Simplifying for Security's Sake - Twenty-Four Seven Security

« Will the Identity 'Big Bang' Happen in 2008? | Main | 2007 -- The Year of the Data Breach »

December 19, 2007
Simplifying for Security's Sake

Regular readers here are well aware that system complexity often stands directly at odds with security. Nothing is worse for an enterprise than having a security breach go down and the company not even knowing about it because it happened on some unaccounted for or unknown area of the network. (OK,. there is something worse, and that's having a breach and doing nothing about it).

According to the Tao Security blog, the federal government is planning to do something about it. In what is being called the Office of Management and Budget's (OMB) Trusted Internet Connections (TIC), the TIC will require government agencies to implement real-time gateway monitoring, as well as force government agencies to simplify the number of internet connections from an estimated more than 1,000 down to around 50.

Why 50? That would equal two a department, but 50 is not set in stone.

"The reduction of access points to trusted Internet connections will improve our situational awareness and allow us to address potential threats in an expedited and efficient manner," Karen Evans, OMB's administrator for e-government and information technology, said. "While we optimize and improve our security, it is also our goal to minimize overall operating costs for services through economies of scale."

“The [TIC] initiative is saying, ‘We have to know what we own in order to protect it,’ ” Evans said. “We also must know we are managing risk at an acceptable level.”

Makes sense to me.

And now for something fun -- see if you can figure out the trick behind this guess-your-number wizardry.