Developing an Effective Security Program

1
Developing an Effective Security Program

• Why do we need one, Control Categories, Physical
  Security Controls, Automated Controls

2
A Few Reasons Why an Effective Security Program
is Important

• Companies could be losing 250 Billion annually
  to information thieves (ASIS 1997)
• The single greatest threat to corporate
  intellectual property is trusted insiders former
  employees are not far behind
• Theft of trade secrets is one of the most serious
  threats facing business today 42 million worth
  of trade secrets were stolen from 64
  organizations.
• Credit Card Fraud is a multi-billion dollar
  problem impacting many companies
• Hackers continue to be a threat and there motives
  are becoming more serious.

3
SECURITY CONTROL CATEGORIES

• PREVENTIVE
• DETECTIVE
• CORRECTIVE

4
Five Ingredients of a Security Program

• Complete and Comprehensive Security Policy
• Security Training Awareness Backed Up by
  Non-Disclosure and Other Signed Docs
• An Effective Physical Security Program
• Effective Electronic Security Controls/Tools
• An Effective Contingency and Reaction Plan
• An Empowered Security/Audit Organization
  Reporting to the Appropriate Level in the
  Organization

5
EXAMPLES OF PHYSICAL SECURITY CONTROLS

• Guard Services
• Physical Access Systems - LOCKS
• Hazardous Material Protection Gear
• Landscaping Provisions Designed to Protect
  Buildings (Mounds, Trees, etc.)
• Building Fortification (Bullet Proof Glass,
  Window Guards, etc.)
• Emergency Drills
• Cameras
• UPS (Uninterruptible Power Sources) Systems

6
Your Electronic Toolbox

• Telecommunications Security (Encryption, etal)
• Electronic Badges/Access Control Devices
• Access Control Facilities (which Protect Files,
  Track Access, Control Passwords, etc.)
• Back-Up Servers
• Pattern Recognition Systems (Experian, American
  Express, etc.)

7
Your Electronic Toolbox continued

• Back-Up Facilities (Off-Site or On-Site)
• Firewalls/Gateways
• Virus Protection Software
• Biometric Controls (Face, Iris, Fingerprint, Hand
  Matrix, DNA)
• Sensors (Heat, Light, Motion)

8
Bulldog Jewelers

• A firewall protects the host system but does not
  protect information in transit.
• If I can get someones SSN, I can order
  merchandise and have it sent to any address that
  I please. The system does not do enough
  validation/authentication. (credit card, address)
• Mail thieves can easily identify a package
  containing jewelry from Bulldog Jewelers.