Close the gap between prediction and mitigation
According to Stan Quintana, VP of managed security services at AT&T, "the premise behind any product/tool that offers analysis and protection is (a) how good and predictive the intelligence being gathered is, and (b) the velocity in which that information can be turned into a mitigation solution."
AT&T Internet Protect Service boasts true predictive information on worms, viruses, D/DoS, and other types of attacks that develop in the network. AT&T notifies its clients within minutes of detecting malicious activity and cyberattacks, and recommends necessary actions to mitigate the event before damage sets in.
"The advantage of having predictive information lies in the ability to quickly turn this information into security rules that can mitigate the security event on a real-time basis," said Quintana.
More important, Quintana said, customers should also have systemic policy management practices in place so that the security infrastructure is current with the changing face of the risk environment. "In addition, having overall management and monitoring, and incident management capabilities, are critical to ensure that the security landscape is addressed on a holistic end-to-end basis," he advised.
Don't forget the employee desktop
"As the effectiveness of network and perimeter security diminishes, hackers have begun to utilise the employee, which can be the weakest link in an organisation's security infrastructure," according to Dan Hubbard, director of product and systems analysis at Websense. Therefore, any complete security strategy for organisations should include protection at the employee desktop level, he said.
Hubbard recommended the Websense Enterprise Client Policy Manager (CPM), an add-on module to the Websense Enterprise content filtering suite, which delivers zero-day protection against unknown security threats and prevents the execution of unauthorised applications.
For reporting, Hubbard proposed Websense Enterprise Explorer for CPM, an interactive, Web-based forensics and analytics tool that enables IT/business managers to quickly detect malicious activity such as spyware, Trojan horses, and hacking tools before antivirus signatures are available.
