The best hope for a security solution that protects enterprise-wide networks while allowing for centralized management is the emergence of standards. Security standards like DCE, Kerberos, SAML, elements of IPv6 and others continue to be the Holy Grail for which we wait. However, the wait continues after decades with little hope for a standards-based security solution in the immediate term. Why wait for a new standard when an existing standard will do.
Let’s take a look at some of the security issues facing the IT professional and see what management problems they have in common:
- All data, including passwords, flows in the clear over most networks
- The insider threat is on the rise
- Wireless networking means networking is not restricted to wires any more
Another huge security problem that has been mainly ignored, because it is hard to solve, is the insider threat. An insider can abuse their privilege to collect sensitive data for the fun and profit of the individual, with no regard for the organization. The insider threat has always been much greater than the hacker threat, but mild-mannered, trusted employees stealing data is not headline material like a thirteen year old hacking the Pentagon. In reality, the disgruntled employee has more motivation and more access to sensitive data than any outsider. The network must not turn into an enabling technology for the disgruntled employee to compromise data or have access to data beyond that with which they are trusted.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.