Plan to fail for security success
We've all heard the old saying: "If you fail to plan, you're planning to fail." Of course, it's true and from a security viewpoint, it's also interesting to turn the cliché on its head. Shouldn't a major part of any robust IT security strategy be about planning to fail? About preparing for the 'what if' scenarios that can disrupt normal business operations, and attempting to mitigate the potential impact of those disruptions?
A majority of businesses in South Africa already do this to some extent by performing regular vulnerability scans and penetration tests on their networks. But all too often these tests will look only at issues such as vulnerabilities on Internet gateways, systems with out-of-date patches or the presence of malware. They don't include other security problems that are just as capable of causing outages, failures and damage - such as Distributed Denial of Service (DDoS) attacks, phishing attempts and more - which almost always strike at random and unexpectedly.
So how do you widen the scope of your security planning to ensure you've covered all the outage and security scenarios that could have a catastrophic effect on your business?
Monkey business
A few years ago, streaming media company Netflix addressed this specific issue by creating a software tool called Chaos Monkey. Its purpose was simply to randomly target and kill software and server processes, to try to disrupt and cause failure in the company's overall services.
While letting rogue software loose in your main business systems may seem counterintuitive, from a security standpoint it makes sense. After all, wouldn't you want your systems to remain secure when it matters the most: during an actual attack or unexpected outage? It's the random element that provides the toughest test.
Here's a look at how to mitigate the impact of some very common, but unpredictable, security problems.
DDoS denial
Over the past year, we've all seen how almost any organisation, commercial or government, can be the target of a DDoS attack. You may not have been targeted yet, but practical measures that any company can take to protect itself against a future attack include:
Kicking out bots
The Check Point 2013 Security Report found that 63% of organisations worldwide were infected with bots, and more than half of them were being infected with new malware at least once a day. Simple measures such as activating desktop firewalls (usually part of endpoint protection suites), controlling access between network segments, and monitoring firewall traffic for clues will help to stop bots. Companies can also deploy dedicated anti-bot solutions.
The human element
Attackers often look to exploit simple human errors: tricking unsuspecting employees into clicking links in phishing emails to infect their PCs, or inadvertently posting sensitive information to the wrong website. Unfortunately, we're all conditioned to trust others, and it's difficult to change this mindset because employees want to be helpful, and want to feel they are doing their jobs effectively.
Education can play a key role in boosting security, by making staff aware of potential risks and threats, and of how their behaviour can mitigate risks by avoiding phishing emails, fake websites and more. It's worth conducting small tests and training sessions with staff to show how seemingly innocuous actions can lead to a security breach.
Anticipating security failures and taking steps to stop them from happening is a good way to boost your organisation's overall protection. Sometimes, planning for failure can be a truly positive thing.
