Subscribe / Unsubscribe Enewsletters | Login | Register

Pencil Banner

How to avoid being the next Yahoo

Ryan Francis | Oct. 18, 2016
What questions should the CIO/CISO be asking network architects to stay secure.

What would we expect the answer to be?

The team should be able to provide the network dependencies as they map to the systems—is it in a single data center, many? What network services does it leverage, any single points of failure, is it attached to a legacy unsupported switch? The description should include some form of segmentation and control. In reality, most organizations are poor at upkeep and a good portion of critical assets are connected to legacy networks, simply because they have been around the longest.

What are the red flags?

Same as question two, you don’t want to hear “Partially. Incomplete. Inconsistent.” If there is mention of legacy, lack of resilience, or no mention of security zones or controls in the description, you’re also in trouble.

Can you report on which systems are accessing our critical/regulated applications and data? Can we tell if anything changes?

Why is this important?

Being able to get the answer for this means: One, your team knows what the critical assets you need to report against. Two, at least some monitoring tools are in place. Three, the monitoring tools are connected to the right controls. Four, it helps validate whether access is appropriate or not. And finally, action can be taken. Knowing what happens should include details of access recertification and changes to management and approvals processes. This is closely coupled with the ability to control access and respond to anomalous or malicious activity.

What would we expect the answer to be?

Yes— and it should be available as a self-service model based on entitlement. But unless the environment is new, with a zero trust policy, most will struggle having this knowledge in any complete or consistent way. However, that is really the point of the question. It is important to understand why these systems are talking, as it ties into policy administration. Further, access should be reviewed regularly and have clear processes for recertification and change management. In essence, the more active the controls or tools the more positive an answer.

What are the red flags?

A cobbled together report from disparate systems, that requires that the data be validated and more. Or the tooling isn’t there and it’s not certain which services we would need to report against (see 1).

How have we segmented the network?

Why is this important?

This question is intended to establish how network security has been approached at the organization. Understanding the prevailing architecture is important for determining the level of maturity and awareness of the limitations associated with a perimeter-based approach.

What would we expect the answer to be?

Ideally, there would be no presumption of trust for networks. There should be a series of domains and tenants for business units, environments and application classes. Controls within and between these domains and tenant should be state and application aware.

 

Previous Page  1  2  3  Next Page 

Sign up for CIO Asia eNewsletters.