Fortifying Enterprises- Compliance, Certifications, and Beyond

For enterprises, managing security threats has always been a challenge. In fact with dependency on technology, security has become a top business priority for enterprises across the globe including India. Recently, several instances of data theft and cyber crimes have brought the vital aspect of enterprise information security back into the limelight. For example, the global ATM heist, where the hackers were able to breach the security systems and tamper with the cards thus, committing a sophisticated crime. This has exposed the vulnerability levels in security systems and infrastructure to cyber criminals around the world. Cyber crime is a well-orchestrated multi-million-dollar business today, executed by global operators who have access to better resources in terms of man and machine than any company. Attacks are executed with such precision that most companies are taken by surprise.

TIME TO RETHINK SECURITY

Today's dynamic business environments are forcing organizations to adopt technologies that will enable round the clock connectivity to distributed workforces, scattered customers over different access networks. With technolgy disruptions like social, cloud and mobility and BYOD, CIO's are increasingly finding it difficult to put in place a comprehensive security framework. Clearly this ambiguity makes them prone to risks like malware to phishing to threats like hacking into enterprise network and sabotaging it. Moreover today employees stay in touch with each other through social media platforms, unaware of the risk factors that emante from links and advertisements on these pages and many assume those as safe. Today another shift witnessed is of increasing adoption of SaaS for using various cloud-based applications. But at times this may also bring in the threat of data leakage as the control is primarily with SaaS providers. Furthermore, cloud service providers may not be transparent about the security violations at their data centers in their claims. Therefore, there is a strong need of compliance and governance regulations on sharing private and confidential information since trade secrets, financial and confidential data are becoming the target of sophisticated attacks.

In addition, large enterprises rely on third party vendors for various purposes including technology management. The very recent $45 mn global ATM heist also involved outsourced entities. Therefore, while it becomes important for organizations to keep continuous monitoring their own infrastructure as well as include third party vendors on their scope and deliverables with due diligence tests on vendors.

LOOK BEYOND COMPLIANCE

Hitherto most of the organizations strategies relied majorly on becoming compliant to PCI DSS, HIPAA, etc, or achieving certifications such ISO 27001, ISO 20000, ISO 22301, etc. The current threat landscape requires organizations to look beyond the ways for improving the security initiatives. The current scenarios require senior management, board members to focus on these issues and invest significantly in the new initiatives.

All of this has forced CIOs to innovate new areas, competencies of their security systems, and protect their enterprises. There is a huge need to educate enterprises to adopt smarter and safer security solutions. Though the challenges exists while implementing security, there are various methodologies and measures that can be taken at various levels within the enterprise to tackle the new security challenges.

To securely manage trends like BYOD, one needs to move beyond current set of policies and evolve new frameworks. On the technology front one needs to look beyond the current state of firewalls and look at application level protection. There is a strong need to educate the staff on organizational IT policies and social media apects.

In fact devices have moved from laptops to mobile to access data real-time and conveniently, organizations must ensure that devices are hardened and updated to handle malware. Considering SoCloMo trends, CIOs need to stay abreast of technologies that can help organizations better manage security threats. As the security landscape is getting complex than ever before, CIOs need to leverage sufficient security solutions to safeguard the information at each and every level.

Thus, CIOs must engage technology partners who can understand their business needs well and help them build enterprise security framework and architecture. Moreover, provide solutions that will protect data security, privacy and unauthorized activities from both outside and insider threats and ensure compliance policies are met. Such vendors must also provide solutions that will help comprehensively monitor and analyze network state for protection against unidentified threats and attacks.