Posts

What does an ISG network assessment look like?

Business technology has become incredibly complex in the past few years. Companies often fall victim to their own success, growing so quickly that the IT department can’t keep up. This can often lead to the network infrastructure being put on the back burner while employees work daily just to keep operations afloat.

Organizations often don’t have the time or expertise to evaluate their own infrastructure, which is why ISG Technology offers comprehensive network assessments. But what do one of these examinations look like, and what can companies get out of them? Let’s take a look:

“No two companies are going to have the same needs.”

What’s the first step?

The problem with laying out a first step for such a complex process is the fact that no two companies are going to have the same needs. A network assessment could mean checking the local compute environment, but it could also have to do with looking at a business’s circuit load. One section of the assessment could be as simple as determining whether or not a physical system has single points of failure.

This is why ISG recommends that companies that come to us looking for a network assessment should first determine what their end goals are. Administrators may not be able to completely vocalize what they need, but they should at least have an idea of what they’re after. Basically, the point of this exercise is to get the organization from its current state to its future state. If we know what a company’s intended future state is, we can recommend clear and decisive actions officials should take in order to get there.

What kinds of issues does the average company run into?

Although each organization is going to have its own unique situation, there are some pretty common problems that our engineers run into on a regular basis. One of the most apparent has to do with mobile devices and their use for work purposes. The Pew Research Center found that just under 70 percent of American adults currently own a smartphone, which means a majority of office workers currently have such a device in their pockets at all times.

Due to the advanced capabilities of these devices, workers are increasingly using their smartphones to access company data. The problem with this is that these employees very rarely take any measures to protect their phones. An infographic from Consumer Reports found that 34 percent of smartphone owners didn’t take any sort of security measures with their phones, and that’s including a screen lock with a four-digit password. Therefore, companies that aren’t taking proactive steps to secure private data from stolen or lost phones are at significant risk of a data breach.

Another major issue we often see is businesses not controlling network physical access in the right way. Many companies are now relying on voice-over-Internet-protocol technology, which allows workers to speak to clients via the Internet. It’s an amazing technology with multiple uses, but IP phones can also be an access point for criminals. These devices require a cable connection in order to get on the Internet. This means that anyone with the ability to get into the office could potentially plug a laptop into one of these cords and instantly access the entire network.

Cybercriminals often break into offices to steal data. Hackers don’t just use computers to commit their crimes.

This is of course a very specific example, but it shows that companies often aren’t thinking of network security correctly. The reality of the situation is that hackers really don’t care how they gain access to a business’s information. Whether it’s by stealing an employee’s phone or dressing up as a janitor to plug into the network after hours, a criminal with enough initiative will find whatever holes exist in current security standards and exploit them.

ISG has the experience needed to do the job right

An ISG network assessment has one major component that sets us apart from other companies: experience. The average ISG engineer has been with the company for eight or nine years, which means they know our network assessment playbook backward and forward. They’ve seen all the classic mistakes – as well as some unconventional ones – and they know what the modern business needs to solve these problems.

When you work with ISG, you can rest assured that you’re dealing with some of the most experienced professionals in the field. If you’d like to see what this wealth of knowledge can do for you, contact an ISG network expert and set up your free IT infrastructure assessment today.





Join the ISG Technology Team




Securing A Mobile-First Digital Workplace

With the growing millennial presence in the workforce today, it’s safe to say GenMobile has definitely arrived. GenMobile isn’t about a specific age generation; rather, a “changing-how-we-do-work” generation. Think about how we do things today versus five or even ten years ago. No longer do we need to come into a dedicated office space between specific hours of the day to get our work done. GenMobile is an always-on-the-go, yet more-connected-than-ever generation, and it’s changing the way IT responds to their business needs.

Today, mobility is everywhere – and it can benefit everyone. If you are an employee, and your child is sick at home, you can be home with them and still meet your deadline. Maybe you are more focused at ten o’clock at night, versus ten o’clock in the morning.  Employers benefit from mobility for those same reasons.

Mobility also affects the business-to-consumer relationship as well. As more companies develop applications that customers can interact with on their smart devices, both parties benefit. Customers benefit from a variety of ways – from product information and reviews to location-based services that lead them around the workspace. Businesses pull valuable information about their customer base through these apps – from what products are generating a lot of interest online, to where customers are spending their time, and when.

Workspaces are changing as well. IDC claims there are over 1.3B mobile workers today, or 1.3B people who aren’t tied to a specific network port. Think of that unoccupied cubicle space in your office. Can you tell me that 100% of your cubicles are in use by a specific employee – not as storage space – as an actual desk space? On average, these spaces are sitting unused at $14k per cube. If it fits the needs of the workspace, what’s holding an organization back from going wireless?

The Internet of Things couldn’t be what it is today without mobility. IoT is all about the sensors, and most of those sensors connect wirelessly. IDC claims that by 2017, 90% of datacenter and enterprise systems management will rapidly adopt new business models to manage non-traditional infrastructure and BYOD device categories. That screams IoT. The only thing more important than those sensors, is securing the data that those sensors are gathering. If the integrity of the data is compromised, what’s the point of the sensor?

With all of these changes in mobility, and everything already coming from IoT, how do you respond? How do you accept these business-advancing changes while keeping your company secure? It all comes down to access – who has access to what on what device at what time. How do you enforce changes as your business changes? Let’s take a look at a few features that will help.

 

Authentication and Authorization

802.1x – It doesn’t matter if it is wired or wireless, 802.1x provides a great level of control over network access. Being able to throw a connection to a quarantine VLAN if/when needed keeps internal data and services safe.
Device Profiling – Having specific information about devices on your network can help create workflows and enforcement policies. It allows you to know what behavior you should expect from the device, and take action when that device is exhibiting unexpected behavior.

Identity-based Security – Not everything connects to the network through a wired port. The system needs a way to find out who is on the network, so that it can enforce proper permissions to its users.

 

Network Access Control Services

Device Differentiated Access – Being able to control not only who has access, but by what device, can help keep expected connections safe and unexpected connections off the network.

Managed Guest Access – Setting up an open Wi-Fi network with an Internet connection is not a guest network anymore. Bandwidth throttling, self-registration, and connection length monitoring are a few capabilities you need to have to provide a safe guest network.

Health/Posture Checks – Making sure that trusted devices are staying compliant before they reconnect to the network keeps networks safe.

 

Architecture and Coverage

Scalability – You never want to paint yourself into a corner when architecting a solution. Business growth shouldn’t mean ‘ripping and replacing’ architecture. Scalability is key.

Context Capture – Sharing information between systems can be extremely valuable. Why can’t your NAC solution benefit from information that your MDM solution has?

3rd-Party Integration – What happens when two companies merge? Often times, multiple hardware platforms are a result, but multiple connection scenarios shouldn’t be. IT needs a solution that has the ability to control a wide breadth of hardware, so the users see the same connection experience, regardless of what they are connecting through.

 

Management and Visibility

Workflow Automation/Template-Based Simplicity – Workflows should be easy enough for users to follow successfully, yet structured well enough that IT gets the information they need from them. These workflows can be created from templates – standardized, that all IT tiers can support them and a win-win for both users and IT staff.

Intelligent Reporting – This term shouldn’t seem like an oxymoron anymore. With a system that is natively aware of all of its parts, reporting should be simplistic yet specific. No more need for a flood of reports, just the ability to piece together what you’re looking for.

At the core of these 4 feature sets is security. The individual pieces of these feature sets are useful, but without security being at the core, they are worthless. Deploying security that works behind the scenes without interfering with a user’s productivity is what the industry is yearning for.

3 Steps to Data Security.jpgIf we combine these 4 feature sets together and we make sure that security isn’t just a ‘bolt on the door’ but an actual part of the solution or part of the DNA, what do we get? At its most foundational level, we get IT adapting authentication to mobile requirements. To do this, we really need 3 things – policy, context, and visibility. We need policy to help us control who we have connecting to what and from what device. Context identifies users and their devices and helps keep policies and enforcement current. Visibility is what ultimately allows us to see how effective our policies are, and gives us the eyes we need for effective troubleshooting. Policy, context and visibility are their own separate powerful entities, but making them work together is far more powerful.

So, IT adapting authentication to mobile requirements seems obvious enough. After all, users need what they need and IT needs what they need, but there’s no reason why both parties can’t have their cake and eat it too. Have you met my friend, Aruba ClearPass?

Aruba has put together a pretty sophisticated authentication engine to run access to your network. ClearPass can handle everything – from onboarding devices for part of your BYOD strategy to managing access to your guest network to providing enterprise AAA including RADIUS and TACACS+. ClearPass also has over 100 vendor dictionaries to make sure that regardless of your hardware platform, ClearPass will be able to not only communicate with it but also make sure that your policies are being enforced through those devices. Having all of these possibilities through one product and not bolted on or piecemealed together, helps ensure consistency throughout the entire ClearPass experience.

New Call-to-action

ISG Partners With WSU's ATAI on Data Center and ITaaS

ISG Technology and Wichita State University’s Applied Technology Acceleration Institute (ATAI), announce a new partnership to provide daily end-user support, from desktop application and operating system support, to network administration and dispatch services.

ISG Technology is a full spectrum data center and information technology (IT) infrastructure company that also provides bandwidth, and an array of IT support services designed to help reduce costs, improve efficiency, and safeguard business critical data. A key component of that service is a support center based in Wichita.  Through the partnership with ATAI, ISG Technology will expose students to high engineering technical resources and learning experiences.

“We’re excited to team with WSU to give students in the ATAI valuable real-world experience in our support center,” said Ben Foster, president and CEO of ISG Technology.  “Technology is cresting an innovation wave right now, with increased storage capacity, faster data speeds and virtualization driving advances in cloud computing. It’s exciting for WSU students to experience the many facets involved in IT service delivery first-hand.”

“The timing couldn’t be better,” said ATAI executive director, Kenneth E. Russell, “ISG brings an incredible opportunity for our students, and we look forward to utilizing their expertise.”

Russell believes ISG Technology will be especially helpful as the institute strengthens its key capabilities, including social knowledge and dynamic data analysis.

In addition to providing student learning opportunities, ISG will support ATAI’s internal IT needs and provide ongoing support for projects including on-premises data center support and physical security system design and implementation.

The Applied Technology Acceleration Institute promotes a practical approach to solving complex technology problems and is focused on building strong industry partnerships and providing experiential learning opportunities for students. The institute includes four centers focused on social knowledge; applied research and technology consumption; dynamic data analysis; and commercialization and inventor collaboration. ATAI is a key component of Wichita State University’s Innovation Campus strategy.

Lessons learned from the Bangladesh Bank hack

Years ago, bank robberies were a very physical affair. Criminals donned ski masks and shot automatic weapons in the air, shouting for tellers to step away from the silent alarm buttons. That said, it would appear thieves have decided that this is just a little too much work. Hacking banks in order to steal money allows for the same reward without having to deal with a hostage negotiator.

In fact, the most recent cyberattack levied against Bangladesh Bank shows just how lucrative these schemes can be. The hackers involved in this scenario made away with around $81 million, which is more loot than any ski-masked thug could ever carry away. However, perhaps the most interesting part of this whole debacle is that this is nowhere near what the culprits originally intended to get. Investigators have discovered that the original plan was to take close to $1 billion when all was said and done, according to Ars Technica.

Unfortunately for the individuals involved, a simple typo wrecked what could have been the biggest criminal act of all time. A transaction meant for the Shalika Foundation was spelled as “Fandation,” which tipped employees off that something was afoot. Regardless, this is still a massive undertaking that demands intense review.

“Bangladesh Bank isn’t completely free of blame.”

How did they get in?

To understand how this whole scheme began, it’s important to comprehend how Bangladesh Bank sends and receives funds. Institutions like this rely on SWIFT software, which basically creates a private network between a large number of financial organizations. This lets them send money to each other without having to worry about hackers – or so the banks thought.

Gaining access to the transactions within this network was basically impossible, unless someone were to be able to compromise a bank’s internal IT systems. This is exactly what the criminals did.

However, Bangladesh Bank isn’t completely free of blame here. The only reason that hackers were able to gain entry was because the financial institution was relying on old second-hand switches that cost about $10 each. Considering how much was at stake, pinching pennies in such a crucial department seems incredibly irresponsible in hindsight. What’s more, the bank didn’t even have a firewall set up to keep intruders out.

Once hackers bypassed this low level of security, they were given free rein to do as they pleased. Accessing Bangladesh Bank’s network allowed them to move on to SWIFT, as the cheap switches didn’t keep these two separate. However, the really interesting part of this whole criminal act was how they took the money without anyone noticing.

Why weren’t they discovered sooner?

In order to make off with the cash, the criminals had to access a piece of software called Alliance Access. This is used to send money, which allowed the hackers to increase transactions in order to make a profit. However, Alliance Access also records transactions. This was a big problem for the thieves, as they couldn’t make money if someone knew they were stealing it.

To fix this, the hackers simply inserted malware that disrupted the software’s ability to properly regulate the money that was being moved. On top of that, this malicious code also modified confirmation messages about the transactions. This allowed the criminals to continue to operate in obscurity, racking up millions of dollars without anyone being the wiser. In fact, they would have gotten close to $1 billion if one of these altered reports didn’t have a spelling error.

A small error cost these hackers hundreds of millions. The hackers could have made so much more money if they’d checked their spelling.

However, understanding so much about how Bangladesh Bank’s system worked has pointed investigators to the notion that this was an inside job. In fact, The Hill reported that “people familiar with the matter” know that a major suspect is a person who works at the bank. No one has been named yet, but getting an employee in on the job certainly makes sense.

Network assessments are a must

Regardless of whether or not this turns out to be an inside job, the fact still remains that Bangladesh Bank was incredibly vulnerable to a hack like this. Relying on cheap network switches is bad enough, but not having any sort of firewall is a major hazard that modern institutions simply cannot allow.

This is why every company should consider receiving a network assessment from ISG Technology. Our skilled experts know how to spot glaring vulnerabilities such as these, and can suggest fixes to ensure the security of private data.

The Boardroom vs. IT: Who drives change?

When it comes to ensuring business continuity and keeping all parts working properly, it’s crucial for communications between departments to be easy and effective. You especially want interaction between executives and IT administrators to be productive. In those conversations, if there is any kind of disconnect with either party, bottom lines could suffer.

How does the proper implementation of IT impact corporate objectives? Having the right technology solution in place can make a difference in the long run across the board, but decision-makers sometimes don’t consult their IT departments before investing in something new. According to InformationWeek contributor Andrew Froehlich, this may be due in part to the fact that new technologies are constantly coming out, sometimes so quickly that tech staff can’t keep up.

Shadow IT is creating cybersecurity vulnerabilities for enterprises.

Shadow IT is compounding this issue even further. With the continued implementation of bring-your-own-device policies, extraneous technologies make their way into companies’ networks. Employees are carrying their smartphones and tablets into the workplace and downloading different – and perhaps unapproved – applications to use in their jobs. This creates cybersecurity and compliance issues due to the entrance of unknown actors on the network.

For instance, one study from 2014 on the information systems of health care organizations found that the average provider has 928 cloud services running on its systems – only 10 percent of which are known to their IT departments. In addition, only 7 percent of the total systems on the cloud comply with industry-specific standards. These kinds of statistics illustrate why it’s crucial for the IT department to be involved in the decision-making process of any company. To ensure compliance and maintain security, technology teams and executives need to be on the same page.

Different departments need to work together to elicit the best outcome for a business – meaning that to achieve the best bottom line, communication between IT staff and the executive board needs to be efficient. Computer Weekly contributor Marc Cercere noted that the agendas of both the business technology and IT departments are equally as important to focus on and improve.

For instance, due to the increase in shadow IT and the continuing focus on cybersecurity across every industry, the IT department should be consulted about any change to technology strategy. Instead of implementing tech “solutions” that may or may not solve a company’s problems, getting the go-ahead from the IT department allows every portion of the company to work in unison toward the same goal.

In today’s business climate, technology should align with corporate objectives. You want IT to work in your favor. If relationships within your business between executives and the IT department aren’t up to par, costly disconnect can occur, and business processes can be hampered.

Real Risks of Cybercrime

First of all, there is a saying going around that “it’s not if you’ll get breached, it’s when”. Today, effective protection requires insight into both the nature and motivation of attacks. Unfortunately, most businesses don’t know who is attacking them, why, or what they’re after.

Cybercriminals are no longer solitary figures who carry out their crimes in isolation, but instead part of an ever-expanding network of virtual crime that’s gaining power every day. The evolution of cybercrime has led to the emergence of a crime sphere that’s highly connected, spread out across the globe and alarmingly efficient in terms of their capacity to compromise networks and steal data and money. Businesses can count on the principle of continuous improvement among cybercriminals.

Breaches are not events, they are processes. Today, the worst breaches are not “one time attacks or thefts”. They are system vulnerabilities exploited over long periods of time. This means it is just as important to know when you’ve been breached, and how to shut it down, as it is to prevent the breach in the first place.

The good news? We’ve been seeing some really good solutions coming down the pike, including incident response, compromise assessments and advanced threat management services. The goal of a cybersecurity strategy is to reduce exposure, recover faster and reduce potential damage.

First, you have to know what’s coming. This is about being proactive by identifying vulnerabilities and taking assessment of your capabilities. Second, you need to secure your digital interactions by hardening your defenses – often at the code level. Staff training around common cybercrime tactics is recommended. Third, detect and manage inevitable breaches with robust analytics. Finally, it’s extremely important to ensure business continuity and availability of your IT environments, systems and apps.