How Software Deployment Is Not All-Encompassing

By: Mark Repka – MegaplanIT Security Consultant 

Information Security Software

Information security structure is a complex and often underfunded matter. An increase in online demand for services, markets, or products spawns an opportunity for the deployment of automated solutions to make your IT infrastructure secure while reducing costs. This, however, comes with the price of knowledge, the deploying automated tools, SIEM, Vulnerability Scanning Apparatus, or cloud-based tools which require both knowledge of how the tool works and appropriate deployment. In addition, the whitepapers and selling points of products may not always encompass the product’s capabilities or may even overstate the effectiveness of the deployed solution.

To combat this, you must first define what it is that you need; These asks may be from governmental regulations such as DoD standards or HIPAA or from private standards required by stakeholders such as PCI-DSS, NIST, or SanteFe Risk Assessment. Areas of security governance stemming from Data Loss Prevention measures, Incident Response Policies, User Access Controls, Network Management, or Anti-Virus Solutions all have diverse requirements per standard. The implementation solutions to meet your end goals will be just as varied as the standards. The classifications of what is needed can be either started from a dataflow process model in which all touchpoints are identified or the systems used to perform business functions are evaluated. Using this model it should be easier to determine what systems are critical and which are ancillary to the function of your business environment. The other method is to perform a comprehensive risk assessment to what risks or vulnerabilities will be the most damaging to the company from financial, reputation, or operational standpoints. The overall goal of these two methods is the same, to identify secure data and processes and the requirements for each.

Software

Where software comes in is a balance between a multitool approach of one solution covering many of your system’s needs while maintaining the viability of deployment and the functions that the tool provides. For deployment of File Integrity Monitoring, there are many deployments of tools such as AlienVault, SolarWinds, Wazuh, and OSSEC which all have different vectors and operating systems to which they are effective. The deployment of these tools may prove to be difficult when trying to culminate your information security tool in one place. Many companies have a suite of tools to address the many queries of information security risks. Suites of tools such as the popular ELK stack (Elasticsearch, Kibana, Beats, and Logstash) give a variety of tools that ingest, parse, and store your logs from systems but may be difficult to manage or require additional training.

For internal vulnerability scanning, not all products are equal. Tools that may be Freeware such as OpenVAS may be excellent for the cost-conscious consumer, but this tool requires skill in its operation and may not provide useful tools and utilities for compliance and system objectives. More advanced tools such as a Qualys or Nessus (Tenable.IO) scan may provide easier interfaces, guidelines on remediation, and additional support free tools do not contain.

Additional Software Considerations

Another consideration is what your service providers are providing for you, cloud service providers may add value to their services such as IDS/IPS, load balancing, or other useful network monitoring and alerting utilities. System engineering service providers may promote internal and external vulnerability scanning as well as system patching, anti-virus, or other requirements for your information security governance stance. Log aggregation providers may have additional monitoring and SIEM tools to reduce the workload to your organization while simultaneously saving costs on additional individual systems or software.

Once choices have been evaluated be sure to test your deployed solution(s) within your environment. Be sure that logging systems are capturing appropriate events, be sure that anti-virus configurations are what your business risk tolerance will allow, set criteria for testing, and document the functionality and effectiveness of each solution. A great way to test network and system layer deployments is through a penetration test which should alert and quantify attack vectors and network activity. External penetration testing should ensure that firewall rulesets, IPS/IDS software, and WAFs are functioning appropriately. In short, test your deployed solution and determine the effectiveness as implemented in your environment.

MegaplanIT’s Team of Software Experts

As always you should consult with a security professional to discuss the appropriate channels and vectors for your information security plan. Industry insight, experience, and deployment of these tools via professional assistance will help you acquire the correct tool for the job while minimizing costs. Appropriate tools functioning properly can aid in the successful completion of audits, prevent fines from data breaches/noncompliance, and preserve a business’s reputation. As an information security consulting company we offer many solutions such as CrowdStrike, AlienVault, and Wazuh as well as many services: SIEM, SoCaaS, and many other services that may save time and cost to your business.