Issue 2

Digg This!

The continuance of malicious computer attacks has made security a front page topic in almost every boardroom and IT oversight committee. Most IT departments accept that routine updates to software operating environments are a necessary part of managing systems.

It's not hard to convince the IT professional that the protection of data assets forms the foundation of recovering from a disruptive event. But very seldom do we think of security, systems, and storage management as part of a seamless and holistic approach to securing the enterprise. Considering the rate at which vulnerabilities show up in our computing environment and the speed at which they can be exploited, we need to rethink how these three management environments should be leveraged - after all, "The only truly secure infrastructure is a managed infrastructure!"

As the list below suggests, the administrative job of managing and securing the enterprise is complex and convoluted, with loosely integrated software that attempts to automate the normal operations of the enterprise.

• Firewall management
• Virus definition updates
• Data backup
• Applications update
• Software licensing compliance
• Vulnerability assessment
• Disaster recovery
• Storage provisioning
• OS upgrade and provisioning
• Archive policy
• File recovery
• Asset inventory and reporting
• Repurposing
• Common operating environment policy
• Patch installation

However, in today's heavily exploited environment we must ensure that the security, systems, and storage management elements of the infrastructure can not only manage during normal conditions but also manage effectively through the disruption of an exploit. Stated differently, security, systems, and storage management systems must effectively manage during normal state and disruptive state conditions. Clearly, the disruptive case is the more difficult state to manage.

What Is a Disruptive State?

When an enterprise has entered a disruptive state it is a serious change in status, evidenced by the number of IT executives that suddenly are visible in meetings, phone calls, and triage sessions. The entire enterprise enters a lockdown as the IT departments identify the threat, determine the vulnerabilities, plan corrections and wait for an exploit. The entire enterprise is holding its breath. The IT organization works long hours to secure servers, desktops, laptops, and most recently, handheld mobile devices. Often the more controlled process and management automations succumb to the deployment of individual experts to manually correct known problems and hunt for leaks in the infrastructure. The frequency, duration, and damage that occurs during disruptive states gives rise to new challenges faced by IT management products.

Managing in the disruptive case requires that the management software be capable of managing through three basic transitional phases: understanding the disruption, controlling the transition, and finally, acting in a way that returns the system to the normal state. This proactive security system must rely on the underlying infrastructure to take action and remediate the disruption; therein lies the critical connection between security, systems, and storage.

Understanding Phase

The system must understand and articulate the origin and nature of the disruption. Security sensors provide the knowledge and understanding necessary to warn enterprises of impending disruptive states.

Control Phase

Once the management state is recognized as "disrupted," action must be taken in a controlled fashion with the goal of returning the system to its normal state. The control phase provides the rules of execution and the instructional intelligence that the infrastructure must follow during the act phase.

Act Phase

During the act phase the infrastructure must respond to the disruption in a way that restores it to a normal or "safe" state. Act phase activities include many of the same tasks that are undertaken during the normal state but with an increased focus on the speed and reliability with which they occur. As an example, security patches must be deployed quickly without disruption, whereas the normal process of upgrading operating systems and applications is typically done as a normal course of change management. While security patches are being planned and deployed, the enterprise is vulnerable to damage.

Systems and data recovery is another example of similar processes being executed in the normal and disrupted state. Traditional backup systems back up data during normal operations, but they very seldom focus on processes that will allow a recovery within the window required by most disruptive events. Since many normal and disruptive state management tasks are similar, it is logical to conclude that if we architect for the disruptive state we will also realize improvements in the responsiveness of the normal state management tasks.

It is important to recognize the enterprise-wide scope of managing in the normal and disrupted state. During the transition phase the management software must be capable of connecting to and managing the entire computing environment. This environment includes servers, network devices, desktops, laptops, and handheld devices in both wired and wireless environments.

The Problems

Consider three key pain points often highlighted during CIO discussions.

Provisioning

The challenge of migrating and building systems at the rate of arrival of new operating systems has become so difficult that some CIOs see it as a career-threatening event. The process involves determining, first of all, what exactly is on every machine in the enterprise, setting the standards for a new operating environment, preparing that environment for deployment, and then finally deploying the change. The whole process takes significant manual activity and expertise and can be so difficult that many organizations still have yet to migrate to Windows XP while a new Windows environment is already inevitable with Microsoft's Longhorn. Provisioning is traditionally a normal state management task, but it is a good example of an area that needs significant improvement through automation.

Patch Remediation

The ability to completely patch and configure machines presents a large problem - primarily because the threat landscape evolves more quickly than the patch process can update the software. Viruses such as Sasser and Blaster are proof that virus writers will continue to exploit vulnerabilities - Sasser was released into the wild less than three weeks after Microsoft announced the vulnerability it exploited. The window of opportunity in which IT can react to vulnerabilities continues to decrease. Patch management is mostly a disruptive state application, but as stated previously, it can be thought of as a highly responsive component of normal state provisioning.

Protection and Recovery

It goes without saying that generally data should be protected, but organizations should also have a backup and disaster recovery plan that will help them recover in the event of a successful attack. Data recovery has become a heightened concern because the rate of attack is increasing, so the probability of having to recover is higher. Additionally, having an infrastructure where the accuracy of financial reporting, the privacy of personal information, security, and other process certifications is becoming the personal responsibility of executives. This level of infrastructure accountability is driven by regulations such as Sarbanes-Oxley, HIPAA, and FISMA. The scope of recovery solutions must include desktops, PDAs, servers, and laptops; and must have recovery times that are measured in minutes.

The Strategy

It is becoming increasingly clear that if we are to evolve the task of managing our infrastructure we need to manage both the normal and disrupted states of the enterprise's operation. Ideally, an organization might have a modular suite of applications that participate in the management of the transition from normal to the disruptive state and back again in a controlled and safe manner. The applications strategy is made up of five modular parts:

• Installation design: A virtual design environment that simplifies the creation of installation and recovery packages. The goal is to improve and reduce the amount of expertise and effort required to create an installation environment.
• Software provisioning and delivery: A centralized delivery environment that automates the local and remote installation of computer operating environments.
• Patch management and help desk operations: Local and remote operations that assure the currency of software and automate problem management.
• Asset management: This is one piece of the life cycle that is often taken for granted, but it is an important foundation. Auto-discovery, inventory, software usage and license monitoring, plus disposal, repurposing, and reporting are elements of the asset management used by most of the applications in this set.
• Protection, recovery, and archive: A hardware-independent, local and remote, automated backup, recovery, and archive environment. IT needs the ability to get to full working condition in a short period of time.

A holistic strategy will allow IT organizations to become more efficient - personnel will have more time to focus on important projects rather than dealing with urgent security issues. By involving all relevant IT and management groups with a common goal of securing the enterprise, the solution becomes fully integrated, rather than fragmented. The benefits are numerous, including increased security and availability, reduced human intervention, competitive advantage through rapid response to change, and improved governance and compliance.

By implementing a scalable, platform-independent architecture that addresses security, storage, and systems management, IT will find it much easier to stay on top of that checklist.

"The only truly secure infrastructure is a managed infrastructure!"