SEC Faculty Advisor

Planning and Preparing for a Possible H1N1 Pandemic

Q.  What is security’s role in planning and preparing for a possible H1N1 pandemic that could impact business continuity?  For instance, should security be involved in decisions regarding possible travel restrictions? What do you think about developing a policy or guideline in the event of a contaminated employee and what are the pros and cons of stockpiling supplies?

A.  The best answer is a company already has in place an established crisis management team, consisting of key company components for critical incident planning and response.  This same crisis team concept is important in developing contingency plans for H1N1.  Joint planning creates an understanding of each department’s area of responsibility, reduces duplication of effort, confusion or conflict and addresses the ongoing situation quickly.  Any H1N1 planning and response must also include input from local and state health departments and information from the Center for Disease Control (CDC)  www.cdc.gov .  Local and state contacts are important since the impact of an outbreak will vary across geographic locations.

As in any crisis planning, security must be an integral partner with other company entities (human resources, medical, operations, legal, etc.,) in planning for a possible H1N1 pandemic.  As a part of the planning team, security can provide advice and guidance on procedures that will have an impact on the protection of company assets (people, property, information and reputation).  Security must be involved in decisions for alternate work environments and/or locations for employees, work from home strategies, increased social distancing in the workplace, restriction or cancellation of non-essential business travel, and possible disruptions while traveling overseas.  Security must have an understanding of human resources, legal, and operational concerns prior to implementing their security procedures.

Prior to travel overseas travelers should be provided with information on what to expect if they are confronted with a suspected pandemic flu situation while in travel status and plans should be in place for the care of business travelers infected while traveling.  The company should have arrangements with their travel department or contract agency on the number of employees in travel status and procedures for conveying important pandemic flu information to them. 

It is important that communication be provided to employees on what to expect if the company and community are impacted by H1N1.  There will be many issues outside the control of the business that may impact operations.  For example, if schools are closed, what impact will this have on the workforce?  If other businesses in the community close will this impact the company’s supplier or customer base, and will employees want to know why their company is not in sync with the community?  With these external conditions influencing the business, the senior security executive should have networking in place with other corporate security executives and their counterparts in the public sector.  Employees must have confidence in the information they are receiving and this can only be accomplished with good coordination between company components and also with outside agencies.  Confusion can be eliminated if company employees have an understanding of company policies and procedures prior to a pandemic.

Since Security needs to maintain its staffing levels and its capability to protect company assets, consider the impact the pandemic may have on security personnel.   Security personnel should be thoroughly briefed on company policies,  personal protection, how to respond to suspected flu cases, and be provided with appropriate protective gear. A good idea is to conduct a tabletop exercise on a pandemic scenario with key members of the team to discuss responding to a pandemic.  This will help to improve the team’s response and also to illuminate any deficiencies in the plan.

Resources:

The following government website is a good resource that contains extensive planning documents, including checklists for businesses as well as individual and family planning guides: www.pandemicflu.gov. 

The decision to stock pile influenza antiviral drugs during a pandemic must be made on a company by company basis.  Guidance in the decision making process can be obtained from:  Considerations for Antiviral Drug Stockpiling by Employers in Preparation for an Influenza Pandemic (www.flu.gov/vaccine/antiviral_employers.html).

Security can obtain information from the Overseas Security Advisory Council (OSAC) http://www.osac.gov/  or the CDC travel website www.cdc.gov/travel on overseas travel situations. 

Answer provided by Rad Jones, Security Executive Council Emeritus Faculty.

Unified Risk Management

Q. Why should I care about all this talk about convergence?

A. In today’s complex global economy, CEOs have a fiduciary responsibility to shareholders to ensure that a unified risk management process is established.  Risk is oblivious to organizational boundaries and transcends the organization both internally and externally. Critical business processes that were traditionally controlled internally are commonly now reliant on third party suppliers that may be in some far flung corner of the globe.  A single point of accountability and leadership responsible for assessing, monitoring and recommending mitigation for the entire portfolio of risks the business enterprise faces is vital to the survivability of the entire entity.  The security executive is the natural strategic leader for this effort, since they normally head the effort to collect and analyze intelligence on the broad range of risks the corporation faces globally and commonly are responsible for oversight of business continuity planning and crisis management.

While the term convergence has been utilized primarily in the context of merging the narrow bands of physical security and information systems security, it must go much further than that.  Without accountability being truly converged, the security executive is left blinded to the totality of the broad issues that potentially impact the viability of the entire business enterprise. Convergence must be redefined to move beyond including these narrow bands into ensuring that all interdependent elements of the business assurance program are integrated. The business assurance program must address the safeguarding of all business enterprise processes, assets, resources and people wherever they are situated around the world. Failure to effectively address business assurance through a unified risk management process results in creating unacceptable levels of legal and regulatory exposure for the business enterprise.

Answer provided by Lynn Mattice, Security Executive Council’s Chairman of the Board of Advisors

Enterprise-Wide Collaboration to Minimize Impact of Activist Events

Q. One of my areas of responsibility is developing an action plan for dealing with activists groups.  With the intent of minimizing the risks that these groups could potentially pose with regard to disruption, can you give me some pointers on evaluating and disseminating strategies that would minimize disruption and promote a safe environment during this type of activity or event?  From an information security standpoint, what are the potential risks of monitoring these groups on the Internet?

A. Consider classifying potential activists as “groups or individuals with interest.” Agendas may vary from influencing your organization to stopping it in its tracks. Tactics can range from socially acceptable civil intercourse to criminal intimidation. It is important to approach any potential contest objectively. Any issue that rises to the interest of a public forum should demonstrate principled conduct that is informed by your organizational mission and values.

Activist entities often consider themselves as “change agents.” Their appeal for an audience will cover a wide range of potential stakeholders from your customers, employees, management and the Board of Directors. Typically activists demand action based on perceived moral or ethical grounds. Demands for action, including amending or abandoning existing processes, may be outlined based on fact, misinformation or a combination of both.

Anticipate a public relations opportunity by assessing the demand with a cross-functional team comprised of communications, legal, operational and security representatives. Drafting a position document that analyzes the activist group’s request for change on merit puts management on the same page. Communications may be privileged. Risks and benefits should be surmised for options. Security's role is commonly diligence and risk mitigation.

Do Your Homework:

1. Assess the demand. Consult with law enforcement if demands are perceived as criminal threats implying harm to individuals, assets, business dependent processes or reputation. In the United States interstate restraint of trade will typically be in the domain of the Federal Bureau of Investigation. Collect all communications from or to the group or individual, including customer service contacts.

2. Assess the group. Groups and individuals that have an interest in your organization typically have a history. The Internet has a wealth of resource material from organizational and personal site listings replete with photos, friends and associates. Caution should be exercised by only employing an ethical, licensed and insured investigative entity that can gather legal information without attribution. Proprietary investigators may undertake the same objective course of action. Site interest translates to encouraging rather than discouraging interested parties. Searches of subjects including suit, arrest, disruption, protest, harassment or trespass may yield a quantity of publicly available information. Stakeholders should refrain from investigating groups or individuals of interest within the organization's IT network.

3. Attempt to follow activists’ communications and action solicitations. Action planning by adversarial groups is often a membership draw for similarly inclined individuals. Meetings sometimes outline tactics for business disruptions ranging from boycott action to pamphleteering and street theater including provocation of management representatives or law enforcement for arrest publicity.

4. Consult peer organizations and law enforcement for factual intelligence that may not be publicly available. Benchmark the experience of other organizations including best practices. Risk mitigation tactics will be formed by event history. For instance, action history may range from inundating the head office with pre-paid customer comment cards to denial of service attacks on servers and telecommunications. Operational disruptions can include impeding opening and closing offices by malicious destruction (from window smashing to graffiti message tagging and intimidation of personnel) to “street theater” that precludes service offerings.

5. Design or revisit existing countermeasures that address the known risks. Access control and exceptional suspicion or risk reporting are valuable capabilities. Increased preventive patrol by security services or local law enforcement is recommended before, during and after planned events. Public meeting precautions may include counter-surveillance and credential, bag and coat checks. Management briefs on potential conflict issues and countermeasures should include meeting decorum requirements to allow dissenters to civilly express a view, the company’s preparation to address it on point and advise the person of follow-up. Contingencies to have personnel close by to take an issue off-line, warn for trespass or lawfully remove obstructionists under the color of authority are recommended.  Public microphones and address systems should be secured to prevent misuse. First responder personnel may be pre-staged to assure medical and public safety intervention if required.

6. Apprise potentially affected personnel of threats with relevant precautionary security measures. Brief need-to–know information to stakeholders on the range of action employed by known groups. Personal and family security of key personnel including board members may be advisable with the ready availability of household information. Mail, package and service delivery security scrutiny at the office and home may be required with the usual access control capabilities. Protective personnel for public engagements may be considered to ensure uninterrupted transportation and avoidance of public embarrassment or injury. Coordinate public and private investigative resources and countermeasures that will document any criminal action for prosecutorial accountability.

7. Don't assume that groups or individuals with interest are unsupported by your stakeholders. Adversaries of record may also be your shareholders. Inaction for responding to unreasonable demands may allow groups with interest to frame the issue. Interests from animal welfare to environmental and other perceived social responsibilities may be shared by clients, employees and other stakeholders. Relevant communications must be above board, factual and tempered for unintended disclosure to the public. Authorized use and dissemination of information should be clearly embedded in policy with known accountabilities for violations.

8. Do not act unilaterally without cross-functional consultation. Ethical organizations cannot afford the appearance of an overzealous security group. Your service level agreement should automatically enable precautionary diligence and security risk mitigation reminders that reasonably protect people, assets and dependent processes.

Bottom line, coming together before an event to identify roles and responsibilities will serve your organization well.

Answer provided by Francis D’Addario, Security Executive Council Member Board of Advisors.  Sign up for notification when his new book, "Not A Moment To Lose... Influencing Global Security One Community at a Time," is available to purchase at https://www.securityexecutivecouncil.com/sec/fdbook/

Mitigating Risks During Mergers and Acquisitions

Q. I am the Chief Information Security Officer at a company that is acquiring a major competitor under hostile conditions.  There is clearly a lot of animosity on the part of the management and employees and, therefore, many concerns about the likelihood of damage to systems and information.  What security controls would you recommend we put into place at this point – and later – to mitigate the potential for damage during the due diligence phase prior to the acquisition, as well as afterwards?

A. This is a good question and one that should be taken into account on every acquisition because while most of management and employees will seem congenial, there is always some uneasiness and even animosity. One has to keep in mind that a change is occurring to the people within the acquired company. They are questioning what their role will be, will they even have a role and for how long? That in its self creates a lot of tension for both parties. When assessing the situation as to what controls should be implemented there are a couple of questions that need to be answered:

First, what are the actual threats and to what?

• Is there threat of data/information exposure to external sources?
• Is there threat that the acquired company will sabotage their own systems?
• Is there threat that the acquired company will sabotage the acquiring company systems once connected?

Secondly, which related controls you put in place are dependent on what phase the due diligence process is in? Meaning, is the due diligence process in place to determine if the acquiring company still wants to acquire, or the company has been acquired and the due diligence is for the integration of IT?

The controls you put in place will be dependent on these answers and will determine what authority you have to implement required controls and when. In essence, the controls you normally use to protect information within your company are the same ones needed for mergers and acquisitions (M&A). The only difference is the controls during a M&A should be stricter and more enforced. My position has always been to treat, manage and control every acquisition in the same consistent manner (i.e., tighter controls at first and then loosened as the threats are mitigated), because you never know what will happen. This translates to: control changes to the infrastructure, modify authentication/authorization to systems and implement monitoring capabilities to validate what is going on.

One key point I have not touched on is the business approval of recommended controls. To truly be successful, the business must approve the controls you intend to implement. The business needs to be informed and educated as to what impact these controls will have on the productivity and how they will assist them. Always remember that while the business has concerns about risk, their first priority is making money; they need to be onboard with what controls you plan to implement. Once you have the authority to move forward you generally want to place a freeze on changes and ensure that there is a good change management process in place to account for any alterations during the integration. Additionally, given the ability to do so, implement monitoring technologies to flag unapproved activity and/or changes to the infrastructure. Both controls of change management and monitoring are ones you, as the acquiring company, will want and need to manage. Additional controls that should be incorporated are:

• Identify/secure all critical systems
• Identify/secure all critical data/information
• Identify/secure key employees
• Modify access for critical identified systems to only those who need it, to also include someone from acquiring company.

This way you have a clear picture as to who has the ability to modify systems and, therefore, who to hold accountable. While some of this may sound harsh and distrustful, reality is, it is vital to success, as you are most likely being held accountable for the secure and uninterrupted integration of this new business.

In summary, the most important controls to put in place as soon as permitted are change management, access control and monitoring to ensure all processes are being followed appropriately. Other than that, the only other option is to take full control of the systems, but this has major ramifications on both parties. Integration of M&As are challenging tasks and no two are the same. This is why it is important to establish a solid foundational approach with consistent controls to be used for all of them.

Answered provided by: David A. Meunier, CISSP, HISP – Security Executive Council Content Expert Faculty

Potential Security Risks for Overseas Operations

Q.  The United States is China’s largest trade partner, followed by India. Bilateral trade between China and India has grown tremendously, which presents many trade and investment opportunities with these two countries.  However, with opportunity comes many risks, such as economic espionage.   What steps do you recommend that I take to mitigate some of these potential risks from a counterintelligence standpoint?

A. The most important thing for companies to remember when dealing with China is that they are dealing with a communist country.  China has an ever growing problem of employment of the masses.  Peasants from the interior are streaming into the cities along the East Coast, where the majority of all business takes place.

China’s stated goal is to become the next economic super power in the global economy.   Chinese government agents and Chinese nationals loyal to their homeland have embarked on one of the most aggressive programs of economic espionage ever witnessed.   Business in China is generally run by the government.  While some entrepreneurial activity is emerging, rest assured it is closely monitored - if not totally controlled - by the government.  All communications in and out of the country are monitored.  If a company has operations in China and that site is directly linked into their corporate computer networks, they can be assured that they are being exploited.  Any communications in and out of China should be considered compromised and corporate systems or databases connected to those networks have probably already been hacked and copied.   China historically has paid little attention to intellectual property rights. The safest method of doing business in China is to only sell products and services there, and only those that have been patented in China or registered for copyright or trademark protection. Even with these preemptive measures, counterfeiting and reverse engineering will still be rampant.  Chinese issued patents, copyrights and trademarks will ultimately become more important in China and they currently offer the only hope of gaining any IP protection . The myth of low cost manufacturing being outsourced to China will, I believe, become the most expensive mistake made by American businesses in decades.
 
Merger, acquisition and joint venture due diligence is extremely difficult in China and almost always produces flawed or insufficient data to make an accurate and informed decision.  Background investigations are nearly impossible to conduct on individuals you choose to employ or contract with and corruption is still rampant, despite periodic crack downs by the government.

India has a population of nearly 1.5 billion people, with a rapidly growing middle class.  Consumption is heating up and the demand for consumer goods is on fire.  These conditions create an attractive market for foreign companies to exploit, but Indian nationals are focused on sustained economic advantage for Indian suppliers.

India is different from China in the sense that economic espionage is not primarily being run by the government.  However, the Indian government does monitor and copy communications and will not hesitate to provide economic intelligence or your trade secrets to Indian companies.  India is more of a free market environment, however, and there is much more innovation taking place.  Counterfeiting and reverse engineering is still a major threat there, however.  While India has very strong intellectual property laws, there is little enforcement action.  This is a rapidly growing economy with somewhat of a "wild west" mentality - anything goes.    Due diligence and background investigations are somewhat more reliable, but still difficult to conduct effectively.  The level of corruption in India makes the environment one that is fraught with potential exposure to illegal activities, especially for U.S. based companies.  Like China, expect that any network connected to India has been exploited.  Companies doing business in India need to be very cautious about whom they do business with and then monitor everything very closely.
 
Sound business practices would include setting up both India and China operations in stand alone networks with strong firewalls in between other corporate systems.

Companies need to be aware of the fact that any products sent to either of these markets are likely to be reverse engineered and then produced by local entities as either competing products under a local label or direct knock off counterfeits.

Answer provided by Lynn Mattice, Security Executive Council Content Expert Faculty

Workplace Violence Policy Template

Q. I’m looking for a template to assist with developing a good, comprehensive workplace violence policy that is easily communicated to a large frontline populations.  Do you have any recommendations?

A. Great question.  Before we answer, I have a few questions for you to consider.  First, is your company policy-driven and will managers and supervisors know what to do with this policy?  And are they likely to use it in the format you choose?  Often companies issue policies to clarify an issue and end up not enforcing it. 

Is your company willing to enforce a policy uniformly in all divisions and at all levels?  A workplace violence policy can be more dangerous from a liability and corporate reputation standpoint than having no policy at all if you’re not willing or able to enforce it consistently.  For example, are you willing to go to court and testify that this policy has been made available to every employee at every level and the company consistently lives by it, no matter who is involved?  Even if it’s an executive officer or your best sales manager, or their family member who is violating the policy?  If the answer is no, you may want to consider guidelines, processes, procedures or something other than a policy.

There is no one agreed upon policy that would work for every company.  When forming your own policy there are some things to consider.  The terminology must be very clear.  There is no room for vagueness.  Consider how you will communicate and consistently enforce rules regarding threatening behavior, intimidation, bullying, harassment and other acts such as assaults. 

How will your policy specifically state and consistently enforce company rules of intolerance for certain behavior from employees and visitors, such as vendors, clients, family members and friends.   How will you deal with anyone who violates the policy?  Consider stating that they will be removed form the premises immediately and not allowed to return pending an investigation.  Consistently discipline or terminate any employee who behaves inappropriately or makes a threat.  Others should be barred from the premises and prosecuted to the fullest extent of the law if investigation determines that their behavior has jeopardized the safety of the employees or the workplace. 

Any behaviors that you state as intolerable must be clearly understood by the lay person and described in terms that are perceived equally by every employee.  Behavior that might be considered appropriate in a warehouse or on a loading dock, often referred to as “shop talk,” may be viewed differently at headquarters. Be sure to describe these differences adequately.  Or, you may state that “shop talk” or “horseplay” will not be tolerated but only if you can consistently enforce it uniformly across all areas.

Pay attention to issues involving domestic or partner violence against or perpetrated by an employee and be prepared to recommend sources of support for the affected employee and to deal appropriately with the offender.  This may include consulting with Legal counsel and obtaining a corporate restraining order.

I recommend that you plan ahead and train your managers and employees about response options.  Assess your access control procedures and physical security risks and coordinate with local law enforcement and other external sources of support. Plan ahead and state who will be notified, who will respond, what training is needed to communicate this, who has to review it to make sure everyone is comfortable with it; then ensure that it is incorporated into each department’s procedures.

Answer provided by Rosalind Jackson, Production Manager for the Security Executive Council. Ms. Jackson has been involved with workplace violence prevention and employee safety for 11 years.

Personnel and Executive Protection Program

Q.  I recently joined my company as CSO.  Personnel and executive protection is one of the areas where I see a dire need for improvement.  Historically, the personnel protection program has essentially been a babysitting and hobnobbing service for executives, with little emphasis on core risk assessments and preventive measures.  What advice can you give me on where to start the turn-around process for creating an effective program to protect personnel?

A.  Some organizations have a tendency to focus on executive protection at the expense of "all personnel protection" (employees, vendors, contractors, visitors and guests).  This is not to say executive protection is not important as your executives are probably high profile and receive the most attention for negative occurrences (real or perceived).  However, corporate liability receives unnecessary exposure when there is not consistent application of personnel security policies.  Consistency of application also applies from facility to facility within a corporation.  I recommend you have discussions with the legal department prior to final approval and implementation of a corporate personnel protection policy.

It appears the best place to start is with the "basics" of personnel (executives, employees, contractors, visitors and customers) protection.  A key consideration is your authority and responsibility beginning at your property line.  Anything beyond that can lead to unnecessary liability exposure and questions of consistent application of security resources.  The easiest and most efficient way to protect personnel is through a well thought out access control policy and procedure.  This may include utilization of electronic and personnel resources such as CCTV, an access control system, security officers, photo ID badge requirements, visitors ID badges and an escort policy or a combination of the above.  The definitions of these resources are very broad in nature and will require implementation to "blend" with your corporate culture.  Partnering with others in your corporation (e.g., legal department and the people you are protecting) is absolutely necessary to achieve long term success.  I recommend you conduct a study/assessment of your current access routes, current controls and potential methods to reduce the number of usable entrances to a minimum.

Secondly, I recommend you assess the locations within your facility where the threat to personnel may be the greatest.  This threat assessment should go beyond "personnel" protection issues and look at "business considerations," such as business interruption, integrity of brand name, etc.  Planning may include internal usage of electronic and/or security personnel.

Thirdly, I recommend you understand that you can plan, implement, train and operate your security protection system the right way and "bad" things can still happen.  Therefore, I recommend you prepare a well thought out response plan.  Again, this will require "partnering" with other disciplines within your corporation.  It will also require extensive training of your security personnel, as well as timely table top and/or real time training exercises for your security personnel.

Lastly, I recommend you review and revise (as necessary) this personnel security plan at least annually.  Circumstances and personnel change and your security plan must be flexible.

Keep in mind the above thoughts are very basic in nature.  There is no "cookie cutter" plan you can implement.  Any security plan, to be successful, must be tailored to your corporation and a specific location or facility.

Answer supplied by Randy Uzzell, Security Executive Council Emeritus Faculty

Workplace Safety During Staffing Adjustments

Q.  My company has had several reductions in force over the past few months and plans to make significant announcements over the next few weeks and months.  Employees are nervous, rumors are rampant and there is an air of uncertainty all around.  As the senior security executive, what proactive measures should I take to help weather the inevitable storm when people who have worked here for many years learn that they will no longer have a job?  How can we ease the tension and give these employees some hope of moving forward?

A.  Workforce adjustments bring about change in the lives of employees.  While most will be able to cope with the change, some may not.  What will the stress of losing this job mean to the employee and what reactions can be expected? How will those reactions affect the rest of the workforce?  You must recognize and respond effectively to the kinds of behavior that raise concerns about the well-being of employees and the safety and security of the workplace.

A key point is to know that while the situation will be stressful for all, it is certain to be debilitating for some (at least initially); not only from a financial standpoint, but self-identity, social network and self-esteem are also impacted.  Some may become defensive and/or challenging. 

When meeting with affected employees, managers should stay calm, stick to facts and not get caught up in the emotion or allow the point of the meeting to be sidetracked.   Monitor your nonverbal communication and be aware of body language (both yours and the employee’s), personal space and how you say what you say. Schedule the meeting as early in the week as possible, giving the affected employee an opportunity to start to contact other potential employees, rather than brood over the weekend.

Plan ahead and watch for people who may need special attention such as any employees who have a history of acting out.  Managers should have an exit route and backup available if needed.  Identify potentially aggressive individuals in advance.  Some may be impulsive and react at the spur of the moment while others may be compulsive and react only after obsessing and stewing over the bad news.  An impulsive reaction occurs as a result of momentary impulse and is committed without much or any thought.  Individuals displaying this reaction often have poor impulse control and may become verbally abusive or physically assaultive in the heat of the moment.  On the other hand, a compulsive reaction may occur after much forethought and planning.  This type of individual is more dangerous and may tend to hold anger in and eventually take revenge in a more lethal way. 

Watch for warning signs such as, for example, disruptive, threatening, belligerent, or confrontational behavior.  Some may become depressed, dejected, uncooperative, moody, or display other inappropriate behaviors.  Be prepared to deal with both types.
The way managers respond will depend on the employee and the situation. Typically, troubled employees often need and can benefit greatly from the support services of an Employee Assistance Provider.  If a situation occurs that could potentially put the workplace in danger, the risk of inappropriate behavior may be higher and you should be prepared to handle the situation appropriately.

Train managers to respect the dignity and privacy of the employee and listen carefully and respond appropriately.  Minimize stress and hassles as much as possible. Offer as much continuing support as feasible in the form of severance, COBRA, EAP or outplacement, etc., and have this information in writing to give to the employee during the termination meeting. 

Finally, understand that organizational changes or layoffs may also involve other people, such as spouses, family members, friends and acquaintances, so there may be more than just the employee’s problems or concerns to be aware of or concerned about.

Answer provided by Rosalind Jackson, Production Manager for the Security Executive Council. Ms. Jackson has been involved with workplace violence prevention and employee safety for 11 years.

Web 2.0 and Business Risks

Q. What is your perception of the risks of Web 2.0 and what businesses should consider before deploying Web 2.0 applications?

A. The risks with using Web 2.0 are really not new (i.e., there is still the risk of data loss, breaches, identity theft, fraud, system compromise and so on), although they are certainly magnified by the capabilities of web 2.0 type applications. Simply put, the main security concern with Web 2.0 is how it broadens the threat/vulnerability spectrum. In essence, it creates more avenues for hackers to exploit and more avenues for internal personnel to send out information that could compromise the business. The technology (tools) used for protecting current threats are no longer efficient in protecting Web 2.0. In the past there was more concerned with the incoming threat via web downloads and email attachments. Today there is the concern with the bi-directional threats (incoming and outgoing) brought on by web 2.0 applications. With the introduction of blogs, feedback sites, chat and social applications like MySpace and YouTube, there is now the capability to provide (or push) data back to the business.

While Web 2.0 type services are beneficial to both companies and customers, the capabilities open up additional paths into the core network and create additional exposures. These are the very same paths for which wrong-doers can utilize to launch attacks. Think of traditional protection methods used years ago in the analogy of a “moat and castle” situation where there was one point of entry to guard your core. This single point of entry provided a better chance to defend the core network because all traffic funneled through it. Today it is a “shopping mall” situation; there is no longer a single point of entry to channel traffic through, there are now many doors to enter or exit from. This new landscape dramatically changes the approach in how to guard information. These new capabilities provide very easy methods to move data/information uncontrolled and undetected without the proper solutions in place.

Thus, the best method towards securing your infrastructure against current and evolving threats starts with one consistent approach, an information risk assessment process. This process enables you to:
• Understand what the threats and risks are with pursuing new initiatives
• Enables the prioritization of critical risks to reduce risks in the most beneficial way to the company
• Assists in determining the appropriate tools (e.g., data leakage, network access control, unified threat management (UTM), intrusion prevention systems, encryption, etc. ) needed to implement solutions that reduce these risks

With the advancement in technology and its expanding use comes the increase in threats and the increase in threats raises the level of risk. When considering web 2.0 initiatives or whatever the next phase is, you continually need to rethink your approach, because as the threats change, so to must the way we protect against them. The key to success is implementing an information risk management methodology and conducting information risk assessments. This ensures a holistic picture. There is no silver bullet solution. Good sustainable risk mitigation requires a risk management approach incorporating, policy, risk assessment, standards, monitoring, people, processes and technology to successfully implement sustainable “defense–in-depth” solutions.

Answer provided by David A. Meunier, Security Executive Council Content Expert Faculty