Poor Access Controls Can Harm Any Sized Company - Twenty-Four Seven Security

« New Age of Computer Security? | Main | Hackers Get Predictable »

October 11, 2006
Poor Access Controls Can Harm Any Sized Company

An article from Search Security reports that no matter the size of your company, your IT must always keep tight control over authenticating users and controlling network behavior. But where large companies have the resources to implement controls such as two-factor authentication, smart cards and tokens, that technology is not always affordable to small and medium sized enterprises.

So many SMEs try to make best with the Network Access Controls (NAC) offered by Microsoft and Cisco Systems, two companies that recently announced plans to provide better interoperability between them. Many security vendors have also gotten in the game trying to entice midmarket companies with more affordable options.

Amer Deeba, VP of business development for Qualys, said that while some mid-sized companies may have decent internal controls, they often lack adequate NAC for their outside contractors, many who frequently sign-on to the network. "That's why NAC is becoming a big deal," Deeba stated.

Security vendors have been trying to develop inexpensive tools, and while that has created a growing number of choices, they often lack interoperability. Unfortunately, for SMEs, there is still no magic bullet. Todd Towles, an IT security consultant, was quoted saying, "Products that work in and of themselves and enable IT administrators to see the big picture are the most value." It is also important that the solution is scalable so they can accomodate a company's growth.

Also, the problem remains that midsized companies often don't view security as important or strategic, and it's hard to see any return on such an investment. Jonathan Penn, an analyst at Forrester Research in Cambridge, MA, said that it's up to IT professionals to help their bosses understand what's at stake. Penn also said, “IT professionals should frame the need for new investment not in terms of cost, but in terms of how it will help the company manage its risk."

If that doesn't work, there is always compliance to consider. The PCI Data Security Standard has motivated plenty of SMEs to take action. So no matter what sized company you are, in this day and age of twenty-four seven security threats, simple password verification just doesn't cut it anymore.

Tags:Search Security, NAS, Microsoft, Cisco, Qualys, Forrester Research, PCI Data Security Standard