Portal:Storage

Wikitip

Diligence and security

Is your organization taking every reasonable step to provide technology security? Of course, there is no such thing as a perfectly secure network, but one of the best ways to satisfy the duty of reasonable protection of a network, beyond compliance, is the exercising of a number of fundamental security principles.

Foremost of these principles is diligence. One key advantage to exercising heightened diligence is that the organization can use these initiatives to establish a better stance on security altogether. They are also able to respond to legal scenarios by demonstrating that it made good-faith efforts to provide security.

Diligence can cover a wide spectrum of focus, but to generalize, staying aware of security and technology developments in the following areas will help an organization's security posture:

• Security Standards – Best practices constantly evolve and adapt to emerging technology and user behavior. Consensus around best practices is therefore always evolving. Look beyond your dusted security standards and reflect these against your organization and what is current on a regular basis. Discovering how your security profile matches up to them can be a very enlightening exercise.
• Regulations – Regulations can provide a benchmark of standard security practices as long as your organization is current and compliant. This is a great base for risk avoidance and a baseline for minimizing legal exposure. While non-compliance by itself typically does not constitute a basis for legal matters, it is typically best to have these matters in order consistently.
• Contracts – Understand the liability your organization accepts when negotiating contracts. Generic disclaimers for security flaws are often non-binding and therefore should not be used. Be specific and cater to your organization’s concerns specifically in all contract matters. Know the extent of liability your organization is accepting.

For example, typically protecting sensitive information, such as PCI-DSS data, requires agreements with vendors. These agreements are created to ensure security requirements. It is critical to isolate information security directives across physical, monitoring, and computing technology domains, with specificity for your organization’s needs. Minimizing risk is the bottom line, and no detail can be too small. If you have questions, ask.

Review the practices your vendors use to support products on your network, and practices that you require of your partners. If you require a vendor to operate in an insecure mode, you may be liable for breaches of its security that can be tied to your requirements.

Minimizing risk to the enterprise is the duty of a responsible and secure organization. This goes beyond typical reactive responses to breach events. It actually delves much further into the health of the organization, minimizing risk, and public perception.

View Another Wikitip

Featured Case Study

Virtualization Energizes Cal State University

John Charles is the CIO of California State University, East Bay (CSUEB) and Rich Avila is Director, Server & Network Operations. In late 2007 they were both looking down the barrel of a gun. The total amount of power being used in the data center was 67KVA. The maximum power from the current plant was 75kVA. PG&E had informed them that no more power could be delivered. They would be out of power in less than six months. A new data center was planned, but would not be available for two years.

read more...

Featured How-To Note

Storage Virtualization Design and Deployment

A main impediment to storage virtualization is the lack of multiple storage vendor (heterogeneous) support within available virtualization technologies. This inhibits deployment across a data center. The only practical approach is either to implement a single vendor solution across the whole of the data center (practical only for small and some medium size data centers) or to implement virtualization in one or more of the largest storage pools within a data center.

read more...