Feeds

Even brilliant sysadmins need help plugging holes

External audits fix issues you didn't know were there

Protecting against web application threats using SSL

Sysadmin blog While we must never allow ourselves to fall into the habit of thinking that security is somebody else's problem, the time has come to accept that external help is required.

We accept the necessity of outside help in many other areas of business. Yet even when IT security audits are offered at no cost, companies are still reluctant to take advantage. Where does the reluctance to seek specialty support in IT come from?

The cost of a data security breach is already expensive, and those costs are still rising. Let's not forget about Sony, whose recent security issues have shown that data breaches can cascade into insurance issues as well.

Intel seems to think that the data security threat posed by missing equipment is a big issue. Meanwhile the FBI seems to think that reinventing the wheel is a potential solution.

Some sectors have it harder than others, but nobody is immune. Not even the biggest and the best. Data security breaches are now so common that we can regularly compile humorous lists of the top10 massive security breaches.

Confidence is not enough; data security needs be studied objectively and measured as qualitatively as possible. It needs the tender care of professionals. A computer science degree or whichever diploma is attached to the milled masses of sysadmins stamped out of polytechnics each year is simply not enough.

Security audits of your company need to be done by people bearing certifications like CISSP, GISC, and CCNP Security. Audits should be done by teams that have individuals sporting many years of actual experience in the field.

There is no ubermensch; the modern polymath is a myth. No one IT director, CTO, CIO, systems administrator or any other designation can or ever will know everything there is to know about modern IT. It simply isn't possible.

A large enough company could theoretically assemble an IT team whose skills covered all the requisite areas – I expect IBM, VMWare and the like have some pretty top-flight nerds – but even the behemoths of IT get themselves into trouble.

For all our skills, knowledge and experience, we are all of us still human. Working with a system day in and day out makes you more familiar with than than an outsider, but it also makes you more likely to overlook subtle quirks or rationalise bad decisions made by bodies further up the food chain.

Sometimes, it takes that outside professional to get the brass to accept you've been right all along. Other times, another pair of eyes really is important. More often than not however, the guy whose job it is to do data security 24/7 will simply know details about issues you simply haven't had time to learn yet, busy as you are dealing with everything else.

External audits also bring an element of "cover your assets" to the table. If it all does go horrible pear-shaped, being able to stand up in front of the judge and say honestly "we did everything possible, including bringing in certified external experts, and following their advice" makes a huge difference should a lawsuit arise. Increasingly, it can also lead to lower business insurance premiums.

If you have an internet connection, then data security audits have become a fundamental cost of doing modern business - no matter who your company is, or what you do. ®

Choosing a cloud hosting partner with confidence

More from The Register

next story
Wanna keep your data for 1,000 YEARS? No? Hard luck, HDS wants you to anyway
Combine Blu-ray and M-DISC and you get this monster
US boffins demo 'twisted radio' mux
OAM takes wireless signals to 32 Gbps
Google+ GOING, GOING ... ? Newbie Gmailers no longer forced into mandatory ID slurp
Mountain View distances itself from lame 'network thingy'
Apple flops out 2FA for iCloud in bid to stop future nude selfie leaks
Millions of 4chan users howl with laughter as Cupertino slams stable door
Students playing with impressive racks? Yes, it's cluster comp time
The most comprehensive coverage the world has ever seen. Ever
Run little spreadsheet, run! IBM's Watson is coming to gobble you up
Big Blue's big super's big appetite for big data in big clouds for big analytics
Seagate's triple-headed Cerberus could SAVE the DISK WORLD
... and possibly bring us even more HAMR time. Yay!
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.