Business Security Information

While trying to catch up on some of my reading this week, I came across an article from the December 14, 2009 edition of Forbes magazine which discussed computer-controlled vending.  A vending machine is equipped with an add-on box which captures all the transactions and transmits the information back to the company.  The boxes can also send an e-mail or text message when a vending machine sells out of an item.  This type of electronic device saves the vending company money in lower fuel costs and more efficient use of their manpower.  If you are interested in learning more, you can check out the website for Cantaloupe Systems .

A couple of weeks ago I went with my family to get some pizza.  It was one of those day we had been rushing around and just wanted to get some good hot food, so pizza it was.  Like most food service businesses, this one had a security camera system that was visible as soon as you walked into the store.  While I was standing there waiting for our pizza, I started looking at the positioning of the security cameras.  What I noticed was that the security cameras covered the cash registers and other employee work areas, but the camera system did not cover the customer area in front of the checkout area.  With this positioning of the cameras, their purpose seemed to be just to monitor employees work and to address internal theft issues.

I just got done watching this short video (2 minutes) on installing a security door plate on a residential door with a wood frame.  It showed how this security plate could provide another layer of security against a criminal that tries to break in by kicking down your door.  As you watch, you will see that the door leads to what appears to be the speaker’s home office.  Although many commercial structures have metal doors with metal door frames which do not need security door plates, I have seen numerous offices and other commercial buildings which have exactly the same type of doors with wood frames where security door plates would have helped reduce the risk of someone kicking down the door.  Also, note that the security door plate helps the deadbolt lock resist such an attack (the door entry lock or door handle lock really is not affected by this security measure.)  Along this line, I would recommend that you install deadbolt locks on your exterior doors if you have not already.  Make sure any exterior door locks you use are resistant to lock bumping (read the definition and watch the videos on lock bumping to understand the dangers from this type of attack).

In the picture, you can see that this business first installed metal bars to protect against someone from breaking in through the window.  As you can tell from the cut and bent bars, that was not enough security so the business went to the next level which was to remove the window and then fill the opening in with bricks.  For most businesses that are trying to protect themselves from a break-in, this  would be just too ugly of a solution.

Do you have any exterior doors at your business that have hinges on the outside, like the one in this picture? If so, you may be at risk for a simple break-in method. Even though the door is locked, someone can easily remove the hinge pins from the exterior-facing hinges and remove the entire door, allowing easy access. One way of reducing this risk is to use what are called “jamb pins”. Refer to this picture of commercial jamb pins to see what I am talking about.

Commercial Jamb Pins

In recent articles, I have spoken about PCI compliance and about security tools that can help you identify sensitive information on your computers .  While talking about PCI with a company recently and as I write these articles, I realized that there is enormous amounts of open-source software that can assist businesses in complying with some of the elements of PCI.  I have included a list of possible open source software that you might find useful when working on the different elements of PCI.  I use open-source software for a variety of elements in my business and personal life and find it comparable or superior in many ways.  Of course, there is usually a learning curve when working with any new software whether open-source or purchased.

In a recent article on PCI , I discussed the need to know what sensitive information your are storing or have on your systems.  How, then, do you discover or determine what sensitive information is on your computers and other endpoint devices?  An endpoint device is basically the starting point or final destination of all information or data going over a network.    They include, but are not limited to, laptops, personal computers, servers, network appliances, network-attached storage, or any other type of device that can connect to a network using wireless, Ethernet or a modem.  Depending on your network, this can include many types of devices which makes securing your information even more important.

As I have discussed in a previous article on UTM devices, the need for such devices came about because securing a network became more complicated.  This resulted in  the number of security devices needed to protect the network also increasing.  Instead of just a firewall, now intrusion detection, anti-virus protection, content filtering, and a variety of other resources were needed to adequately protect the network.  Along with the different devices came different interfaces to manage the technology which was difficult for small business to manage without having a number of staff knowledgeable in the different types of technology.  Since most small businesses cannot afford to hire additional staff, the UTM devices allowed less staff to manage and maintain them.

In the last post, we discussed UTM devices and how they may benefit your business.  The purpose of this post is to provide you with sources of UTM devices so you can research specific devices and the features of each.  Here is a list of UTM providers that were  gathered from a few different articles published in 2008 and the beginning of 2009.  The list may not be complete since there appears to be new providers coming out all the time, but this list will get you started.

1. Ahnlab            www.global.ahnlab.com
2. Arkoon            www.arkoon.net

First we can not talk about something if we do not know what it is so let’s define this term of “Unified Threat Management”.  Unified Threat Management (UTM) basically is a firewall that has a variety of features and capabilities beyond just a firewall.  It is a device that can include such features as intrusion detection, intrusion prevention, anti-virus, spam filtering, content filtering, instant messaging security and other similar types of features.  Please note that this is not a complete list of features because these devices are continually changing, and different features are offered by different vendors.