Facing network breach threats, visibility is key

If the past three years have taught network managers anything, it's that everyone is vulnerable to a network breach by cybercriminals. This isn't breaking news to IT pros in the financial services industry, where sensitive data is abundant -- as is the number of bad guys looking to get their hands on it. In this edition of "The Subnet," we catch up with Andy McInerney, data network and voice manager at Penn Mutual, one of the oldest mutual life insurance companies in the United States.

What are you working on these days?

Andy McInerney: Some of the major initiatives include upgrading our Unified IP [platform from Aspect], which is our call distribution system for our customer service center. It's a pretty substantial project. We're also entertaining a major distribution switch upgrade. We're also building out DMZ infrastructure using our Palo Alto appliances.

What's your take on all the big network breaches lately? As someone in financial services, you must feel like you have a target on your back.

McInerney: Yeah, we do. We're sensitive to that. We definitely take the approach of a layered defense. We're trying to reduce the attack surface, so everything that we do is based on that premise of taking a layered approach.

We're looking at email, obviously. A lot of these things begin and end with email, so we're really taking a wholehearted, focused look on [user] education in the form of best practices. Targeted phishing is a big thing, so we're trying to reduce the likelihood of getting a targeted phishing attack or campaign that can actually [inject] any sort of data flow that will put us at risk for a breach. We've done a pretty good job on the ingress/egress side from a hardware perspective. We're focused on end-user behavior and email as the mechanism, with phishing as the method.

What technology are you trying to learn more about these days?

Andy McInerney

McInerney: We're looking toward the cloud, and with that comes the need for -- more than anything -- the Layer 7 capabilities that exist from an ingress/egress standpoint. That, to us, I think is most important because it gives us that deeper visibility. It gives us that look into what traffic flows east, west, north and south. That's a big vernacular with me, and it's probably pretty saturated throughout the industry -- getting that visibility into the actual traffic. And that dovetails into the whole [discussion about] security and limiting the breaches as well.

Knowing what you know now, what career advice would you give your 22-year-old self?

McInerney: Back then, I was in this industry. I was in the military within information systems and security, but it was a totally different world. The one thing I never envisioned is the maturity of the Internet, so I guess the one thing that I probably would've focused more on would be the impact on PII -- an emphasis on how to control personally identifiable information and the [consequences] surrounding it.

When I first started in networking … security was in the vernacular but it wasn't the emphasis because the Internet wasn't as pervasive.

I would've told myself back then to be more ardent in [developing] my networking skills toward security. Because back then, when I first started in networking, security was in the vernacular but it wasn't the emphasis because the Internet wasn't as pervasive.

There's a book called The Cuckoo's Egg. It's an incredible story of, back in the '70s, the first case of Internet espionage. It wasn't really PII-oriented, but it was an incredible read into what's actually happening today. It's not quite the same; it's obviously a bit more sophisticated and mature today.

The focus on security has evolved as the threats have emerged, based on the rapid decentralization and increase of the Internet as a whole -- and how companies and corporations do business [using that technology]. We didn't know back then that it was going to grow to what it is today. So I think that would be the one thing I would've told my 22-year-old self: Maintain pace with the external threats and the bad guys.

And the people launching attacks are really different now too -- they're not just kids looking to cause a little mayhem.

McInerney: It's a billion-dollar-a-year business. You remember that movie "War Games" with Matthew Broderick? It was about this kid using analog and dial-up capabilities to hack into a government system and play a game. That's how it used to be.

There's a [financial motive] for everything now, and the [source of the threats] is international. Getting back to why my biggest focus now is on Layer 7, we have the ability to geofence and geo-block within our environment -- ingress and egress. Where do we see most of the threats coming from? Are they coming from the Russian bloc? Are they coming from the China bloc? Are they coming from the Korean bloc? We have the capacity now, with these new appliances, to inhibit traffic inbound and outbound to those undesirable domains.

You mentioned that you started out in the military. How did you get into IT and networking?

McInerney: I joined the Air Force with a dedicated job of information systems specialist back in the '80s. It was way before the digital age. It was analog-based, but it was so good. It set me up for where I am today. I got out of the service, and I went to work as a computer operator at Princeton University, at a [Department of Energy]-funded nuclear fusion reaction project, and learned a little bit about programming, did this and that, and worked myself into a little bit of digital VMS systems manager.

Then I got a job at Cigna and was doing the same thing. I had an opportunity to help out with the network group where it was really just one person, the manager, and the network was growing. I basically just learned on my own and learned from him, a great mentor, and really self-developed everything I've been able to achieve over the last 25 years. I got certifications and increased responsibilities at different intervals and have just grown into where I am today.

OK, let's look a little further into the past. If you could go back in history, who would you like to meet?

McInerney: Maybe because I have a military background and have a couple of sons in the military, but I think it would be somebody like FDR [Franklin D. Roosevelt] or [Harry] Truman. The decisions they made were so impactful to our history and the world order -- World War II, getting us involved in the Pacific engagement, the Pearl Harbor attack. Truman made the most poignant military decision probably ever of any president ever had to make. It's something that's always intrigued me.

It could also be Jim Morrison, from a musical standpoint, which would be a totally different conversation....