometrics not used. It is useful at shops, schools, offices, organizations, companies and libraries no matter how small or big it is. Biometrics has wide range of applications ranging from visitor management, access control system, biometric door locks, finger print readers and face recognition systems.

Companies Fail to Take Precautions to Secure the Weakest Link in their Information Infrastructure - Paper

Recent well documented stories in the media have shown how easy it is to cause breaches in security by careless handling of paper documents. IT managers need to understand that not all attacks are malicious, and employees can inadvertently be involved in accidental data loss.

While millions of pounds have been spent by corporations on security networks to ensure that data entering and leaving cannot be accessed by anyone without permission, many companies still fail to take any precautions to secure perhaps the weakest link in their information infrastructure – paper.

Holding Down The Fort

Seldom has there been a more difficult marriage than the one between electronic technology and physical barrier portals. While access control systems are faster than ever before and filled with control and data base management features, regular hinged swinging doors are still the barrier portal of choice. Fire and light-safety codes, not to mention moral responsibilities, mandate that exits require no special knowledge to use.

Bio-degradable and recycled ID cards for eco conscious brands

A new range of environmentally conscious ID cards and accessories is now available from DED Limited. Including bio-degradable and recycled cards as well as lanyards produced from a renewable source, these products are ideal for ID and membership cards for companies with an eco conscious brand strategy or message, as well as events, festivals and conferences with an environmentally friendly theme.

ID card scheme is fundamentally flawed and should be shelved

TSSI Systems says it is not enough for the home secretary to only scrap plans to make ID cards compulsory, the whole scheme should go. “The scheme has been ill conceived from the start. Apart from the outrageous costs, people’s privacy is still at risk,” said John Barker, General Manager, TSSI Systems Ltd.

Network access control now addresses multiple needs

CIOs and chief information security officers whose network managers are evaluating network access control (NAC) products are advised to lay down some guidelines for finding the right solution. NAC now has several uses and as many potential pitfalls. An organization should define its primary usage case for NAC, map out a plan for taking advantage of NAC's other uses and decide on an enforcement protocol. Otherwise, it risks choosing the wrong vendor or product.

IT managers involved in decision to purchase IP-based physical security products

According to a new report from IMS Research, IT managers are involved in almost 60% of decisions to purchase IP-based physical security products. The report, based on a survey of North American integrators and installers of IP-based security products, also found that over three quarters of the companies surveyed dealt with IT managers more now than they did one year ago.

Use Video Security And Access Control Systems To Keep Your Premises Safe And Secure

Do you manage an office that deals in secure and confidential information? Or perhaps you run a business that would suffer greatly if anyone managed to get their hands on your business plans. Whatever the reason, most people who run office or business premises wish to protect the security of those premises, and prevent any unauthorized
entry.

ISC Education Launches Summer Learning Series

ISC Education announces the launch of its Summer Learning Series, a free webinar series powered by ISC365.com. The monthly webinars are an extension of the ISC Education program found at ISC West and ISC East, offering physical security and network professionals a forum for ongoing training and education between the ISC Events.

CCTV Computerized Monitoring and Storage

Current closed circuit television (CCTV) cameras operate utilizing a wide rage of lenses and electronic components. Modern cameras can focus on extreme detail, allowing for optimum visibility in a high definition field, but can create problems when storing the media.

Other advanced uses seen in several of our CCTV installations in Los Angeles and Orange County included computerizing the monitoring process. By linking the control of the cameras to a computer and motion sensors, objects can be tracked semi-automatically. The system will track movement across a scene where there should be no movement, or they can lock onto a single object in a busy environment and follow it. This can also be adjusted for the time of day the system needs to perform these functions. These systems can also be linked to time access key card operations. Computerization allows the tracking process to work between cameras on a unified system.

The primary components in a CCTV surveillance installation include:

· Video surveillance cameras
· Digital video recorder (DVR)
· Intercom systems

Long-term storage for large commercial enterprises usually requires a digital video recorder (DVR). DVR’s utilize different compression ratios and are equipped with differing amounts of hard disk space. The size and quality of the recordings are subject to frame rate, video compression and the length of time the file must be saved.
Storing the recorded images is necessary depending on the specific business functions of the system owner. The digital recordings are kept for a multitude of reasons, and the length of time the recordings are stored differ from business to business. The primary purpose of storing recordings is usually to monitor a facility. They can also be used to recover evidence of an important activity, or evaluate historical information.