Every Organization Needs To Be Thinking About Security

Today, everyone is talking about security.  Just in the last sixty days there has been over 456,000 mentions of cyber attacks and data breaches in news, blogs, forums and Twitter.

It’s easy to get caught up in the daily news cycle that surrounds the security, focusing on either the breach headlines, downed websites, or even the new threats and vulnerabilities that need constant attention and remediation.

However, while people might be talking a lot about security today, it’s also important to keep everything in perspective.  To do that, we also need to take a step back from time to time and ask our colleagues, employees and even ourselves, “are we asking the right questions?”

Are You Asking the Right Questions?

As Albert Einstein is often quoted as saying, “If I had 20 days to solve a problem, I would spend 19 days to define it.” So the first question you need to be asking is, are you asking the right questions? Asking the right questions frames the entire conversation as an inquiry in which stakeholders are coming together to uncover the best solution.

So we put together this comprehensive list of 137 security questions every business leader needs to be asking. This is meant to help guide security discussions in your own organization and it’s based on some of the top security challenges organizations face today and how security intelligence can help protect organizations. We divide these questions into eight sections:

• Security Intelligence
• Fraud
• People
• Data
• Application
• Infrastructure
• Business Partners and Outsourcing
• Threat Intelligence

The Basics: Security Questions To Get You Started

To establish an effective security strategy, you must start with an accurate evaluation of the current information security posture. This set of 137 questions will help guide you towards a comprehensive evaluation of the existing security landscape in relation to industry best practices and regulatory requirements. To identify risks and provide detailed, actionable recommendations for mitigating risks and improving protection.

Before you get deeper into the different set of questions, here are seven questions that will help you assess your security posture and overall picture:

1. What is your biggest security concern and is your security spend and expertise properly allocated to address that risk?
2. Do you have a clear picture of your overall security posture and of how it relates to industry best practices?
3. Do you currently conduct security assessments, such as penetration tests on a bi-annual basis?
4. How realistic is your plan to address the security gaps that you might have today ?
5. Do you have an established process to address computer security breaches?
6. How confident are you of your ability to demonstrate compliance?
7. Given the skills gap that exists in security, do you view the ability to recruit and retain talent and expertise as a top priority?

Security Intelligence

Log Management

1. How many of your IT systems generate logs with relevant security-oriented data today?
2. What percentage of these logs are you actively collecting and monitoring today?
3. Is your process for collecting and storing all of those logs manual or automated?
4. Do you have a single place to correlate, report and real-time monitor across all of these relevant logs today

Security Information and Event Management

1. Do you routinely manage, monitor and/or analyze the collection of logs of user activity, network activity, performance data, application activity, and/or flow data in your infrastructure?
2. What is your process to proactively detect/analyze invalid user access or any anomalies in applications or network traffic in your organization?
3. Is your process for this detection/analysis manual or automated?
4. What kind of response and remediation procedures do you have in place to handle any incidents identified through this analysis?
5. Is the output from this process automatically fed into a single security intelligence console?

Anomaly Detection

1. Do you have a unified collection and analysis technology and process for event, network, vulnerability, asset, and intelligence data?
2. Is this approach capable of contextual and in-depth analysis and correlation across these diverse data sets?
3. Is this process automated, and does it provide response and remediation capabilities?

Fraud

Fraud Detection

1. Do you measure your annual losses from fraudulent business transactions?
2. Do you proactively examine your critical business transactions logs for non-obvious relationships between transactions that often indicate fraudulent activity?
3. Have you implemented a testable and automated control for addressing this process?
4. Do you provide a solution to your customers to help them avoid being victimized by fraud?

People

Directory Management

1. How many definitive sources of identities does your infrastructure have today?
2. Have you standardized on a primary enterprise directory platform?
3. What percentage of those identity sources are actively synchronized to ensure currency?
4. When you are audited, how do you prove what identities are actively defined within your infrastructure?

User Account and Role Management

1. Are you satisfied with the length of time it takes to add new user access to all of their needed systems, on average?
2. The last time you checked, what percentage of your user account population was found to be invalid or ‘orphaned’?
3. Is your process for managing user access provisioning and deprovisioning manual or automated?
4. Are you satisfied with your ability to define users within roles and then leverage those roles to enforce access policy

Single Sign-On and Strong Authentication

1. How many userid/password combinations does your average user have to use daily within their jobs today?
2. What percentage of your help desk calls are for password resets?
3. Is your process for authenticating and resetting passwords manually performed within each system, or automated across the infrastructure?
4. Do you have requirements for multi-factor authentication today, and if so, do you have this capability already deployed?

Fine-Grained Entitlements

1. Are a user’s fine-grained entitlements handled consistently across the organization, such that they can be viewed, audited and modified in a consistent manner ?
2. Are the users’ fine-grained entitlements enforced by application code or by infrastructure services?
3. [This question only applies to organizations with external system interactions] Are the context-aware authorization services that enforce the users’ fine-grained entitlements in internal systems also used for both inbound and outbound requests to/from business partners and cloud/service providers?
4. Are the context-aware authorization services that enforce users’ fine-grained entitlements based on an open standard such as XACML?

Privileged User Management

1. Do you have a concise understanding of all shared service accounts being used in your infrastructure?
2. Do you have a regular process to validate that all shared service accounts, and all users with access to them, are necessary?
3. Are you able to automatically manage the check-out and check-in of shared service account usage, so you’re able to audit exactly who was using a shared account at any given point in time?

Data

Encryption

1. Do you have self encrypting storage?
2. Do you have requirement for encrypting all data at rest?
3. Is your certificate management a manual or automated process
4. Do you use encryption for data leakage protection?

Test Data Masking

1. How many disclosures of sensitive business production data did you have within your test and development environments in the past year?
2. Do you have a documented policy on how to avoid these disclosures and risks?
3. Have you implemented a testable and automated control for enforcing this policy?

Database Activity Monitoring

1. Do you know where all your databases are on the network?
2. Do you know where all your sensitive data resides in your DB infrastructure?
3. Do you know which applications have access to the most sensitive data?
4. Do you know which users have access to the most sensitive data in the DB?

Data Loss Prevention (DLP)

1. Have you defined data loss prevention policies?
2. Do your data loss prevention policies enable you to comply with data privacy regulations?
3. Can you automatically enforce configurable DLP response actions?
4. Is your DLP solution integrated with your broader endpoint management solution?

Data Discovery and Classification

1. Do you know exactly how much data you have, where it is used, and how it is being used?
2. Do you know how much data has not been used in the last year?
3. Does your infrastructure have any single points of failure?
4. Do you know the status of your infrastructure at any given moment?

Key Lifecycle Management

1. Are you aware that there is now an agreed to standard called “Key Management Interoperability Protocol” (KMIP)?
2. How many key management systems do you currently employ?
3. Do you have a plan to centralize key management?

Application

Dynamic Vulnerability Analysis and Testing

1. Do you currently host any web-based or internet facing applications?
2. Do these web applications contain customer data, proprietary information or compliance regulated material?
3. Are you currently performing any penetration tests or dynamic analysis and testing activities?
4. Is your dynamic analysis integrated into your software development lifecycle?
5. Are you scanning third party applications?

Static Source Code Analysis

1. Do you currently run applications, including mobile, that were developed in-house, by an outsourcer or by a partner?
2. Do these applications contain customer data, proprietary information or compliance regulated material?
3. Do you perform any manual or automated source code review for security vulnerabilities?
4. Is source code scanning built into your software development lifecycle?

Real-Time Detection

1. Are you currently collecting event and network telemetry data, such as flows, from your IT infrastructure in real-time?
2. Is this data being analyzed for anomaly or suspicious activity?
3. Is this data being viewed within the context of application vulnerabilities?
4. Have you established a formal process around the investigation and remediation of any detected incidents?

SOA Message Protection

1. Do you protect your backend business service from the front facing client?
2. Do you know where your message is coming from, and how a message is protected against different attacks (e.g. Replay Attack, XML Threat, Confidential and Integrity Protect during transit)?
3. Do you need to enforce company policy on the message?

Infrastructure

Network Protection

1. How many successful intrusions have you had in the last year?
2. With your existing technologies, would you know if you had a successful attempt?
3. What technologies do you use, that could detect such an attack and intrusion?
4. What are you doing to block attacks against Web applications?
5. Are you using your technology to passively detect or actively block attacks?
6. What technology do you use to mitigate SQL injection attacks?

E-mail Protection

1. Does your organization offer end-users functionality to control the email coming into their inbox?
2. What is your process to recover a single e-mail?
3. Is your organization concerned about loss of confidential or proprietary information over email?
4. Does your organization have filters in place to deal with unwanted email such as newsletters, inappropriate content such as pornographic emails or malicious content?
5. Does your organization offer end-users seamless end-to-end email encryption to anyone on the Internet?

Patch Management

1. Is your first-pass patch success rate over 95%?
2. Are you able to use a single solution and console to automatically manage patches for multiple operating systems, including Microsoft Windows, UNIX, Linux and Mac OS, plus smartphones and tablets?
3. Do you have real-time visibility of endpoint compliance against defined policies, such as mandatory patch levels, and can automate and confirm successful remediation?
4. Is your patch management solution integrated with a comprehensive endpoint management solution that includes power management, to enable both patching and energy conservation?

Server Protection

1. Does your server security solution protect both network- and application-based attacks automatically?
2. Does your server security solution give your IT personnel the time they need to test and deploy patches properly while protecting their systems against the vulnerabilities for which the patch was created?
3. Are you confident that you have sufficient protection at the server to repel the many attacks that appear in the news?

Anti-Malware and Anti-Virus

1. Do you have an anti-virus / anti-malware solution deployed on every endpoint?
2. Are you able to verify that antivirus services are installed, running and up to date on all endpoints, and automatically correct out of compliance situations?
3. Is your solution integrated with data loss prevention, device control, and other comprehensive endpoint management capabilities?
4. Do you have a prevention solution to address malware that can avoid traditional anti-virus technology?

Endpoint Management

1. Are you able to quickly identify all of your distributed endpoints (servers, desktops, laptops, smartphones and tablets, plus specialized equipment such as point-of-sale devices, ATMs and self-service kiosks) and check for rogue assets on the network?
2. Do you have real-time visibility of endpoint status and automated compliance reporting?
3. Does your solution provide a closed-loop integrated assessment and automated remediation for patch, configuration, vulnerability, anti-malware, and data loss prevention?
4. Does your solution continually assess the status of the endpoint and ensure the endpoint remains in compliance with organizational policies?

Mobile Device Security and Management

1. Are you able to capture and store detailed mobile device data, including inventory data such as device model and serial number, usage data such as last connection time, and hardware information such as firmware and memory, as well as operating system version, location information, network details, and installed applications and certificates?
2. Are you able to detect rooted or “jailbroken” mobile devices and safeguard enterprise data by enabling complete or selective wipes when devices are lost, stolen or decommissioned?
3. Does your solution help maintain compliance by identifying non-compliant mobile devices and automatically taking corrective actions such as denying email access, deprovisioning profiles or removing VPN access?
4. Does your solution leverage a single infrastructure to deliver unified management and security for all types of enterprise endpoints, including smartp hones, tablets, desktops, laptops and servers?

Rapid Incident Response

1. Are you able to set alarms to quickly identify rogue or misconfigured endpoints and takes steps to locate them for remediation or removal, or identify and quarantine tens of thousands of machines in minutes?
2. In the event of a security incident, can you protect all of your endpoints by distributing necessary forensics or remediation tools to endpoints, regardless of their location or connection type, quickly enough to prevent further intrusion or disruption?
3. Are you able to respond in real-time to zero-day attacks through ad hoc, closed-loop remediation that can target those systems that are affected with specific actions to an exact type of endpoint configuration or user type?
4. Does your solution provide analytics capabilities with insights for hardening the infrastructure against attacks to the network, servers and endpoints?

Virtualization Protection

1. What are you doing to protect your virtual systems?
2. Is the level of security of your virtual systems consistent with that of your physical servers?
3. How are you addressing virtualization specific security risks?

Business Partners and Outsourcing

Business Partners

1. Is there confidential product or process information stored on computers within your network?
2. Could loss of this information compromise one or more of your firm’s competitive advantages?
3. Do you give access to your internal network to important partners such as marketing firms or subcontractors?
4. Do these important partners provide you with professional assessments of their network security?

Outsourcing and Managed Security Services

1. Are you struggling from the high cost to manage your security infrastructure?
2. Have you considered outsourcing the management or monitoring of your security devices?
3. Do you already outsource management or monitoring and would like to investigate other opportunities?
4. Does your Managed Security Service Provider discern legitimate traffic vs malicious traffic?
5. Does your Managed Security Service Provider have it’s own vulnerability research team?

Managed Security Services (Cloud Security Services)

1. Are you struggling with the upfront capital expenditure to purchase and deploy security technologies?
2. Have you considered outsourcing to lower cost of cloud security services?
3. Do you already use cloud security services and are interested in outsourcing others?

Threat Intelligence

Threat Intelligence

1. Are you integrating external threat intelligence into your overall security posture?
2. Is that view comprehensive enough?
3. How do you use IP reputation data as part of your security strategy?
4. What resources does your organization use to make sure they are updated on the latest in threat intelligence?
5. Do you have a process for effectively receiving and sharing threat intelligence with industry peers and government?
6. Are you able to correlate internal activity and events with information from the web?
7. Do you use existing threat models and indicators to profile and identify malicious behavior in your own organization?
8. Do you regularly attend industry conferences such as BlackHat to educate yourself about security research?
9. Is a foundational understanding of publicly available exploit kits part of how you assess your own infrastructure?
10. How easily can intelligence about malware be distributed and acted upon within your infrastructure?