The Compliance and Security Connection

EMA Analyst Steve Brasen Speaks on Managing Complex IT Environments

Session with EMA Analyst DiscussesProcesses Necessary for Resolving IT Challenges with Controlling Large, Complex IT Implementations

News Facts:

• Ecora today announced that EMA Analyst Steve Brasen will be the guest on their upcoming IT Implementation and Management Webinar.
• The session: Dealing with Complexity in Large IT Implementations will take place on Wednesday, March 5, 2008 at 1:00 p.m. EDT.  To register, please visit: http://www.ecora.com/ecora/webinars/webinar.asp/2008-03-5/.
• Steve Brasen will discuss challenges faced by IT managers confronting broad IT and compliance requirements while dealing with complex IT Infrastructures, especially in large IT implementations. 
• Tools are typically employed to automate standardized processes, but many heterogeneous environments require specialization to support specific practice areas, requiring several disparate tools that are not integrated and require repetitive duplication of effort to manage effectively.

What you will learn:

·         The challenges faced by today’s IT managers

·         Unique considerations for large IT Implementations

·         How ITIL and other best practices address IT complexity

·         The importance of integration

·         Achieving regulatory compliance

·         Choosing tools and solutions that enable IT productivity

Multimedia:

• Visit the Ecora blog
• Download an Ecora podcast on IT challenges
• Explore the Ecora whitepaper library
• View past Ecora webcasts

About Ecora Software

Ecora Software is the market-proven leader for Configuration Auditing and Compliance Reporting solutions that allow a proactive view of the IT infrastructure and deliver actionable evidence ensuring critical business services remain operationally effective, secure, and compliant with internal standards and external regulations. Auditor Professional™ offers immediate value with its agentless architecture matched with rich report templates and pre-defined policies providing the foundation for effective change and configuration management. Please visit us at www.ecora.com.

A health scare, the Patriots loss, and how it all relates to managing IT

Last night, the New York Giants shocked most of the sports community with their 17-14 Super Bowl victory over the previously undefeated New England Patriots.

As a life-long Mainer, I have been a devoted follower of all of New England's sports teams since my earliest youth. Needless to say, the idea of the Boston Red Sox winning their second World Series in my lifetime, followed by the Patriots winning the Super Bowl in potentially undefeated fashion was just incredibly heady stuff and my family and I were extremely disappointed to see a 19-0 season slip from New England's grasp.

While there will be lots of analysis of why New York won and New England didn't, a quote shared in Mike Rothman's column this morning stood out to me. In his column, Mike shared the following Tom Brady comment from after the game: "It is extremely disappointing. This isn't something any of us prepared for."  Now, I don't expect anyone to prepare to be defeated, but, there is a need to believe the potential exists to be defeated, and to prepare to prevent those possibilities.

This rings true in what I've been going through personally over the past two weeks. If you happen to be a regular reader of The Compliance and Security Connection, you've probably noticed that it's gone dormant over the past two weeks. While driving with a co-worker to a company meeting on January 22nd, I suffered a seizure. The next thing I knew, I was in Portsmouth Regional Hospital surrounded by a wealth of medical staff and, by the time I was that coherent, my wife and parents. There's a lot about this story that I'd love to share, but is not necessarily appropriate to this particular blog. However, the point that was made by the neurologist that has struck a chord with me is, while there is a tumor that was a key factor in my having a seizure, the catalyst for the seizure was the tumor's presence combined with stress and lack of hydration. In some respects, in spite of warnings from co-workers, family and even my own physician, I was not prepared for the results of not taking better physical and mental care of myself.

So, what does this have to do with IT security and compliance?

In too many cases, I think we're just focused on getting through the audit, because we don't see what significant value audit preparation could provide. This is primarily a result of two factors - 1) we don't really believe we're a target for either an internal or external security threat and 2) we aren't using audit preparation tools that actually provide meaningful information for identifying security vulnerabilities and improving overall system performance.

Whether in sports, health, or running an IT department, it is far too easy to become complacent and think you aren't vulnerable to some form of defeat. Let the Patriots' defeat and my recent health challenges cause you to re-think just how vulnerable you and your business might be.

Contributed by Mark Tordoff

The Red Sox, The New England Patriots and Using Technology for Managing IT

It's pretty heady times to be a New England sports fan. The New England Patriots are 8-0 after thoroughly annihilating the Washington Redskins Sunday, 52-7. Then, the Boston Red Sox swept the Colorado Rockies to clinch their second World Series crown in the last four seasons.

There are two interesting parallels between the Red Sox and Patriots that have application in how IT departments should use technology in managing its environment.

First, the Red Sox showed their offensive firepower in games 1 and 3 of the series, but counted on their pitching and defense to carry them in games 2 and 4. While the New England Patriots have not needed to rely heavily on their defense to win their first 8 games, they are still among the top six teams in the league in every key defensive statistic. So what's my point? To be successful, you need to have a balanced approach. In an IT department, this should mean taking a proactive and reactive approach to security. You understand that you have external and internal threats to your environment, so you employ an outside-in, and inside-out model of security. In the case of compliance, you don't just react to an upcoming audit, you proactively take steps to improve your compliance posture by making a commitment to adopting IT service management processes.

The second parallel between these two successful franchises and managing an IT department is effectively using multiple resources. One of the interesting debates on sports talk radio this morning in New England is the choice of Mike Lowell as MVP. Some are touting Papelbon, who saved three of Boston's wins, while others are citing Ellsbury or Pedroia, Boston's rookie phenoms. Clearly, cases could be made for each of these, as well as David Ortiz, Kevin Youkilis, Manny Ramirez, and Josh Beckett.

The Patriots are no different. Tom Brady has now thrown 30 touchdowns in the first 8 games of the season. While 11 of these have been caught by the Randy Moss, there have been six others with touchdown receptions - four of those with multiple TDs.

In other words, the Sox and Pats don't have to rely on a single weapon, much like you shouldn't rely on a single solution for addressing your IT challenges. Sometimes, we want an all-in-one, out-of-the-box solution for security, compliance or controlling change. The reality is we need a few "players" in our technology arsenal to make sure we've covered all of the angles.

A recent story by eWeek's Cameron Sturdivant reinforces this thought when he says, "Almost all organizations will need to use a combination of broad reporting tools and narrow enforcement products to produce the full range of reports needed by outside auditors." 

42internetworks makes a similar case for multiple solutions in this post from last week when they say, "Before you start evaluating a single vendor, do them and yourself a favor.  Figure out what are the primary use cases you need to solve, how much money they could save you (this helps prioritize them), determine which organization(s) are going to pay for the solution (most likely their use cases will get weighted higher) and finally engage based on previous guidance.  There is no silver bullet here where I can say one vendor is best fit for everyone…the honest truth is each vendor has their appropriate strengths & weaknesses."

While you may not be a fan of the Red Sox or the Patriots, I think it is important to appreciate what has made them successful and how you can apply that to your own "competitive environment." Give some thought to how you are attacking your IT challenges and whether you are relying too heavily on just one solution. A proactive, multi-faceted approach may give your department and organization the boost it needs to be victorious in moving your organization forward.

Contributed by Mark Tordoff

Cal Ripken Shares Lessons in Perseverance at itSMF

The Tuesday afternoon keynote speaker was Baseball Hall of Famer Cal Ripken, Jr.

Cal shared a message that, while not IT-specific, applies to anyone in business that is trying to make a difference amid all of the competing forces that can derail us from our goals.

The presentation was the basis of a book Cal recently released, entitled Get in the Game: 8 Elements of Perseverence that Make the Difference.

Cal related that as he was drawing closer and closer to Lou Gehrig's record of consecutive games played, he was constantly being asked for his secrets to being able to play day in and day out. He really didn't have any specific answers, until the question was posed by New York Yankees shortstop Derek Jeter at Jeter's first all star appearance. When Ripken didn't have any concrete advice, Jeter gave him an "is that all you've got for me" glare, according to Ripken.

From that incident, Ripken came up with his 8 traits necessary to persevere. Here's the summary of the eight:

1. The right approach
2. A strong will to succeed
3. Passion for what you do
4. The love to compete
5. Consistency
6. Conviction
7. Strength
8. Life Management

He expanded on each of these, but rather than try to summarize all of his points, perhaps it is best to simply share the quote that Ripken said he's carried in his pocket for years.

"Far better it is to dare mighty things, to win glorious triumphs even though checkered by failure, than to rank with those poor spirits who neither enjoy nor suffer much because they live in the gray twilight that knows neither victory nor defeat."
  --  Theodore Roosevelt

In whatever we do, let us all dare to do mighty things.

Contributed by Mark Tordoff

Effective IT Risk and Compliance Management

The June 2007 issue of the ISSA Journal has a well-written article by Pravin Kothari, CEO of Agiliance.

Kothari addresses several key points for addressing the overlapping challenges of regulation and control, risk management, and cost reduction.

These keys are:

1. Capture the appropriate assets
2. Implement a common control framework
3. Automated survey workflow and technical testing
4. Quantify and analyze risk
5. Take appropriate actions to manage risk
6. Provide visibility to support informed decisions

The point that reverberates throughout Kothari's comments are how important being able to thoroughly document configuration items is and then being able to measure those items consistently against common control frameworks to ensure that controls are followed.

As Kothari indicates, by laying this fundamental groundwork and applying the other details he spells out, IT departments will:

• Always know their compliance position
• Understand and manage risk that matters to the business
• Effectively use current resource levels to manage growing risk and compliance requirements
• Sustain lower cost through sustainable processes and better quality information
• Provide visibility to enable informed decisions at all levels of the enterprise

Contributed by Mark Tordoff

A Blogging We Will Go...

Ecora has had a presence in the blogosphere for nearly two years now, namely through the thoughts of our Founder and Chairman, Alex Bakman's blog. Alex is still providing insightful thoughts, but has expanded his entrepreneurial horizons into new and exciting technologies. Make sure you have Alex's blog on your short list as he shares thoughts on virtualization, Wi-Fi, paid search marketing, and more.

A common theme I've heard in talking to analysts, compliance gurus, and seasoned information security pros is "compliance doesn't make someone secure and being secure doesn't necessarily make one compliant." It is with that thought in mind that we launch The Compliance and Security Connection. It is here that we'll venture to find the common ground between compliance and security...and why both are important in today's evolving business environment.

Joining me in contributing to The Compliance and Security Connection are James Sayles, Chief Compliance Advisor at Ecora and Bryan Cote, Senior Product Manager. James has a wealth of real-world security and audit experience and will be sharing from his years working with some of the largest gas and oil and financial services companies in the world. Bryan, in his key role in developing automated software solutions, will share how increasing compliance regulations and increasingly sophisticated threats to information security is driving advances in technology.

Me? Well, I get to wear two hats in this forum. First, I have spent the better part of my adult life learning to quickly interpret and apply government regulations. I'll be keeping both you and I up-to-speed on new regulations and any changes to existing ones. More importantly, I get to play the role of the consumer in all of this security and compliance talk. At the end of the day, it's your information and mine that is at risk and it's you and I that bear most of the direct and indirect costs for data loss.

Thanks for joining us in this new venture. One request - don't just sit on the sidelines. Participate! Your comments will help keep us honest, focused and engaged in providing meaningful conversation on a very important topic.

Contributed by Mark Tordoff