Uncategorized
Security Issues
THE PANEL
Chairman: Conall Lavery, CEO Entropy
Damien Moran, IT Security Consultant, Rits
John Brosnan, CEO, NetFort Technologies
Wireless Presentation – Easy to do – hard to get right
Presenter: Damien Moran, IT Security Consultant, Rits
In recent years the proliferation of wireless networking technology has provided an easy and cost effective route for many companies to network their offices. However, many such companies remain either unaware or unconcerned by the security threats that accompany the use of wireless networking.
In this presentation Damien will address some common wireless security threats. The presentation will include practical demonstrations of security threats associated with wireless networking and will show how a wireless network may be hacked. Damien will then demonstrate some practical countermeasures that can help businesses to secure their wireless networks.
Experts from the IIA SWG will discuss why IT security has been traditionally delivered as hardware and software solutions which you manage yourself, but why there is a movement towards buying it as a service now. Whilst the technology behind each approach may be covered, the discussion will mostly focus on the business, cost and risk issues of each approach. Outsourcing has been slow to take off in Ireland and many feel that this is due as much to the Irish psyche of wanting to own “the ald bit of sod” as it is to the different management skills required to manage an outsource provider. There will be ample time at this session to ask the panel questions
Many of the issues covered in this discussion are relevant to outsourcing any IT infrastructure or application.
Panel Discussion 1
Outsourced IT Security Vs. doing it yourself
The Case for Outsourcing IT Security
John Brosnan will outline the case for outsourcing. Specifically John will briefly discuss the following:
• IP networks are becoming more and more critical for ALL companies. Daily change, expansion, partner networks, new applications (VoIP), etc. More and more applications now running over IP.
• How do you know everything is ok? Regular audits are not the solution? Everything should be continuously monitored.
• More and more risks, dangers, internal (users accidental or malicious, mobile devices, etc) and external (more sophisticated attacks). Loads of tools freely available that allow even basic users ‘hide’ what they are up to. Some recent real life examples will be used to illustrate these risks.
• Very difficult and usually expensive to hire the people with the appropriate skills. Dedicated IT security people usually only found in the larger organisations.
• Over complex and expensive systems. Very easy to manage and very easy to mis-configure.
• Must stay up to date, Patch Tuesday, etc. All patches applied in a corporate network should be tested so that they do not break any applications on the corporate network
• Also recently more rules and regulations.
• The company reputation is also at risk
• The ‘experts’ have the skills, the experience of dealing with lots of different problems in lots of different companies. Prevention is a lot cheaper than the cure.
• You do not lose control if you ask for regular reports, copies of all procedures and processes, etc.
• Subscription model is financially very attractive. No large capital expenditure up front.
• Disaster Recovery – can you afford to have this in house?
• Access to 24hr Emergency response team.
• After building up an in-house security team, you are still left with gaps when people go on holidays.
The Case against Outsourcing IT Security
Conor Crowley will outline the case against outsourcing. Specifically Conor will briefly discuss the following:
The main case against outsourcing IT security services is based on the transference of risk; ultimately it is your brand, your reputation, your assets that are damaged by security lapses. No matter how well the outsource contract appears to protect your interests you and your company will be the ultimate loser in any failure of the security resources put at your disposal.
Companies need to understand the limitations or constraints in the offerings that are available. How difficult will it be to manage your relationship with the service provider – what are the contractual issues? What level of added complexity exists if security services must be split across different providers? How can you ensure quality of service? What are the limitations of the tools and procedures that are used? How will your business be treated in the case of a major security breach? Will your provider be around this time next year?
The cost and complexity of putting in place an outsourced security service that meets the needs of your business may well be over and above the challenge of growing this expertise in-house.
Liability and Brand Risk issues
Richard Nealon will outline the issues associated with Liability and Brand Risk. Specifically Richard will briefly discuss the following:
In today’s environment outsourcing is a standard business strategy. Sometimes the reputational and liability issues associated with partner organisations controlling part of your business operations are not always given the recognition that they deserve. When a company is in the middle of a complex outsourcing deal, it’s not always considered what might happen when things go wrong. Businesses are often dependant for their very survival on the integrity, confidentiality and availability of their information and data. Because of this, they need to recognise that any breach in the security of their partner’s processes or systems, can have the potential to irreparably damage the reputation of their business.
When a security breach occurs at an outsourcing partner, media attention always focuses on the business rather than on the outsourcer. The businesses ability to manage their data in a responsible manner is immediately brought into question, and their brand and image is damaged.
Outsourcing companies are fully aware of these risks. However, it is in their interest to run a tighter business model, and as a result, cut costs wherever they can. Information security is one area that can often be looked at when costs are scrutinised. As a result, many outsourcing companies will try to cap their contingent liability at a small figure. This practice can cause difficulties if a business needs to take legal action to recover reputational or financial losses as a result of the outsourcing partner not meeting it’s contractual obligations to adequately secure the businesses data.
If we choose to engage outsourcing companies we need to remember who owns the risk – we do! Outsourcing companies can be responsible for the security management of our data, but the impact of a breach of security belongs to us. Let us make sure that we can manage that risk.
Issues concerning ownership of the policies, SLAs, change control and ownership and control of the data.
Sean Reynolds will outline the issues associated with SLAs, change control and the ownership and control of the data. Specifically Sean will briefly discuss the following:
Organisations can no longer delegate sole responsibility for the protection of its customer data and assets to a third party. So how do you protect data and assets when it is in the hands of a third party and how can you be sure that the security agreed between both parties is in fact in place and working effectively?
The aim of this panel discussion is to outline some key actions that can be taken to safeguard an organisation’s assets when entering into a service arrangement with a third party. It will include issues such as the need to perform basic security due diligence reviews prior to entering into a contract with a third party, the importance of the content of a Service Level Agreement (SLA), confidentiality and ownership of intellectual property and the level to which security controls are put in place and monitored by a third party to ensure the protection of your data whilst outside your direct control.
Following these brief introductions the panel will discuss these issues and invite members of the audience to give their views and ask questions.
BIOGRAPHIES
CONALL LAVERY Entropy – Founder and MD
Conall Lavery is the founder and managing director of Entropy a company specialising in IT security. Conall is a graduate of the Marketing Institute of Ireland. Conall is one of the founders of the IIA (Irish Internet Association) and served on the board from February 1997 until November 1998 with responsibility for eCommerce and Security.
DAMIEN MORAN, IT Security Consultant, Rits
Damien has a Masters in Computer Forensics from Dublin City University and a BSc in Computing from Institute of Technology Tralee. He is a specialist in conducting forensic investigations and ‘expert witness’ services for which he provided testimony in court for both civil and criminal cases. Damien also has considerable experience in wireless assessments, penetration testing, vulnerability assessments, data recovery and ethical hacking techniques.
JOHN BROSNAN, CEO, NetFort Technologies
John, a graduate of the University of Limerick (B. Eng Electronic Engineering 1986, M. Eng Computer Systems 1994) has extensive IT security and networking experience having worked as a Principal engineer with Digital Equipment Corporation and Director of Software Engineering in Asita Technologies. In 2002, John co founded NetFort Technologies. Since then the company has developed and sold its Network Activity Monitoring solution to enterprise, local authorities and Universities in Ireland, the UK and the USA.
RICHARD NEALON Bank of Ireland
Richard Nealon, Bank of Ireland: Richard is the Operational Risk & Compliance Manager, Payments and Electronic Services, Bank of Ireland Group. Coming from a communications background, Richard has been a part of the information security practice within Bank of Ireland since 1990. In recent times, he has moved back into a business role within the Bank of Ireland Group. He is the proud recipient of the COSAC Award 2003 and the (ISC)2 Presidents Award 2001 & 2003, and continues to be actively involved in the Irish Information Security Forum (IISF).
Conor is a high profile member of the Information Security community in Ireland as Director of Technical Services. Within Rits he manages a specialist team delivering a range of services including network design, penetration testing, vulnerability assessment, wireless and secure communication audits. He has held the trusted position of Information Security Manager in a number of large organisations including government, semi-state and financial. Conor is a regular contributor to the Irish and International media in the area of information security and provision of independent advice.