How to pin down tricky portable media in your security policy
While imperative to the protection of critical infrastructure, securing portable media devices is not easily done
According to research performed by Lloyds of London insurer, Aegis London, in the first half of the 2013 fiscal year, the US Department of Homeland Securitys Industrial Control SystemsComputer Emergency Readiness Team responded to more than 200 incidents, 53% of which were in the energy and utility sector, and many of them sponsored by states such as China.
Efforts to improve the security of critical infrastructure systems like nuclear power plants and water treatment facilities have accelerated at a rapid rate since the issuance of US Executive Order 13636, 'Improving Critical Infrastructure Cybersecurity', on February 12, 2013.
As attacks become more sophisticated and digital control systems increase in complexity and levels of automation, it is increasingly difficult to prevent threats from impacting the operation of critical infrastructure. As a security measure, most critical infrastructure systems are air-gapped, or isolated from external networks.
> See also: Data security - 9 tips for senior managers
Because of this, portable media is a primary vector for cyber-attack; it is often the only way to transport files to and from secure areas. As key attack vectors for malware, it is extremely important that extra attention is placed on securing the portable media devices that are brought in and out of a secure facility.
While imperative to the protection of critical infrastructure, securing portable media devices is not easily done, and there are many requirements that can impact the portable media security policies for operators of critical infrastructure. In many cases, there is no single source for an organisations portable media security policy, and individual facilities may require unique security policies.
Security balancing act
When making decisions about security policies for a critical infrastructure facility, the costs of implementing a stricter policy need to be weighed against the potential costs that could result from the failure of a weaker policy. The solution for each organisation will vary based on the requirements necessary to meet their security and business objectives.
Increases in digital security rarely come without a corresponding increase in operating costs. These costs include purchasing a security solution, implementing this security solution, and finally managing and maintaining the solution. Initial costs often include the physical infrastructure necessary to deploy the solution, such as servers, kiosks and networks, as well as the consulting services that are often required to implement the solution correctly.
Go here to see the original:
How to pin down tricky portable media in your security policy