If a network is compliant with regulations, does that mean it\u2019s secure? Unfortunately for both IT professionals and businesses, it does not. <\/p>\n
\u201cCompliance is not security, but security can be compliant \u2013 with a set of requirements and guidelines that ensure data is confidential to authorised users, has integrity, has not been changed or modified, and is available on demand,\u201d says Anton Jacobsz, Managing Director at Networks Unlimited, an African value-added distributor of NETSCOUT solutions across the continent. <\/p>\n
He adds that compliance is about making choices to implement security controls in an organisation aimed at keeping data safe and secure, but also available. \u201cAfter all, critical data, like customer lists and corporate secrets, would be useless if it were not available to your employees.\u201d <\/p>\n
\u201cTo protect data, first put on your Hollywood screenwriter’s hat and think of all the bad things that could happen to the data, the devices it resides on, and the networks that carry the devices. This process is designed to identify risk and build a set of requirements that will mitigate it \u2013 in a threat model,\u201d continues Jacobsz. <\/p>\n
Threat modelling identifies resources of interest to hackers and thieves and brainstorms the feasible threats, vulnerabilities, and available security controls. <\/p>\n
TechTarget defines it as a procedure for optimising network security by identifying objectives and vulnerabilities, and then defining countermeasures to prevent, or mitigate the effects of, threats to the system. In this context, a threat is a potential or actual adverse event that may be malicious (such as a Denial of Service) or incidental (such as the failure of a storage device), and that can compromise the assets of an enterprise. <\/p>\n
\u201cYes, assume there will be attacks, because you need to make data available for use, and that one or more attacks will be successful,\u201d highlights Jacobsz. <\/p>\n
He further points out that if you look at security as a process, it becomes a series of battles where you will win some, lose some, and hope you don’t lose a lot. \u201cOtherwise, you will be out of data and out of business in a short period of time,\u201d states Jacobsz. <\/p>\n
Some guidelines for managing and securing mobile devices in the enterprise are for IT to restrict access to hardware and software; manage wireless interfaces, monitor and report exceptions; require authentication to access company resources; and restrict app installation. <\/p>\n
To meet the above goals, it is recommended to first identify the devices that an organisation intends to support in terms of their features, such as: network services including cellular, wireless, Bluetooth and near field communication; and built-in vs non-removable storage. Also consider external, removable storage (flash memory, USB) and digital cameras. <\/p>\n
Then, build a threat model for worst-case scenarios, followed by a compliance policy to combat these, such as: use of untrusted networks, interaction with untrusted systems, use of untrusted content over the network, and use of global positioning system and location services. <\/p>\n
\u201cWe have realised that organisations across Africa are faced with the challenge of developing a Wi-Fi compliance policy. NETSCOUT\u2019s AirMagnet solutions in the region can however play an active role by enabling detection, planning, compliance monitoring and troubleshooting of all smart devices, thereby successfully harmonising BYODs into an organisation\u2019s IT, governance and security infrastructure,\u201d concludes Jacobsz. <\/p>\n
For more information, please contact John Hindley, NETCOUT business unit manager at Networks Unlimited: john.hindley@nu.co.za. \t<\/p>\n","protected":false},"excerpt":{"rendered":"
If a network is compliant with regulations, does that mean it\u2019s secure? Unfortunately for both IT professionals and businesses, it does not. \u201cCompliance is not security, but security can be compliant \u2013 with a set of requirements and guidelines that ensure data is confidential to authorised users, has integrity, has not been changed or modified, […]<\/p>\n","protected":false},"author":23,"featured_media":14195,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,328,136,399],"tags":[919,564,37,252,83],"class_list":["post-14193","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-enterprise-security","category-features","category-industry-expert","category-more-news","tag-data-security","tag-netscout","tag-network-security","tag-networks-unlimited","tag-wi-fi"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/14193","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/users\/23"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/comments?post=14193"}],"version-history":[{"count":0,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/posts\/14193\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media\/14195"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/media?parent=14193"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/categories?post=14193"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/africa\/wp-json\/wp\/v2\/tags?post=14193"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}