IT security teams are struggling to know where to look when it comes to security. They’ve pinned down, or believe they’ve pinned down the perimeter of the enterprise. The problem is that there has been no effective perimeter for well over a decade. Mobile users, cloud-services, social media presence and websites all show that the notion of a perimeter that can be secured is an ineffective approach to security.
On a recent trip to San Francisco, Enterprise Times got a chance to sit with RiskIQ, CEO, Lou Manousos. He talked to us about how organisations can begin to get a handle on their IT risk. It all starts with identifying the assets that the organisation has and setting up effective monitoring of them.
IT is no stranger to the use of sensors to see what is happening on the network. What Manousos says it needs to do is extend that. The business needs to start capturing Internet telemetry to know what its users and applications are going and what they are doing. Once you know what is happening then you can analyse the traffic to identify assets. The key is being able to separate out the assets you own and control from those you don’t own but might still have some responsibility for or reliance on.
When it comes to tracking Internet usage, there is a conflict between employee privacy and corporate need. Those lines have become increasingly blurred with BYOD. Manousos points out that organisations have policies to deal with how data is dealt with and what employees can do. While some of these policies may need overhauling, there is no reason why they cannot be adapted to protect employee privacy and the enterprise.
Manousos went on to talk about what else RiskIQ was seeing IT security teams doing when it came to understanding attacks and threats. He also talked about the challenge of trusting cloud providers and services.
To find out more, listen to the podcast online or download it to your device and listen to it later.
