Security Enforcement

The assurance of security is a major concern and means to enforce that into an organization or individual system is known as Security Enforcement.

Organizational Security Enforcement:

1. BYOD[Bring Your Own Device]: Many organizations approve BYOD to reduce infrastructure costs. But it is a major security hazard. A proper log should be maintained as to how many devices are being brought inside the organization. Specific policies should be issued with respect to BYOD; as to what devices are allowed inside the workplace. Websites that could harm the integrity of organization should be given IP ban to increase the security. Use of VPN to bypass IP ban should be penalized heavily.

BYOD

2. Security Hardening: Apart from the well known defense mechanisms, some additional security hardening measures should be taken inside the organizations. Some of them are:

a. Patch Known Vulnerability: The known vulnerabilities should be patched as soon as they are found to reduce the risks. Ignoring known vulnerabilities could invite threats inside the organization, which is never recommended.

b. Remove Unwanted Services: Every services can have known as well as unknown vulnerabilities. If there exists a service which is not being used it should be removed to flush out vulnerabilities.

c. Enforce Password Complexities: Simple passcodes that are straight forward can be hacked easily and cause massive losses to the organizations. Thus a policy should be implemented to use passcodes that contain various combinations, such as, Capital letters, Small letters and special characters.

d. Close Unused Network Ports: Threats and attacks generally enter through open ports. So, if there exists ports that are currently unused, they could be closed to prevent unwanted threats and attacks.

e. Remove Default Accounts: Using default user names and passwords to access the server should not be allowed, as it is a major breach to security.

f. Configure and Manage User Privileges: A hierarchal system should be maintained in the organization as to what privileges can be accessed by an induvial depending on the role or position they hold in the organization.

Few other hardening to improve security are:

. Application Hardening

. OS Hardening

. Server Hardening

. Database Hardening

. Network Hardening

3. Data Protection: The organization should enroll policies to protect their data. RAD model can be used to implement data protection. A disaster recovery plan should be present. Backup and Restore policy is also very important to prevent losses in case of accidents.

4. Access Control: The organization should have control on who can access which part of the system.

Types of access control:

. Administrative control

. Physical Control

. Technical Control

Models of access control:

. Discretionary Access Control(DAC)

. Mandatory Access Control(MAC)

. Role Based Access Control(RBAC)

. Attribute Based Access Control(ABAC)

5. Training: In the recent scenarios security is not given as much importance as it requires. Every employee should be trained about the good habits of cyber security, and how to manage risks and deal with threats.

Individual Security Enforcement:

1. Safe Surfing: Users should be aware of where to share information and which cookies to accept while surfing the internet. Malicious websites should be avoided to protect the confidentiality and integrity of the user. Any unknown URLs should be blocked immediately.
2. Password and Identity Management: Proper passwords should be used and generic passwords should be avoided to reduce risks of attacks. Sharing Identity should be done with caution to reduce identity theft.