Staying Ahead of the Bad Guys
Cyber security (and lack thereof!) is in the news constantly. From the recent security breach at the Texas Comptroller of Public Accounts, to the LinkedIn hack, it seems no one is safe. Bridgepoint Consulting recently hosted Chief Audit Executives in Austin to discuss this topic is more detail. We asked CSID, a global provider of enterprise-level identity protection, fraud detection and technologies, to provide insight on emerging security threats. Here are a few key points that emerged from the discussion:
1) The threat is real – almost every company has experienced some attempt to attack their networks. Those threats are increasingly coming from Eastern Europe and China. If you are not aware that such attacks have been attempted, you may not have the right detection systems in place.
2) Access control continues to be an issue – the most dangerous threats to your organization may come from inside. Access to internal systems, particularly by IT staff, needs to be regularly reviewed, and terminated employees need to have their access removed immediately. We see exceptions to access control policies in most of our IT controls testing at Bridgepoint Consulting.
3) Data security is more complex than ever – with the advent of smartphones, tablets and personal laptops on the corporate networks, data security now extends outside the walls of the organization. If you allow personal devices to access corporate networks, you need to have a policy on securing those devices and a way to clean the corporate data if the device is lost or stolen.
4) Cloud security varies based on approach – when deploying applications in the cloud, organizations must understand the security implications. Using public cloud offerings (Amazon Web Services, Microsoft Azure, Rackspace OpenStack etc) does not relieve the organization from responsibility for security. Applications deployed in the cloud must be tested and controlled similar to internally hosted applications. For mission critical applications, a private cloud may provide better services levels and security than a public cloud.
5) Don’t make it easy – hacker organizations such as Anonymous, use widely available intrusion techniques across many organizations looking for those with little or no data security controls in place. Your organization needs to be more secure than others so you are not a victim.
6) Have a response plan – one of the key components for limiting the impact of a data breach is to have a plan on responding to breaches. A data breach may have operational, legal and public relationship impacts. The quicker your organization responds appropriately to a breach, the less damage the breach will cause.
Technology is continually evolving. Data security approaches must evolve with technology. While no organization can be completely secure from data breach, your organization should not be behind the curve. If you have a solid plan to prevent, detect and respond to data security threats, your organization will be less vulnerable.
