Tip

Adjusting a network security strategy when the business plans change

For any enterprise information security team to sustain long-term success, it is necessary to conduct periodic evaluations of the synergy between its business strategy and network security strategy. Major business events like an acquisition should not be the only time that such evaluations take place; changes happen constantly within a company, and it's surprising how quickly a disconnect can develop. This tip will outline business events that demand a network security strategy review, what that review should include and how missteps with management can be avoided.

When an information security strategy should be reviewed
Replacements and promotions amongst senior managers, or perhaps the start of a product or service offering, can quickly alter the key drivers of a business. New reporting lines may not clearly cover ownership and accountability of risk. Whenever a company undergoes such a change, it is essential that the network security strategy and policies change accordingly to deliver the type of security that the evolving organization requires.

I was recently working with a large organization that was making many of its products and services available online for the first time. Despite the success of the move from a "brochureware" strategy to an e-commerce Web site, it dramatically increased the amount of personal identifiable information travelling across its internal network, as well as the Internet. The

    Requires Free Membership to View

    Login

network security policy had to be updated to secure this change in network traffic. All network connections to the customer database were encrypted, network users' access rights were reviewed and adjusted where necessary, and the organization began testing various data extrusion detection tools.

Communicate the strategy to everyone -- early
To avoid a misaligned security strategy, the head of IT security needs to keep up with an organization's different departments and their strategies, and how each is planning to implement those strategies. He or she should engage senior stakeholders on a regular basis to discover and discuss areas of concern. By ensuring all parties are made aware of both business and security imperatives, more informed choices can be made when it comes to purchasing and implementing security technologies. For instance, if security is involved in a new business initiative early on, security can be planned for and implemented at the start of the project -- always a more effective approach than trying to bolt security on at the end.

The key components of any security strategy
The focus of a network security strategy review should be to assess whether the current security strategy can:

  • Protect data, both at rest and in transit across the network, according to its security classification;
  • Mitigate new and emerging threats;
  • Maximize resources while delivering services securely;
  • Match the organization's appetite for risk; and
  • Meet compliance and regulatory requirements.

Getting management to approve the new security strategy
Any major changes to the current information security strategy need to have key stakeholder support, and they must be signed off and supported at the board level. New security initiatives that require additional funding are more likely to be approved if they play into risk and compliance, two major drivers of governance activity. A recent recommendation I proposed to a client was quickly approved once the board fully understood their legal responsibility to adequately protect their customers' data.

For more information

Learn why network policy reviews are especially important during a corporate merger or acquisition.

Mike Rothman explains the best model for an organization's IT security staff.

Are penetration tests essential for enterprise network security? Mike Chapple answers your questions. 
A network security policy change often requires new products or services to make things run smoothly, and those things don't come free. So to get that key increase in the security budget, try presenting the revised strategy as part of a cost-saving initiative, such as a technology-based project that improves efficiency and reduces overall costs.

It is essential, however, that the security team fully appreciates the organization's risk tolerance. Business and security strategies most frequently diverge when a security team and business managers have different definitions of what a company's appropriate level of risk is. This often occurs when a newly appointed senior manager comes from a different industry and is used to operating within a different risk environment. When the teams don't see eye to eye, defenses are over- or under-engineered and budgets are misspent.

It is a challenge to create an updated network security strategy that aligns with evolving business plans. Policy adjustments require communication and cooperation among all departments that rely heavily on the network. The key is to ensure the network security strategy is seen as a business enabler not a disabler. Security professionals may need to change their mindset or those of their business colleagues; it's important to think about how even the smallest of business changes can leave security vulnerabilities wide open.

About the author:
Michael Cobb, CISSP-ISSAP is the founder and managing director of Cobweb Applications Ltd., a consultancy that offers IT training and support in data security and analysis. He co-authored the book IIS Security and has written numerous technical articles for leading IT publications. Mike is the guest instructor for several SearchSecurity.com Security Schools and, as a SearchSecurity.com site expert, answers user questions on application security and platform security.

This was first published in August 2007

Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.

    Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.

    Back to top