Network Security
in Canada

Network Security Assessments

Life is full of risks, but when you know you are safe, you feel secure. A network professional can help you anticipate what can go wrong and implement solutions so you know you are safe and secure. An initial consultation will explore your requirements for availability, data integrity and information confidentiality, review current measures and identify any areas that warrant further investigation.

Availability

There is a degree of availability appropriate to every situation. An application and its data may be so important that keeping it online is paramount, in which case measures like redundant servers should be considered.

In many cases, after considering the time to build a new server, simply having a copy of the data within reach may suffice. The important thing is to consider the risk/impact and design the response appropriately.

Integrity

Can we trust the information? Whether accidentally corrupted by operators, or maliciously distorted, data that is not trustworthy can present issues that are just as serious as losing the information altogether. Integrity should be protected by ensuring that only authorized people can update information.

Trust in one's co-workers' intentions is generally insufficient, since the majority of data corruption originates from well-meaning participants who accidentally cause problems. Therefore, care should be taken to restrict users to manipulating only specific job-related information.

Confidentiality

Who can see the information? How sensitive is it? HR records, customer lists, credit card information, financial statements and more commonly reside in business computer systems. What could happen if this information fell into the wrong hands? Internet connected systems, mobile workforces and mass storage devices small enough to fit in phones, coupled with the availability of strategies for safeguarding information raise the standard of due diligence every day.

In addition to protecting business interests by ensuring that information does not fall into competitive hands, that the business reputation is not harmed by a theft of sensitive customer information (a problem we see in the news with increasing regularity), statutory requirements such as Privacy legislation make businesses increasingly legally responsible for appropriately safeguarding the confidentiality of the information they collect.

Businesses should be particularly protective of information that could potentially be used as part of an identity-theft operation.

Everything or Nothing

There are two fundamental approaches to security-related systems:

• Everything is allowed unless explicitly prohibited.
• Nothing is allowed unless explicitly authorized.

The simplest approach to designing a computer network is an approach in which everything is allowed by all participants at all times. Too many small businesses opt for this approach because the latter, properly secured approach demands a thorough assessment of each function that should be allowed and by whom, and implementation. Securing systems, like locking the building, is well worth the effort.

A secure system presents multiple layers of challenges to frustrate nefarious characters, and multiple layers of protection for the owner. Properly adapted to business requirements, a secure system presents no inconvenience to users who are supposed to have the keys.

Policy versus Technology

An appropriate usage policy can be helpful to communicate with employees exactly how they are allowed to use the company network. Without such a policy, employees can, and do, successfully argue that they had no way of knowing that their use of the company computers was inappropriate, even in the most egregious cases of misuse.

A usage policy can include stipulations about proper work-related use of the world wide web, email, instant messaging and so forth, and schedule specific types of unacceptable activities. Such a policy is also an opportunity to clarify the types of activities that are recorded, without necessarily being specific.

Strong policy and good record-keeping is often more effective at deterring undesirable use of a corporate network than attempts to erect specific obstacles for every type of activity employees might participate in.

Overarching systems that track activity, in varying degrees of strength, are relatively easy to implement.