Peer-to-Peer (P2P) file sharing is the fastest-growing application on the Web. Employees install P2P applications to download music, movies, images and software – all free of charge. Additionally, more than 84% of all organizations have some form of unsecured public Instant Messaging (IM) service, including AOL, MSN, Yahoo and ICQ running on their networks. Public IM gives an organization the advantage of “presence,” which improves work efficiency, customer service and productivity while reducing long distance costs. However, because these “rogue protocols” rely on external servers to exchange data, there are significant security risks associated with their use.

The public servers through which IM and P2P data travel do not scan for viruses, leaving an open door to hackers to introduce worms and other viruses that can spread rapidly throughout a corporate network. The most recent example of this type of attack was the Fizzer Worm, which
spread via KaZaA using public IM applications. Despite efforts to bolster firewalls and block ports, employees can easily send plain text files of sensitive corporate data to external sources without leaving a trace of the file transfer. Or, outsiders can easily “pose” as corporate IM users to obtain sensitive and proprietary information.

Because these “rogue protocols” are not standardized and are constantly changing, they are nearly impossible to stop. Security assistance is available via IM & P2P management software, including products offered by Akonix. These products easily integrate with existing hardware and software and provide a centralized repository for data storage, search and retrieval through which administrators can track usage and alter policies as needed. Furthermore, these private-to-public gateway managers provide the most logical and intelligent solutions for reducing the risks related to the rising use of IM and P2P in the corporate environment. Akonix server based software even offers a dynamic update service for these ever-changing protocols to eliminate the “cat and mouse” game.

A: Security Policies
In today’s connected economy, Information Security continues to be a pressing issue for Executive and IT managers. Articles describing Information Security incidents headline industry trade publications and have also penetrated into the mainstream media.  Threats such as Worms, Viruses, industrial espionage, fraud, and inappropriate use of corporate systems by employees are resulting in enormous financial loss, increased legal liability, and disruptions to business continuity.  Organizations are deploying tactical security solutions such as firewalls, Intrusion Detection/Protection Systems, and 24/7 security monitoring to combat these threats, but often overlook a vital component when developing their Information Security Program. That component is Information Security Policies. Information Security Policies lay the foundation for an effective Information Security Program by defining and enabling managers to enforce corporate security objectives. Policies deliver a framework that provides direction for all security decisions including the technical requirements that dictate where and how to deploy technical security controls as well as identify acceptable use and behavioral guidelines for employees. Without policies, employers have traditionally found it difficult to hold employees liable for inappropriate actions and have exposed these organizations to lawsuits under privacy, sexual harassment, and due diligence liability laws. Policies impose employee responsibility for actions such as downloading, storing, or transmitting viruses, pirated software or offensive/explicit materials. As aforementioned, policies also provide the technical guidelines for securing critical information and systems.

The list below represents several best practice security policies:

                         · Information Classification and Protection     
                         · Physical Security                                              
                         · Information Disclosure                                      
                         · Workstation/Desktop Acceptable Use           
                         · Remote Access                                                
                         · Monitoring and Auditing                                    
                         · Incident Response and Handling     
                         · Employee Privacy
                         · Training and Awareness
                         · Access Control – Network and Systems
                         · Technology Procurement
                         · Vendor/Visitor Access
                         · Disaster Recovery                
                         · Internet and Email Acceptable Use

BAC Florida Bank, a member of one of Central America's foremost multinational banking organization, turned to Compuquip Technologies to reinforce its existing network security and protect its various technology and information assets.

“We installed the appropriate products, but lacked the staff to follow through with a strategy to continuously monitor, manage and modify our security policies and practices,” said Adilson Araujo, Internet Banking and Network Manager with BAC Bank Florida.

After performing a thorough assessment of BAC’s network infrastructure and existing information-security policies, Compuquip provided a solution that addressed the bank’s unique technical configurations and architecture and put into place a system for managing and measuring the effectiveness of BAC’s evolving security policies.

August 7th - Security Seminar Presented by Compuquip, Check Point, Surf Control and Guarded Networks
Click here for more info.