I think that security policies are the most underrated aspect of any information security program. In chapter 1 I write "They provide the blueprints for an overall security program just as a specification defines your next product." How do you tell your administrators to configure a firewall if you don't have a policy to specify what you are protecting? Policies are the foundation for a sound infosec program.
Handheld devices are now owned by many people who use them for business purposes, which makes companies more susceptible to wireless security problems. In your opinion, what is a good approach in writing a wireless and handheld device usage policy to safeguard the corporate network?
Handheld devices, like any new technology, come with a lot of security issues. The first thing I would do is a risk assessment of the device. The risk assessment would look at how the device is used, what its capabilities are, and what are the risks being added to the environment. Once I have that information, I would then look at the proposed mitigations and write a policy that would allow me to mitigate the risks I am unwilling to accept.
For any technology, old or new, this is a good approach to devise a policy. It also allows you to better understand the technology and how it is being used and its effect on information security.
What is, in your opinion, the biggest challenge in protecting information at the enterprise level?
Watching the threat from the insider. Everyone focuses on the attacker from the Internet or what can happen outside of the enterprise. However, statistics continue to show that the biggest threat continues to come from insiders. And sometimes it is a challenge to determine who the insiders are that could cause problems.
The first failure is to not have a proper security awareness program. If the users do not know what is in the infosec policies or what is expected of them as part of that policy, how does the organization expect these users to follow the policy? Unfortunately, most organizations either do not have a security awareness program or have one as part of employee orientation and they do not follow it up with refresher courses.
Having sound policies that understand that the insider is the greater threat, a solid security awareness program, a proactive security enforcement program, and a commitment from management are the keys in meeting this challenge.
What are your future plans? Any exciting new projects?
Not long ago, I contributed a chapter to Que Certification's "CISSP Training Guide." I wrote Chapter 3, Security Management and Practices. I have also been working with the SANS Institute to review some exciting new courses they will be offering. I am also working on a book proposal with a colleague. This should be fun!