Organisations that get their Windows migrations wrong, could suffer the consequences for many years an IT security company warns. Last year saw some of the biggest security breaches to date, and some large organisations feeling the heat. Anonymous and LulzSec made their presence known, taking on a large number targets. RSA suffered a massive breach, inadvertently putting the security of its many customers in jeopardy. The Sony Playstation Network had to be shut down following a breach. Even Apple cracked under an attack from malware writers. Whether this year will be as eventful remains to be seen but what we can predict is cybercriminals will continue to look to profit from their illicit activities, albeit with evolving tactics. Rather than wait for them to strike, a little foresight can help prepare to fight back. So, with this in mind, Avecto’s Mark Austin draws on his experience of the corporate security landscape to predict four key threats he believes organisations will have to face in this Olympic year and how to mitigate them. Perhaps more importantly he also looks at the equally Olympic battle organisations face as they migrate away from Windows XP to Windows 7.
1) Mobile Security
The explosion of mobile computing, for example the various tablets that stormed the enterprise during 2011, shows no sign of slowing down. However, for too long, the security of these devices has continued to lag behind that of traditional desktops and laptops. Many enterprises have struggled with pressure from the workforce to allow these technological marvels, and the precarious balancing act to do so securely.
While many argue that Microsoft has ground to catch up in the tablet market, I think 2012 could see Microsoft gaining mindshare, as Windows 8 will be more appealing to the corporate world. Expected to go into beta in 2012, it is widely anticipated to provide superior integrated security features. In combination, Microsoft is following Apple’s lead of having a dedicated App Store, but it is expected to include corporate controls, which will give companies a more ‘corporate friendly’ tablet. The ability to connect Windows 8 tablets to a domain will ensure that these devices can be secured just like any other Windows endpoint. For this reason I think Microsoft tablets will be viewed favourably in the corporate environment.
2) Bring your Device to Work
But it’s not just tablets – smartphones too pose a serious security concern to the enterprise, especially with the growing trend for people to use their own personal devices to improve their work life balance. Lured by aesthetics and functionality, little regard is given to their corporate security offering. Personal laptops are of even greater concern as the specification could present the organisation a rather large liability headache.
One of the major concerns is that the apps users download to these devices could introduce vulnerabilities. Additionally users, wanting to take advantage of the flexibility and freedom their device can deliver, will be looking to transfer corporate data on to them. . The technology savvy users will use external cloud storage accounts, such as Dropbox, or even email it out of the network and to access it externally. . The biggest risk here is data loss so, naturally, this is where we will see the big investment, as companies battle to control corporate data.
A fairly new advancement on the block that could gain traction in 2012 is the hypervisor for smartphones, which will allow a phone to be effectively split into two distinct profiles, which are securely isolated from one another. The corporate side could be managed by the enterprise, complete with enhanced security solutions and controls, with the users having a personal side for their apps, music, contacts, etc.
3) Endpoint Security
That leads us nicely to my next point. With the explosion of endpoint devices, and resultant mobility, naturally we’ve also seen an increased focus on endpoint security.
Solutions that are able to detect the criminals’ increasingly diverse arsenal of threats will become crucial in the battle against stealthy and persistent malware. As a result, the adoption of application control and privilege management solutions within the operating system will increase in order to provide a more pro-active approach to endpoint security. Many malware attacks can be mitigated, and even eliminated, with better control over application execution and user privileges. Both of these solutions will become more relevant on the server-side too, as organisations look to comply with external or internal compliance initiatives, and demonstrate that servers are secured and administrator activity is strictly controlled and monitored.
4) Cloud Security
Finally, no 2012 prediction would be complete without a look to the sky. My belief is compliance could be the key differentiator here. While smaller organisations will continue to adopt cloud based offerings more readily, larger organisations, especially those governed by regulatory compliance, will continue to tread more carefully and stick to more mature cloud offerings, such as CRM solutions.
That said, the security of servers in the data-centres of cloud providers will drive more innovative security offerings at the hypervisor level. This in turn will allow the security software to get a complete view of the hosted servers, especially when dealing with stealthy attacks.
If cloud providers are to appeal to customers in highly regulated industries then administrator access, and their actions on servers in the data-centres, needs to be better controlled and monitored.
Whether this year will see as many high profile incidents as 2011 remains to be seen. However, we are confident that, across all industries and sectors, one challenge this year will be a common one: organisations looking to migrate across to Windows 7 must ‘get it right’ this year or it could all be over for the next few years as they struggle to regain control, if they can manage it at all. Don’t wait to see what the criminals have in store for you – act now and get ahead of the game.
For more information, visit www.avecto.com.
