Panel discusses top infosec issues

By on

Making security policies effective, patch management, and risk analysis were among the many issues discussed and debated Tuesday by a panel of infosec experts at Infosecurity Europe in London.

Getting employees to follow security policy requires having consequences that hurt them personally if they don't comply, said Jason Creasey, senior product manager at the nonprofit research organization Information Security Forum.

"If they don't follow policy, take their bonus away. Make them look stupid in front of their friends," he said.

A lot of people ignore policies because they don't see how they're relevant to them, said Andy Thompson, head of security services at systems integrator Cap Gemini Ernst & Young.

"They have to be relevant," he said. "If you can give them a free drink, meal, let them go home early - something that means something to them."

On the patching front, panelists had various views. Companies need to be selective with patches, Creasey advised. "You need to do a risk analysis on patches... It's quite dangerous to apply all patches automatically," he said.

Richard Hackworth, head of IT security at HSBC Holdings, agreed that a risk assessment is needed before implementing a patch but said a level of automation in patch management is "fundamental."

With some 250,000 devices connected to the network, 100,000 employees and many mobile workers and contractors at BT, the patching process "has to be a slick process," said Martin Roberts, group security director at the company.

Panelists said risk analysis is a key component to an infosec program.

"If an organization can't identify risk associated with a critical business application, it must be difficult to define the appropriate level of control," Creasey said.

Thompson said anything done in security should be based on a risk analysis that correlates security to the business goals: "It's important for us as security professionals to understand how the business works."

Hackworth said, "Essentially we're managing commercial risk...Security controls will be proportional to the commercial risk."

 

Copyright © SC Magazine, US edition
Tags:

Most Read Articles

You must be a registered member of iTnews to post a comment.
| Register

Poll

How should the costs of Australia's piracy scheme be split?
Rights holders should foot the whole bill
50/50
ISPs should foot the whole bill
Government should chip in a bit
Other
Flash is heading towards its grave, and that's...
Great! Good riddance
Sad! Flash had some good qualities
Irrelevant. I don't care
What's Flash?
View poll archive

Whitepapers from our sponsors

What will the stadium of the future look like?
What will the stadium of the future look like?
New technology adoption is pushing enterprise networks to breaking point
New technology adoption is pushing enterprise networks to breaking point
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
Gartner names IBM a 'Leader' for Disaster Recovery as a Service
The next era of business continuity: Are you ready for an always-on world?
The next era of business continuity: Are you ready for an always-on world?

Log In

Username:
Password:
|  Forgot your password?