Worst to First: Securing Best Practices

Thursday, August 4, 2011 @ 02:08 PM gHale

Organizations fail to adhere to simple data protection standards and appear unaware of what security practices are in place, according to a new survey.

Industries such as manufacturing, banking and financial services, high tech, and government were among the 420 organizations surveyed by Venafi, an enterprise key and certificate management provider in the “2011 IT Security Best Practices Assessment.”

Cyber Report: Social Media Security Lacking
Security 101: Avoiding Social Engineering, Phishing Attacks
Web Sites to Find if You’re a Target
Paranoia Means Better Security

The survey examined where organizations rank in the implementation of 12 IT security and compliance best practices, ranging from how organizations leverage and manage encryption to how often they conduct security awareness and training programs.

The top five best practices, their high failure rates, and recommendations for mitigation include:

Best Practice 1: Perform quarterly security and compliance training.
Failure rate — 77%
Recommendation: Deploy technologies that compensate for the lack of training resources by removing opportunities for human error through automation.

Best Practice 2: Encrypt all cloud data and transaction.
Failure rate — 64%
Recommendation: Salesforce.com, Google Apps and other cloud applications do not encrypt by default. Deploy third-party technologies that encrypt cloud data — in motion and at rest — to enhance security and privacy.

Best Practice 3: Use encryption throughout the organizations.
Failure rate — 10%
Recommendation: Although the low failure rate seems encouraging, failure to implement management technologies can turn encryption into a liability by exposing keys that provide unrestricted access to seemingly secure data. Deploy technologies that can manage encryption assets across the enterprise.

Best Practice 4: Have management processes in place to ensure business continuity in the event of a Certificate Authority (CA) compromise.
Failure rate — 55%
Recommendation: Digital certificates rank among the most ubiquitous security technologies. However, as CA breaches show, certificate authorities have been, and will continue to suffer compromise. Using a CA is half the battle — to further reduce risk, have a plan for immediately replacing all certificates and encryption keys signed by a compromised CA.

Best Practice 5: Rotate SSH keys every 12 months to mitigate risk incurred by the average employee life cycle of 2 years of service.
Failure rate — 82%
Recommendation: SSH keys provide servers and their administrators with root-level access to critical systems and data. A key rotation period that far exceeds the average employee’s lifecycle significantly increases the risk that a former employee or malicious admin can gain inappropriate access. Some enterprises that do not rotate keys might fail to understand their significance. Deploy technologies that simplify and automate key rotation.

The survey showed almost 100 percent of evaluated organizations had some degree of risk:
• When asked if their organizations encrypted data stored in leading public clouds such as Google Apps, Salesforce.com and Dropbox, 40 percent said they did not know.
• When asked how often critical encryption assets such as SSH keys were rotated, 41 percent responded that they did not know.
• When asked if their organizations were using encryption keys and certificates for data security and system authentication, 10 percent said they were not.

Leave a Reply

You must be logged in to post a comment.