The IT/IS interface: defence tools

Yaroslav Yasenkov, Security Vision

Introduction

Practice shows that the goal of achieving information security arises for companies that have reached a certain level of maturity. On the way to achieving this maturity, the volume of processed information increases, and the risks of loss or leakage of such information grows. At the same time, the number of staff grows. Expansion of the staff leads to the separation of goals and tasks assigned to responsible persons. And where goals are divided, conflict situations inevitably arise. Separation of IT and IS divisions of the company is no exception.

The development of such conflict situations can negatively affect the efficiency of the company as a whole. That is why it is important to understand the main points of contradictions between IT and IS departments and make a number of organisational decisions that can minimise such situations and direct the work of specialists in a fruitful direction.

Problems of interactions

One of the main problems is the lack of mutual understanding between IT and IS specialists. As a rule, the main goal of the IT department is to automate and improve the efficiency of the company's processes. The main priorities of IT in this case are speed, simplicity and cheapness. And this can be relevant both for the IT department, which creates automation for use within the company and for delivery to the customer. At the same time, the IS division has the goal of reducing information security risks and achieving the notorious state of information security. Such a state cannot be achieved by quick, one-time actions, but requires planned long-term organisational and technical work. In practice, this leads, for example, to the fact that the IT department may strive for the fastest and unlimited availability of information, while the IS department in every possible way ‘puts sticks in the wheels’ by restricting access to information.

Another problem is the lack of information sharing between IT and IS departments. The IT department may not always provide sufficient information about new systems, upgrades or infrastructure changes, which makes it difficult for IS specialists. The IS department, in turn, may not sufficiently inform the IT department about new threats or security requirements, which can lead to vulnerabilities in information systems.

Finally, financial constraints can be another issue between IT and IS departments. The IT department may feel that improving security requires additional costs that may not be acceptable to the company. The IS department, in turn, may feel that the IT department is not devoting enough resources to security.

Approaches to overcoming problems

The following approaches can be used to overcome problems in the interaction between IT and IS departments in the company:

- Establishing clear communication: it is important to establish communication channels between IT and IS departments to ensure that information is regularly exchanged and security issues are discussed. Regular meetings should be organised to discuss current tasks, problems and plans. This will help to improve mutual understanding of goals and objectives and consistency of work.

- Training and development: Training and seminars should be organised for IT and IS specialists, with the role of teacher rotating between the IT and IS departments. This will help to improve understanding of each other and reduce conflicts due to different approaches and priorities.

- Develop procedures and policies: The company should develop uniform procedures and policies that address both the needs of the IT and IS departments. For example, procedures can be created to share information about new systems and infrastructure changes, as well as security policies that establish requirements and measures to protect data.

- Management involvement: management should be actively involved in resolving conflicts and supporting co-operation between IT and IS departments, as well as mediating disagreements and making decisions that take into account both security and performance needs.

- Allocate sufficient resources: the company must ensure that it has sufficient financial and human resources to ensure information security. This may include hiring information security specialists, purchasing the necessary hardware and software, and conducting security audits and testing.

It should also be remembered that the joint use of IT and IS defences by business units can provide a number of benefits and advantages for both parties, as well as improving the efficiency of work processes.

How IT defences work

Knowing the performance of firewalls, proxies, intrusion detection systems and other tools that monitor network activity and detect anomalies or suspicious behaviour can help IT better understand the current threat landscape and design and configure infrastructure in an optimal way.

The use of vulnerability scanners will allow you to find weaknesses in your IT infrastructure and quickly receive recommendations for remediation. Code analysers will allow you to identify flaws in the software being developed at an early stage of development and take measures to eliminate them, which will optimise development costs.

The use of access control tools will help to protect data from unauthorised access and changes. This is especially important for the IT department, which is responsible for storing and processing large amounts of information.

The use of GRC class tools will increase the efficiency of both IS and IT departments. It will help to automate and ensure the processes of compliance with information security requirements.

SIEM class systems, the main function of which is to analyse and correlate events, can be used by the IT department to monitor the availability of information systems. In the event of a failure or unplanned outage of an event source, the SIEM will be able to inform administrators that a failure has occurred. SIEM correlation rules can also help in monitoring information systems, as they can detect different kinds of deviations in the normal flow of events.

Another example of a system that can be equally useful to an IT and IS department is IDM. IDMs allow centralised management of user access to various IT resources and automate access management processes such as creating, changing access rights, deleting and blocking user accounts. This, on the one hand, reduces the time and resources spent by the IT department on account management and, on the other hand, allows the IS department to exercise control over the processes of providing access to information resources and ensure compliance with regulatory requirements.

Information security tools are the main source of information about incidents occurring in the infrastructure. But to ensure effective information security, it is also important to pay attention to communication between the IS and IT departments. Based on the results of incident investigations, IS specialists accumulate knowledge about the shortcomings of the existing information infrastructure and ways to strengthen its security to eliminate the possibility of similar incidents in the future. Therefore, it is crucial to ensure that such knowledge is transferred to the IT department.

Conclusions

In general, the joint use of information security tools by IS and IT departments, as well as their effective interaction, will help to improve the security and reliability of the company's information systems, accelerate the detection of and response to information security incidents, meet regulatory requirements in the field of information security, and ultimately reduce the use of resources, including financial budgets, personnel and infrastructure, as well as lead to optimisation of the company's processes, improved productivity and reduced costs.