Home > Cover Story

Security for the enterprise
By Shubha Murthy

Data and network security is a high concern area for the connected enterprise. Here is a peek into various aspects concerning security including issues about implementing a security policy

Enough has been said about the fact that it is information, the magic wand that augurs success to businesses in the e-economy. But as the saying goes, greater the wealth of information generated and accumulated by a business, the more insecure the CIOs and IS mangers become about safeguarding it. In this scenario protecting all of this data, most of which is mission critical and proprietary from leaking out, is what is giving CIOs and IS managers sleepless nights.

Businesses, as they are metamorphosing from a brick and mortar model to one that is a synergy of online and offline processes, are generating huge amounts of data from the various domains of interaction such as with employees, partners, suppliers (B2B) and customers (B2C). Consequently, the distinction between the private and the public network is fast collapsing, making an enterprise network, be it an intranet or extranet or a VPN, susceptible to intrusion more than ever. All this points to one fact enterprises can no longer be complacent about security issues.

A recent KPMG fraud survey found that 17 percent of the Indian companies surveyed had experienced some kind of security breach, including system crash, website defacement and virus attacks.

Even as enterprises are waking up to the reality of loopholes in their security policies, the Gartner Group predicts worldwide information security market to reach $13.1 billion by the end 2001. V Pradeepan, technology consultant, security, Select Technologies, Bangalore, substantiates this when he says, "Awareness of network security is spreading like wild fire. It is being addressed as the top priority in enterprises."

Though awareness is spreading, "Indian corporates are still confused when it comes to applying security solution. Each security solution needs to be customized to a company's existing network and specific requirements," points out Swapan Johri, GM, emerging services, HCL Coment, New Delhi.

He adds, "As a result, security has become more of a reactive solution-based plan to overcome problems rather than a consistent plan to monitor and analyze vulnerabilities."

Levels of network security
Building a virtual fort around a company's network to insulate it from unauthorized and illegal intrusion has become the prerogative of CIOs and IT managers in all enterprises, big or small.

Security infrastructure deployment is no longer a one-time affair. Even as data networks are expanding, so are newer security loopholes being discovered. Therefore, what is of critical importance apart from deploying security solutions and policies, is conducting regular audits and penetration tests on the network and management of all the above by skilled personnel. Since this is an onerous and expensive task to achieve in-house, several enterprises, particularly from the mid-market segment are outsourcing these services to Managed Service Providers (MSPs).

An enterprise has to be monitored for breaches and intrusions at various levels such as access, server and per user. However, security is not just network security. As Milind V Dikshit, practice head, security consulting, Bangalore Labs, Bangalore points out, "An organization has to be secure at all layers network, operating systems, applications and databases.

Besides the practices and processes also need to be necessarily looked into."

In other words, the various levels of network security that an organization has to be careful about are directly related to the various levels of threat that an organization must guard against.

However, securing a network from external threats alone is not sufficient. M Srinivasa Rao, general manager, operations, Network Solutions Ltd, Bangalore explains, "A strong security with a firewall doesn't mean that internal host security is no longer needed on the contrary, most successful attacks come from insiders!"

Vishwajeet Deshmukh, country head, Network Associates, Mumbai, warns that 70 percent of security breaches occur internally from disgruntled employees. "Hence a firewall at the perimeter cannot take care of internal threats to information security," he adds.

Firewalls for perimeter security
Though firewalls can be termed as the first step towards network security, as Girish Karanth, systems consultant, Sun Microsystems, Bangalore, avers, "Security needs to be approached as a building block vital to the success of the enterprise and needs to be architected as such and firewalls are an integral part of this architecture."

Firewalls offer security at the perimeter of a network either as a remote access server, or inside the intranet to segregate departments or are deployed on an existing application or data server to control access and provide encryption services.

Firewalls provide stateful inspection of packets that maintains a session table for each connection and for each protocol type.

Since this happens between the data link and the Network layers, all processing happens in the operating system kernel, which makes such transactions faster than other kinds of firewalls such as packet filtering firewalls (routers) and application layer firewalls (proxies).

Key security threats an enterprise should look for

Courtesy: Cisco

Hardware Vs Software Firewalls
While the primary difference between hardware and software-based firewalls is dependent on the kind of operating systems they run on, both are equally secure if the network design and configuration are impeccable. "While software based firewalls, are secure enough if the operating system they run on are fine-tuned to plug all the vulnerabilities," points out Srinivasa Rao of Network Solutions, "hardware firewalls are built specifically for the purpose of 'firewalling', and hence, they do seem to have an edge over software based firewalls."

A hardware firewall is sturdier in its ability to support more number of connections simultaneously as compared to a software firewall, but is more difficult to manage. Since hardware based firewall devices run on proprietary operating systems, they do not carry the vulnerabilities of software firewalls, which run on general-purpose operating systems such as Unix and Windows NT. "Here even if the firewall software is secure, the underlying security holes in the operating system can allow a hacker into a protected network," explains SV Ramana, vice president, systems engineering, Cisco India, New Delhi.

As Dikshit from Bangalore Labs informs the number of attacks through software-based firewalls is five times more than hardware-based firewalls, which use proprietary integrated software.

Need for a Comprehensive Security Policy
The disadvantages of firewalls do not lie so much with the products per se but with the fact that still a lot of enterprises believe that by deploying a firewall, they have built an impenetrable iron grid around their network. However, what many IS managers fail to realize is that firewalls are only one of the many important components that go into making an enterprise's security infrastructure. Yet it is the most expensive security component. As Binod Kumar Panda, country manager, Apara Enterprise Solutions Pvt. Ltd., Bangalore, says, "Firewalls are the biggest piece of investment any company makes on the security front." A single firewall implementation could cost anything between Rs. 50, 000 to 15 lakhs.

Firewalls, besides securing a network, also help an enterprise implement an access control policy. "Information security plans, and their associated policies, are a crucial part of the planning effort," explains Ramana of Cisco

This brings us to security policies, a set of comprehensive guidelines to ensure that corporate networks or servers are protected against the latest security loopholes.

The following segments are increasingly looking at firewalls as a security solution:

Typically, a security policy involves the following modules:

Disaster recovery planning and elaborate information access schemes that determine who can view particular files or types of data are also included in more sophisticated policies.

Says Ramana of Cisco, "In addition to access control, an Internet firewall provides a natural focal point for the administration of other network security measures." A firewall also monitors all traffic entering and leaving the private network, and alerts the IT staff about any attempts to circumvent security or patterns of inappropriate use.

Network Address Translation (NAT), a service that re-addresses data packets as they pass the firewall, is another important function it performs. "This not only simplifies address management by allowing a single external address to be used for all internal users; it masks the true addresses of internal computers and servers from prying eyes outside," adds Ramana of Cisco.

Thus the functioning of any security hardware or software is impingent on the policy that is chalked out and its effectiveness in the real world application. Dikshit of Bangalore Labs points out, "The firewall is as secure as the host on which it resides and the policy applied on it."

If the policy is designed and applied appropriately it will provide a list of accessible hosts, devices and specific services allowed both inward and outward.

Besides, clarity and transparency are also vital to a security policy. An enterprise should put in writing exactly what measures are currently in place and what information assets they are meant to protect. All users of organizational computer systems should be aware of any guidelines established for passwords (and sharing them), transfer of data between computers, using anti-virus software, and encrypting correspondence, along with any other controls that are imposed on individual computer use.

"Policies involving the use and misuse of passwords and user accounts have to be strictly enforced. These are management issues that should be raised during the planning of any security policy and cannot be solved with firewalls alone," explains Johri of HCL Comnet.

Speaking about effective application of policies, Ramana of Cisco says, "IT departments should work with the company's human resources departments to develop policies that define these behaviors specifically and also define the consequences of deviating from them."

Advantages of Firewall l Implement access policy and permission/restriction rules between two networks. l Stop confidential information from leaving the network and attackers from entering. l Provides detailed statistics on communication between networks (who uses what service and how often). l Provides logging and audit trail of communications; analysis of logs can be used to detect attacks and generate alarms. l Reduces risk of attacks from curious and malicious hackers, commercial espionage, accidental disclosure of company data (i.e. customer, employee and corporate data) and denial-of-service attacks. Disadvantages l Firewalls are not very effective against viruses. There are too many ways of encoding binary files for transfer over networks, and too many different architectures and viruses to try to search for them. l Trusted users/disgruntled employees who intend to affect the organization's productivity and who do not pass through the firewall itself. l Cannot protect data traffic that does not pass through the firewall. l Cannot prevent individual users with modems from dialing into or out of the network. l The firewall may not able to handle threats that can arise by misusing new technologies like Java applets, Microsoft's ActiveX, etc.

Security for everyone
Initially it was the larger organizations that deployed firewalls as part of their security initiatives. Two or three years ago, the cost factor, the complexity of installation and the need for dedicated and skilled personnel deterred small and medium sized enterprises from installing firewalls. Besides, SMEs went about networking individual departments, which remained isolated, and hence the need to share data digitally was minimal.

But the scene is changing now. With SMEs Web-enabling their businesses, intra and extra connectivity has become the order of the day.

Karanth of Sun Microsystems reiterates this when he says, "There is this mindset that firewall deployments tend to be very complex, expensive and time consuming. But there has been a change, with more and more companies realizing the benefits of doing business on the Net and being a part of a supplier/vendor network or extended intranets being hosted by larger enterprises. In such circumstances, the first, and sometimes the only, security measure that SMEs undertake is the installation of a firewall." It is important to note that the purpose for which firewall is used, cannot be substituted by any other solution.

With the emergence of plug and play type of firewall solutions such as the ones from NetScreen, for instance, complexity is no longer an issue. Dikshit from Bangalore Labs cites the maintenance and monitoring of firewalls i.e. assessing their effectiveness on an on-going basis, as the more daring challenge for enterprises.

Ramana of Cisco points out, "It is true that many SMEs are wary of dealing directly with firewalls. However, with specialized security service providers offering solutions in India, this should not be a concern for them."

The bottom line is, as Anurag Mehrotra-general manager, business solutions and services, Wipro Infotech, Bangalore says, "Any enterprise leveraging the Internet for its business is an ideal candidate for firewalls."

Pradeepan from Select says futuristically, "We will see firewalls at the gateway of every network, essentially those hosting websites, e-commerce companies, in a nutshell all those who are or would be using the Internet in a big way."

Shubha Murthy can be reached at shubha_m24@hotmail.com

<< >>