A CURE FOR SECURITY: A CONVERSATION WITH EQUANT'S ALAN SIMPKINS

Alan Simpkins has managed security for infrastructure solutions developer Equant’s multinational customers since 2001. Before taking on his current job, he spent eight years in both the public and private sectors managing security networks. He has also designed systems for both the U.S. military and the U.S. stock exchange. He spoke with Telephony’s Kevin Fitchard about the trends shaping the future of enterprise security.

On the current state of security among corporate networks: The market is operating on the edge of the abyss right now. You might think that’s an exaggeration, but it’s really not. One of the services we offer at Equant’s security practice is a service that tests the security measures of company’s network. The idea being if you build a house with a modern, state-of-the-art security system, the best way to test it is to hire someone to break into it. In my time, we’ve done this to dozens of networks. The amount of companies that stopped us from breaking in, I can count on one hand. And most of them time when we went back to the company to report our results, they had no idea they’d just been broken into.

On the factors that will encourage companies to think more about security: A big one will be executive accountability. Executives can’t blame this on IT people anymore. They’re the ones that make the decisions and they realize the risks are out there. More executives are starting to think ‘what happens if there is a breach?’ ‘what happens if my financial data winds up online two before we release it?” “What happens to me after that happens?” There are so many examples of situations where an executive could have taken action, but didn’t--and it cost them their jobs. They’re beginning to realize that the difference between success and disaster could come down to one simple decision.

On the role of regulation in network security: A lot of people don’t seem to realize that regulation has become one the biggest issues in managed security today. A lot of multinational customers have offices in dozens of countries and customers in hundreds. Each of those countries has different set of rules to abide. In the U.S. individual states have their own regulations. California has just allowed class action lawsuits against companies that allow information about California residents to get out. The German government says you have to have all German citizens’ data stored on a server in Germany. You’d be surprised how many multinationals do business in countries whose regulations they haven’t a clue about.