Every week, there are new reports of data breaches at organizations of every type. Firewalls and intrusion detection systems can shield an enterprise only from known attacks, so it’s almost inevitable that hackers will be able to penetrate an organization’s systems, or that an employee will download sensitive data to a mobile device or USB drive, which might then be stolen or lost. However, with the right management software, an administrator can control which devices are allowed to access data, prevent sensitive data from being moved to portable devices, and verify that the data on internal or removable devices is encrypted. That way, even if data is stolen, thieves won’t be able to read it.

Symantec’s Endpoint Encryption Device Control, Endpoint Encryption Full Disk Edition and Endpoint Encryption Removable Storage Edition form three prongs of an approach to ensure data security. Device Control allows administrators to set policies on what kind of data can be moved around, whether on the network or to local storage or mobile devices such as smartphones, tablets or USB drives.

Full Disk Edition confirms that the internal drives in a PC or notebook are encrypted; a password must be entered before the device boots, ensuring that unauthorized users cannot extract data from the system. Removable Storage Edition encrypts data on all sorts of media, such as floppy disks, CDs and DVDs, as well as USB and FireWire storage devices. It can also encrypt files as self-extracting archives so they can be e-mailed safely to employees or partners.

Advantages

The three products together form a comprehensive approach to data security, allowing an administrator to prevent data from being copied over a wireless network, via a sync cable to a smartphone or tablet, or onto any type of removable media unless it is first encrypted. It controls all avenues of data movement and can even keep users from making local copies on a PC’s hard drive without encrypting the data.

Policies can be created based on document type, connection type (Wi-Fi, USB, Bluetooth), user or group type, or location in the file structure. An administrator can protect specific applications or directories from being copied to USB devices while allowing a specific user to perform backups. Such flexibility is great, though it can add to the complexity of setup, because there are many options to consider.

Why the Products Work for IT

Device Control allows an administrator to create a policy for data security, roll it out to all the PCs in the organization and automatically enforce the policy. This allows IT staff to block PCs from writing certain files to USB keys or prevent any data from being copied.

A central management server controls policies for all endpoints and can work with Active Directory as well. Administrators don’t have to set separate policies for each PC or user; the organization can deploy different policies based on existing Active Directory groups or set up new ones.

Disadvantages

The three products — Endpoint Encryption Device Control, Endpoint Encryption Full Disk Edition and Endpoint Encryption Removable Storage Edition — must be purchased and installed separately (but this also means that if you need only one or two parts of the functionality, the cost is less). Setting the system up and creating policies takes some thought. An administrator won’t be able to just install the software and begin using it.

Managing vendor contracts, controlling hardware and software costs and optimizing IT assets to meet organizational requirements constitute critical chores for IT professionals. Symantec's Altiris Asset Management Suite 7.1 aims to remove the hassle from IT asset management by giving enterprises the detailed information they need to make smart, informed decisions. Such tools are a necessity in today's cost-conscious workplace.

Altiris Asset Management Suite (AMS) culls data from Symantec's Client Management Suite (CMS) and Server Management Suite (SMS). AMS also integrates with similar Microsoft discovery tools so IT departments can tap installed investments.

Advantages

IT departments often find it tough to tease out relationships between hardware, software, associated contracts, end users and user groups. Altiris AMS takes away the pain of guessing who has what system, who has what installed on their system and when their licenses are due for renewal.

The downloadable suite provides a wizard that assesses whether a system meets the minimum product requirements and will add any missing applications if prompted — a cool feature that saves the administrator time during installation. After ensuring that my hardware met the minimum product requirements prior to the installation, AMS downloaded successfully. The installation and initial setup were painless.

Why It Works for IT

AMS's user interface logically divides hardware and software. An application metering capability provides insight into which applications have been installed, which have been paid for and which are being used. Such information makes this a real cost-cutting tool for IT.

IT managers can also see the full cradle-to-grave lifecycle of an asset, including contracts of all types associated with hardware and software, purchase orders, service-level agreements, warranties and even retirement and disposal documentation.

Administrators can calculate total cost of ownership by factoring in discoverable data such as purchase costs, monthly maintenance fees or chargeback costs. It's possible to customize AMS to include fields specific to an organization and also add non-discoverable information to an asset, such as an additional cost center.

It's also possible to designate who may view asset information by groups, which proves useful for security. For example, IT staff can limit asset visibility of a branch office to authorized people in that office.

Disadvantages

AMS is optimized for and depends heavily on its associated Symantec discovery tools, CMS and SMS. Figuring out these dependencies may take a bit of time and some experimentation. According to Symantec, most deployments consist of AMS coupled with CMS.

With many organisations moving to hybrid cloud and remote work environments, the threat landscape is constantly shifting direction, and maintaining a secure network at the edge is taking centre stage.

There’s significant complexity in delivering a range of different services in an integrated way when needs are continually changing. This is where an integration model such as Secure Access Service Edge (SASE) aims to combine numerous network-based security functions into a simplified approach covering secure web gateways, firewalls, zero trust network access and cloud access security broker functionality — with software-defined wide-area network rolled into one.

SASE is expected to open new pathways to help customers conceptualise the components of a credible network and security environment.

However, first, partners need to nail both their technology and go-to market along with seeking out areas to continuously shape and Boost their integration model.

According to Gartner, the popularity of SASE is expected to snowball over the next few years, claiming it will be the dominant consumption model for WAN edge in new and updated deployments.

Arrow A/NZ general manager Karl Sice noted that customers were moving away from separate vendors and complicated product sets and are instead looking for a simpler unified technology solution that reduces overhead, increases security, is easy to maintain and can also integrate with other existing solutions.

“Migration and services skills are required to transition companies to the new networks, which not only boosts the partners profit, but allows for closer collaboration and ongoing maintenance of the customers SASE environment in the long term,” Sice said.

“Partners are now able to offer mature SASE solutions to their customers that reduce the complexity and cost of their network, Boost security posture of all connections, regardless of their location and Boost network performance of all applications.” 

What are some of the core pillars that make up a successful SASE strategy?

According to Sice a successful SASE strategy for any company should incorporate and integrate a Zero Trust Network Access (ZTNA) strategy, with Firewall as a Service (FWaaS), Secure Web Gateways (SWG), Cloud Access Security Broker (CASB) and SD-WAN/VPN access and connectivity layers.

“Tying all of these technologies together and integrating the management and supervision of the environment is imperative to ensure the integrity of the network is maintained and secured at all times,” he said.

“A successful design, deployment and implementation of SASE not only provides a recurring revenue stream for partners with regards to implementation, management, renewals and support, but also allows partners to leverage their experience across multiple verticals, opening up new markets and opportunities to partners that might otherwise be inaccessible.

“A successfully managed SASE environment is a powerful reference that can be advertised in any market and then adapted to the specific client’s needs.”

Visibility and integration are two of the most important components in managing a SASE model, Sice said. Without visibility, the security of the network cannot be ensured and if one part of the network is unable to integrate with another for user profiles, device types and profiles, an end to end security strategy cannot be maintained. 

“Partners need to be aware of the complexities that companies face in trying to manage ever-expanding and more complicated network environments,” he said.

“Simplifying and unifying their networks with a strong SASE design can reduce overheads and maintenance headaches without sacrificing security. Partners can now leverage best-of-breed SASE solutions that provide enterprise class security controls and visibility and are easy to maintain and support.”