Story image

Fortinet and IDC: The five stages of IT security

25 Nov 2015

You are not alone. When it comes to your network’s security, your journey from zero to hero follows a predictable, well-developed pattern that is surprisingly standard across most organisations.

That is the opinion of IDC as set out in their ‘IT Security MaturityScape’ position paper and endorsed by Fortinet, a global leader in high-performance cybersecurity solutions.

Five stages of IT security

Ad hoc, opportunistic, repeatable, managed and optimised. These are the five stages of network security.

“As you develop your network,” says Andrew Khan, Fortinet Senior Business Manager at Ingram Micro, New Zealand’s largest distributor of Fortinet’s network security solutions, “your security profile evolves as well. The first stages are typically historical. When your organisation installed their first server and modem years ago, network security wasn’t even an issue. Maybe you installed some anti-virus. Maybe you had guidelines about staff installing third-party executables. This is the ad hoc stage. Your network was vulnerable but it wasn’t a major concern.”

Fast forward a few years and spam, viruses and hackers started to have an impact. “Remember Anna Kournakova and the ‘I Love You’ phishing scams?” asks Khan. “All of a sudden network security received more attention. A memo came down from the boss that asked ‘what are you doing about it? You now had a budget, upper-level support and a mandate. So you developed a policy, upgraded to a firewall and talked to more vendors. This is the opportunistic stage. You’re improving, but still vulnerable.”

Getting better

Now we’re moving quickly. But not as fast as the bad guys. “Security breaches, data loss, blended threats. Once obscure jargon, these terms are now mainstream,” continues Khan. “IT managers are becoming security experts. Or else! You now have a clear understanding of the risks, costs and procedures. Your mission critical applications and data are protected. You have a multi-layered approach. This is the repeatable stage. If the risk is there, you can address it.”

But that’s still not good enough. “It’s not today’s threats that are the biggest risks,” he says, “but the ones that will hit you tomorrow. To protect against these, you need a systematic approach with constant review and updates.

"Your disaster recovery plan has been tested and tested again. You have a ‘sandbox’ for isolating anomalous behaviour and your security vendor is a key player in your team. Network security is ingrained into every activity and practiced by every employee. This is the managed stage. You should be as safe as practicable.”

Security nirvana

You’ll never be 100% secure. No organisation can be. Even the NSA gets caught-out. But you can maximise your security profile.

“When cybersecurity is the highest priority in your organisation, when every staff member follows your explicit security policy to the letter, you monitor network activity at the granular level and your board of directors starts talking about DDS, IDS and realistic budgets, congratulations, you have reached stage five: optimisation. You are ready for anything. You proactively update everything every day. You have a full-time, highly-trained team. And you keep your organisation out of the headlines. This is where your organisation should be.”

“Most enterprises fall into the ‘repeatable’ and ‘managed’ stages,” concludes Khan. The ‘ad hoc’ businesses went bust and the ‘opportunistic’ ones are skating on thin ice. A few are moving into the ‘optimised’ stage. But by and large, most companies have reliable security procedures and solutions in place and are prepared for most attacks. And that is good enough in most cases. But one hack, intruder or data breach can have grave financial implications. So it’s up to you. Is ‘good enough’ cyber security good enough? Is the risk worth it? That’s a judgement call and one that you have to think through very carefully.

“If you want to minimise your risk and optimise your security profile, the resources are there. But you need the motivation, the upper-level support and a coordinated, full-time approach. Anything less is risky business.”

For further information, please contact:

Hugo Hutchinson, Business Development Manager at Ingram Micro
hugo.hutchinson@ingrammicro.com
P: 09-414-0261 | M: 021-245-8276

Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.
IBM X-Force Red & Qualys introduce automated patching
IBM X-Force Red and Qualys are declaring a war on unpatched systems, and they believe automation is the answer.
Micro Focus acquires Interset to improve predictive analytics
Interset utilises user and entity behavioural analytics (UEBA) and machine learning to give security professionals what they need to execute threat detection analysis.
Raising the stakes: McAfee’s predictions for cybersecurity
Security teams and solutions will have to contend with synergistic threats, increasingly backed by artificial intelligence to avoid detection.
Exclusive: Ping Identity on security risk mitigation
“Effective security controls are measured and defined by the direct mitigation of inherent and residual risk.”