Why turning off can be a turn-on

A multi-faceted approach to automation can help companies save cash and improve their security

Nursten: Improving security and the environment go hand in hand

As attitudes to environmental policies change globally, organisations will come under increasing pressure to reduce consumption associated with power-hungry ICT equipment left on 24x7 irrespective of use.

Many organisations have recognised the bottom-line benefits of a greener approach to business. In addition, it helps cut costs and generates a feel-good factor for staff.

Yet there is another significant and as yet unrealised benefit: improved security. As recession-led security concerns grow about disgruntled ex-employees potentially joining the numbers of malicious intruders attempting to access the network, the ability to lock down systems ever tighter without incurring untenable cost has strong appeal.

Turning off unused equipment out of hours ­ from desktops to servers, Wi-Fi access points to telephones and switchboards ­ radically reduces the number of available attack vectors, and thus significantly reducing the security threat as it reduces carbon footprint and energy costs.

Unused desktops are prime targets for attack from viruses, trojans, malware and spyware, as they provide access to the corporate network. Such security breaches rely on equipment being left idle so an individual can take control remotely.

Yet the latest generation of technology can shut down an unused desktop automatically during evenings and weekends.

Similarly, individuals often look to exploit a less robust security policy associated with development environments and non-production servers. Security patches are not always applied as frequently as in production environments, and because this area of the network may not be used daily, it is not continually monitored.

Yet these machines typically have public IP addresses to enable testing and collaborative developments, making them prime attack vectors. Shutting down these machines when they are not active reduces energy use and removes a clear security weakness from the network.

Wi-Fi access points are a well-known security risk. The current generation of wireless technology is now locked down and secure, but there are still countless unsecured wireless networks providing access to corporate networks.

Breaking into these networks does require a brute force approach, using technology to guess passwords in an attempt to gain entry.

Switching off such networks overnight and at weekends limits the chances of a brute force attack succeeding. While phones are less of a security threat, they are prone to employee misuse, with some individuals re-routing company phones over weekends and evenings to make long-distance calls to friends and family.

Turning off both handsets and switchboards overnight and at weekends represents a massive energy saving ­ and reduced phone bills.

Of course, many businesses encourage staff to switch off desktops at the end of each day. But most forget, and the strategy fails to address a raft of other devices, including phones, switchboards and servers. No organisation wants staff randomly unplugging systems every night.

VARs need to understand network use across customer organisations. A network use audit carried out over a month may assess cyclical patterns, including back-up processes and regular data transfers around business continuity and disaster recovery policies.

Once these patterns are understood, a business can determine use policies and deploy technologies to turn off equipment automatically and, in the case of switch ports, if left unused for a specified time.

This latter strategy may require some administration, such as requiring an individual to request the switch port to be re-enabled, but can really slash the risk of an outsider accessing equipment.

It does not offer all the benefits of network access control (NAC) but it does provide a major security benefit.

Cut noise, improve security, save money
Turning off unused devices also reduces the noise on the network, minimising
the strain on firewalls and intrusion detection systems and making them far more effective.

Corporate social responsibility (CSR) reduced across many organisations this year. However, as one leading UK bank discovered, simply turning off its phone handsets when they were not being used (60 per cent of the time) saved £2.5 million.

Automation is key. By combining an understanding of network usage with technology that automates the switching on and off of devices across the network, organisations can reinvigorate the CSR strategy, save costs and, critically, improve security by eliminating the availability of attack vectors at the key time of vulnerability ­ out of hours.

Scott Nursten is managing director of secure networks specialist s2s and systems integration director at NG Bailey