Feature
News
2/21/2008
12:30 PM
50%
50%

Action Plan: Pacific Northwest National Labs Recommends Regular Check-Ups

Technology is good, but the nothing beats the intuition of personal experience.

REGULAR CHECK-UPS

Continuous vulnerability scanning of your entire network is essential. I've talked to some CIOs who believe that having an external party scan a portion of their network once a year is sufficient. That's frightening. Our system scans the entire network for "Top 10" vulnerabilities as fast as it can (about once per hour), and we conduct a credentialed scan of the network for vulnerabilities once per day. No single scanning tool will pick up all vulnerabilities, so consider using more than one and rotating between scans.

Look beyond vulnerability scanning and periodically assess your complete program. Evaluations need to cover both the programmatic and technical aspects of cyberprotection. This is where an independent assessor, either your internal auditing organization or an external consultant, is valuable.

InformationWeek Reports

Becoming overly reliant on technology breeds a false sense of security. Good detection tools are commercially available, but the actual detection of intrusions still depends heavily on the personal knowledge of the analyst. This should not be a part-time job or one given to an entry-level employee. The intuition of experience is important, as well as investments in forensic training.

UNBIASED GUIDANCE

The best source I know for expert, unbiased guidance on cybersecurity is the National Institute of Standards and Technology. More than 250 NIST information security documents are available at www.nist.gov. There's even an online guide to accessing the particular information you need. For example, PNNL uses NIST Special Publication 800-53 Recommended Security Controls for Federal Information Systems to assess the maturity of our cybersecurity program. The NIST publication provides a good template for assessing the robustness of any organization's cybersecurity efforts.

Return to the story:
CIOs Uncensored: Security Smarts

Comment  | 
Print  | 
More Insights
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest, Dec. 9, 2014
Apps will make or break the tablet as a work device, but don't shortchange critical factors related to hardware, security, peripherals, and integration.
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Join us for a roundup of the top stories on InformationWeek.com for the week of December 14, 2014. Be here for the show and for the incredible Friday Afternoon Conversation that runs beside the program.
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.