Business Security Information

I was thinking about how busy life and business seem some-days–today being one of those days.  It got me pondering how complicated security can be for a business, especially computer security issues.  Fortunately there are some simple things that can be done to protect PC’s in your business without you  having to spend enormous amounts of time or money–things that you can do right now!

Web Application Firewalls

Web Application Firewalls are a market that is still hard to define, meaning what one vendors says is a web application firewall may not be what another defines as such.  For right now, many products fall under the web application firewall term.  For a business such as yours, this makes it hard to evaluate and compare products.  To overcome this confusion, first look at what your security needs are, the structure of your network, and the applications that are you using.  Then, look at what is available that fits your criteria.  Just by doing this first, you will narrow your search down from many to probably a few products that you are interested in researching and maybe testing further.  A few requirements for a web application firewall include:

This article covers a somewhat complex and lengthy security topic so I am breaking it into two parts.  The first part will discuss web applications, what they are, and the basics of website security including web application firewalls.  The second part of the article will go into more detail regarding web application firewalls, the PCI standard pertaining to web application firewalls, and, lastly, UTM and web application firewall capabilities.

Web Applications

In recent articles, I have spoken about PCI compliance and about security tools that can help you identify sensitive information on your computers .  While talking about PCI with a company recently and as I write these articles, I realized that there is enormous amounts of open-source software that can assist businesses in complying with some of the elements of PCI.  I have included a list of possible open source software that you might find useful when working on the different elements of PCI.  I use open-source software for a variety of elements in my business and personal life and find it comparable or superior in many ways.  Of course, there is usually a learning curve when working with any new software whether open-source or purchased.

As I have discussed in a previous article on UTM devices, the need for such devices came about because securing a network became more complicated.  This resulted in  the number of security devices needed to protect the network also increasing.  Instead of just a firewall, now intrusion detection, anti-virus protection, content filtering, and a variety of other resources were needed to adequately protect the network.  Along with the different devices came different interfaces to manage the technology which was difficult for small business to manage without having a number of staff knowledgeable in the different types of technology.  Since most small businesses cannot afford to hire additional staff, the UTM devices allowed less staff to manage and maintain them.

First we can not talk about something if we do not know what it is so let’s define this term of “Unified Threat Management”.  Unified Threat Management (UTM) basically is a firewall that has a variety of features and capabilities beyond just a firewall.  It is a device that can include such features as intrusion detection, intrusion prevention, anti-virus, spam filtering, content filtering, instant messaging security and other similar types of features.  Please note that this is not a complete list of features because these devices are continually changing, and different features are offered by different vendors.