Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
The group spoke to a crowd at this week's RSA conference on the virtues of using multiple security solutions and pursuing a 'defence in depth' philosophy for securing their networks.
The system calls for adding multiple levels of security throughout the network, both to prevent intrusion and secure data within the network. Rather than relying on one suite of products on one box to provide total security, the panel advised administrators to pursue multiple 'best of breed' products and secure multiple avenues for attack.
For panellist Bob Pratt, head of product management for ArcSight, the term 'defense in depth' applies not only to a company's hardware choice, but also its philosophy towards administration and management of IT.
"It is not just buying six products and layering them one of top of the other," said Pratt.
"It is not having one guy who administers every single security product in the company, you have two security products, why not have two different sets of administrators."
Several of the panellists likened the approach to that of a bank vault, where multiple security measures and procedures are put in place to safeguard the money in addition to the vault itself.
The panel also warned against relying simply on front-end security and intrusion prevention systems. Metronome director of product management Daniel Proch described the approach as "M&M security" in reference to the hard-shelled candy.
"It is a hard outer shell they think, but with a really soft middle," Proch explained.
"They are not patching back-end systems, they are relying on the boxes on the outside to stop everything."
In general, the panel agreed that in order to better prevent attacks and intrusions, businesses needed to communicate better. Panellist and Tenable Network Security chief executive Ron Gula suggested that enterprises follow the lead any financial institutions have begun to take and share certain attack details within the industry.
"We need to be a little bit more reactive," said Gula.
"You can put that [information] into your environment and get a good idea about how other people like you are getting attacked."
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.