When we talk about implementing basic security measures, one could think "And what are those?" And if that question would be asked, it would be a very, very difficult question to answer. If you are a system administrator, an IT security manager in your company, or just a regular information security enthusiast, I recommend you to read this paper, as it addresses some of the most important issues in implementation of basic security measures in an IT environment.
Information security breaches have been rapidly rising over the past decade at an alarming level. For this reason, more and more IT companies have realized that securing their businesses is not something they should do, but something they have to do. The losses we read about in everyday news are too scary to let IT security of your company be just the way it is – none! You can't do it once and for all, but rather by employing basic security measures and following some rules and policies you define for your organization. In this article, we are going to point out some of the steps which need to be taken if you want to do good for your company by implementing a serious and comprehensive security process. We will not focus on only one operating system (i.e. Linux), but rather point out general information on the subject.
According to the Internet Security Alliance (ISAlliance), there are about ten good security practices as a place to start. These ten practices include different kinds of information security, such as policy, process, people, and technology, all of which are necessary for deployment of a successful security process. With these techniques adopted, we can say we are moving towards our goal – ensuring the security of critical information assets. It is proven that through adopting commonly accepted, good security practices, every organization can begin to successfully manage their security risks. So, let's take a look over these ten practices.
We are going to divide these ten practices as follows:
- General Management
- Risk Management
- Security Architecture & Design
- User Issues
- System & Network Management
- Authentication & Authorization
- Monitor & Audit
- Physical Security
- Continuity Planning & Disaster Recovery
In a perfect world (like the one we're not living in), every company should have a predefined, straight and ready to implement attitude over the security in the company. It is considered an advantage to recognize a problem even before a problem becomes an emergency. On the other hand, if that is not the case, following and researching these suggestions should help every IT manager in successfully implementing basic security measures and by doing that, ensure their organization has done the basic efforts to defend themselves from the dark side of the cyberspace.
IT security managers must establish an appropriate information and Internet security policy and an auditing process. Security in their company must be seen as an essential part of their business survivability. Also, security processes must be an everyday activity, not something you do once and forget about it, as security itself is such subject that it is changing not even daily but hourly. There are legal authorities whose job is to process complies if something goes wrong and their security forts fail to respond properly, and management must be aware of these bodies.