Formal security policies are less commonplace in enterprise environments than many people might think. Why are some organizations still dragging their feet, and what might help give security administrators a boost?
In a worldwide study of more than 1,000 IT executives last year, Computer Sciences Corp. (CSC) discovered that 46 percent do not have a formal security policy in place; 59 percent do not have a formal compliance program; and 68 percent do not regularly conduct risk analyses or security status tracking.
Security specialists, of course, find statistics like these alarming. "If organizations don't develop and enforce security policies, they're opening themselves up to vulnerabilities," maintains Richard Pethia, director of the FBI's National Infrastructure Protection Center (NIPC).
Other studies underscore these vulnerabilities. In its recently released "2002 Computer Crime and Security Survey," the Computer Security Institute (CSI) conducted research among 853 security practitioners, mainly in large corporations and government agencies.
A full 90 percent admitted to security breaches over the past 12 months, and 80 percent acknowledged financial losses due to these breaches. Frequently detected attacks and abuses included viruses (85 percent); system penetration from the outside (40 percent); denial of service attacks (40 percent); and employee abuses of Internet access privileges, such as downloading pornography or pirated software, or "inappropriate use of email systems" (78 percent).
Why, then, are some organizations putting security on the back burner? Observers point to reasons ranging from insufficient staff resources, to the growing complexities of cyberattacks and security solutions, to difficulties in getting buy-in from business decision-makers.
"Most network administrators know what they should do about security. It's just that they don't always have time to do it. No matter how hard they run, they're still just 'running in place,'" says Guy Copeland, VP, Federal Sector, for CSC.
Clearly, policy tools abound these days, running the gamut from books and online templates to software programs. Still, though, some administrators do struggle over the basics.
"I have been left with the responsibility of writing up our Internet Security Policy. I suck at writing policies, and I have no clue as to what to do. Can anyone e-mail me or post an all compiled security policy that they may have? I need something to go by that I can modify to fit our purpose," writes one stymied administrator, in an Internet newsgroup posting.
Incident reports to the FBI's NPIC prove that cyberattacks are rising in sophistication, as well as in sheer numbers, according to Pethia.
Meanwhile, security solutions are getting so complicated that analyst firms are issuing entire reports dedicated to policies around specific technologies. Take, for example, application-specific access rights. IDC offers a report called "Managing Access Rights Efficiently: Policy-Based Provisioning."
"Web-based applications are proliferating. End users, 'outside' suppliers, customers, and partners all expect to access back-office data and applications, such as order status and supplies availability. The old rule of 'employees' versus 'outsiders' breaks down as different users expect different levels of access to different types of data," according to the report.
Getting business buy-in can be a big headache, too. "Recognition of security problems tends to 'stay low' in an organization. Often, information only trickles up to CIOs in bits and pieces," Pethia notes.
"Gaining executive management buy-in for an information security policy requires understanding corporate procedures, creating a review board, ensuring that the policy implications are understood, and providing updates," according to a Gartner Group report.
Yet many business decision-makers have traditionally looked at security as "nice to have," rather than essential, says Ron Knode, CSC's global director for managed security services. Business managers' perceptions don't change till "something goes wrong," according to Knode.
At this point, many observers are hoping for a quick uptick in policy activities. Federal government officials are among them. In "Security in the Information Age," a 130-page federal report issued last month, security specialists contend that government needs to induce industry to be more open about security problems.
A big thrust of their argument is that private industry owns much of the nation's infrastructure, a major target of terrorists. "If both the private sector and the federal government are targets, it makes sense for two targets to share information with each other. The private sector is on the front lines, yet has no access to government information about possible threats. On the other hand, the federal government, which has unique information and analytical capabilities, lacks specific information about attacks - particularly computer attacks, occurring outside the government but still within the United States," writes U.S. Sen. Robert F. Bennett (R - Utah) in the report.
In another section of that report, Mark Montgomery contends that business and government security should rest on the same three "prongs": policy, technology, and people. "Silicon Valley and the Beltway, where the sandal meets the wingtip, must stand side by side and on equal footing in addressing these issues and formulating responses," according to Montgomery.
Meanwhile, on a day-to-day basis, administrators will keep trying to stretch their resources, catch the ear of top management, and fight their way through the snares of security.
? See All Articles by Columnist Jacqueline Emigh
Security Policies - Not Yet As Common As You'd Think
