Secure Value

Secure Value by Understanding the Criminals in the Digital Neighborhood

Image by waltarrrrr via Flickr

I just got a crack at reading Deloitte’s new Center for Security and Privacy Solutions' report titled Cyber Crime: A Clear and Present Danger.  It is a quick 16 page read and worth it for any entrepreneur or emerging business innovator, CEO or COO.

We are building business in a digital world.  Knowing the neighborhood, so to speak, is important.  Along with all the good things things about the neighborhood -- effeciency, effectiveness, new markets, new products and services, collaboration -- comes new forms of crime, new scams, new ways that our business dreams can be damaged or destroyed.

My business partner at Jacadis, Simon Herring, often speaks of our efforts as cyber security and risk professionals at protecting 10-foot walls againts 11-foot ladders.  The reports key finding "Threats posed to organizations by cyber crimes have increased faster than potential victims—or cyber security professionals—can cope with them, placing targeted organizations at significant risk.

In interpreting the survey responses Deloitte reports that "cyber crime constitutes a significantly more common and larger threat than respondents recognize."Bluntly cyber criminals are innovating in the digital marketplace just like the rest of us; only their innovation is outpacing what are traditionally considered best practices.

The report in Deloitte's words "is directed toward senior leaders including CIOs, CSOs, CROs, operational risk managers, government agency budgeting and procurement professionals, and other executives and professionals with decision-making roles in the security of their organization’s IT environment and of the assets within that environment.

It is a quick 16 page read and worth it for any entrepreneur or emerging business innovator, CEO or COO.  It is worth reading for those in the IT audit profession as well.

Some trends pointed out in the report:

• Cyber attacks and security breaches are increasing in frequency and sophistication, with discovery usually occurring only after the fact, if at all.
• Cyber criminals are targeting organizations and individuals with malware and anonymization techniques that can evade current security controls.
• Current perimeter-intrusion detection, signature-based malware, and anti-virus solutions are providing little defense and are rapidly becoming obsolete—for instance, cyber criminals now use encryption technology to avoid detection.
• Cyber criminals are leveraging innovation at a pace which many target organizations and security vendors cannot possibly match.
• Effective deterrents to cyber crime are not known, available, or accessible to many practitioners, many of whom underestimate the scope and severity of the problem.
• There is a likely nexus between cyber crime and a variety of other threats including terrorism, industrial espionage, and foreign intelligence services.

Or more simply put.  You lock your office, warehouse, storage, retail, etc. facility because leaving the door open would invite a criminal. 

Do you lock your digital doors?

Does your business design, operation, IT infrastructure invite criminals?

The report can be found at: http://www.cio.com/documents/whitepapers/CyberCrime.pdf.

Related articles by Zemanta

• Cybercrimes Are Becoming A Serious Threat (techstartups.com)
• 2010 CyberSecurity Watch Survey: Cybercrime Increasing Faster Than Some Company Defenses (eon.businesswire.com)
• Cyber attacks cost businesses an 'average of £1.2 million' a year (telegraph.co.uk)
• Report: Companies unprepared for cybercrime (news.cnet.com)
• The "Unstoppable" Growth of Internet Crime (pindebit.blogspot.com)

Secure Value By Managing for Social Media Security and Privacy

Image via Wikipedia

The following question has been asked in several ways to me online and in the Q&A of speaking engagements I've recently done.  It is a question you should be asking if you are using social media to run and grow your business.

What issues are there with social media security and privacy? How are they resolved? What can I do to prevent or reduce problems especially with Facebook and Twitter? Should we jump into the social media world?

1. You'll need to be prepared to be protected from viruses, malware, worms and a whole slew of other nasty software threats. You should be protected from those issues regardless of whether you Facebook or Tweet. Just connecting to the internet will expose you to these threats. Facebook and Twitter are just another delivery channel for what we call malware in the security industry.

The solution is protecting the endpoints in your business (speaking English that means your computers and your cell phones). A good endpoint security package is going to include a personal firewall, anti virus, and anti spam. My company is a big fan of Sophos end point products as they are partners of ours.

2. Privacy is about control. Don't publish details you don't want to be out in the open. The obvious no no is over publishing personal information. Giving too much away, in regards to travel or equipment purchases, etc. can expose you. There are documented cases of people tweeting on vacation only to come back to stolen electronics. A coincidence? Or a follower?

Nobody knows for certain but there is no reason to expose yourself. Be careful of geo tagging for the same reasons.

3. Understand social engineering techniques. Social engineering is when people online use old cons to trick you to do things they want. Get rich quick schemes, emails from people you don't know (particularly with downloads) and the like are typical concerns. We've dealt with cases of social engineering where enough detail was given on Facebook, Twitter, etc. that the attack actually came over the phone with people pretending to be people known to the victim.

4. Back your systems up. IF you are attacked you don't want to lose all your hard work.

Scary? Probably. But so frightening you should stay away? Hardly.

My firm is an 11 person information security firm that cautiously and correctly uses social media to run and grow our business.

The security and privacy situation is constantly changing in regards to social media. Get involved in social networking but set aside some time to become familiar with the security and privacy features of these tools (and their weaknesses). Don't listen to people that advise you to stay away from them; embrace them wisely and grow your business!

Related articles by Zemanta

• Cybercrooks Target Social Networks (marketingvox.com)
• Social Networks Are Becoming a Security Risk (mashable.com)
• Firms worry about social networks, but don't block access (arstechnica.com)

Secure Value by Identifying Information Assets and Their Owners

Image via Wikipedia

Information Owners -- those responsible for the viability and survivability of an information asset -- need to accountable to their role.  It is not enough to expet IT as custodians to understand their role in protecting the asset without an Information Owners involvement.

I am working on a data discovery and information asset profiling project for a client.  Essentially this client has agreed that they a). need to know where their critical assets are b). whether or not they are protected throughout the business life of the information and c). what compliance requirements must be met to stay in-line with regulations and contracts.

Your business has these same issues.  If your market is in the health care space you may have protected health information (PHI) and be expected to meet HIPAA requirements.  If you transact business using payment cards -- Visa, MasterCard, Amex and so on -- the Payment Card Industry (PCI) expects you to meet their Data Security Standard.  If you conduct business in most states you need to be compliant with data protection and notification laws that differ state to state.

Many businesses do an "ok" job of understanding what compliance requirements must be met but do a terrible job knowing where that protected data lies or flows within their business.

Which brings me to this client.  They are a services firm that through its normal business routine gathers, processes and stores a termendous amount of personally identifiable information.  They have a diligent and caring information technology department.  They have executive support for securing their information.  And like most firms the protected information in their business freely flows outside of protective boundaries creating a risk of exposure.

We were asked to do a data discovery to help find that exposed information and make recommendations for properly protecting it for both security and compliance purposes. 

The CERT Survivable Enterprise Management group at the Software Engineering Institute at Carnegie Mellon in Pittsburgh developed the Information Asset Profiling (IAP) process as a model.

Some key components of the model:

Information owners are those responsible for the viability and survivability of an information asset.  For all businesses that means that sales is responsible for account information, call center management responsible for the information in the customer relationship management toolset, engineering responsible for the "secret sauces" in the company product and so on.

Information custodians are those responsbile for protecting the information asset.  In most firms this means the information technology staff.  In most firm this is the group also given implied responsibility for viability and survivability.  Yet, IT doesn't have the necessary tools to value information and protect it outside of its existence in computer systems within the company.

Containers are a concept within the model that refers to the form factor that is used to store the information.  A file folder.  A filing cabinet.  A BlackBerry.  A laptop.  A server.  The computer network.  All these represent containers. 

In our experience which has been validated as this project continues organization's are concerned with protecting the computer assets but are unaware when data flows into containers that are then themselves exposed such as printed documents, file folders, faxes and the like.

The end result of this project is that our client will truly know where their critical data is, how the containers it resides in are exposed, and what can be done to lesson the risk of losses or compliance violations.

Do you know where your data is?

Related articles by Zemanta

• HITECH and State Breach Notification (slideshare.net)
• HIPAA Compliance (slideshare.net)
• PCI compliance: What it is and why it matters (Q&A) (news.cnet.com)

Secure Value by Preventing Bad Things From Becoming Crises Cases

Image via Wikipedia

We are not going to prevent all bad things from happening in all areas of life including the weather (as I sit semi-snowbound in my home office) and information security.  I'm using the downtime to catch up on some business reading.

One article that struck me as sharable to the executive and business leader trying to secure value was a Management Tip of the Day for Feburary 16th from the Harvard Business Review: 3 Components for Preventing Crises:

1.  Pattern recognition. Encourage your people to share information and make connections so that you can recognize when a problem is forming. 

Part of this is ensuring that you have a good news travels, bad news travels fast culture.  If your employees are scared to deliver bad news you won't get the information you need to see an emerging pattern in time to prevent the crises.  You also need to have awareness of what to do and visibility for what "normal" is, so that abnormalities can be identified.

• Does your behavior as a leader support bad news making it to your desk in time?
• Are you staff aware of what their role in the information security process is?
• Do you know what "normal" looks like in your business environment? On your network? In your call center? In your applications?

2.  Broader communication. Communication across silos is not easy, but it should be mandatory so that critical information reaches all parts of an organization.

Again, the ability to communicate across silos is a cultural issue.  Do you promote cross cultural collaboration? Or do you prefer that information and data travel up and down a chain of command?

3.  Trusted leadership. Leaders need to react quickly when a problem surfaces. Showing that you c are about an issue is critical to gaining your employees' trust in your ability to handle problems.

And I believe that showing you care about how the company handles its critical data during good times is a precursor to whether you'll be believable to your employees and customers (and maybe the courts!) if something bad happens.  Trust is critical to securing value.  The trusted leader accepts responsibility for the company's stewardship of critical data.  Are you daily behaviors regarding information stewardship the kind of behaviors that will lead employees to the conclusion that you care about protecting data?

Additional information is available from Harvard Business Review at http://web.hbr.org/email/archive/managementtip.php?date=021610.

Related articles by Zemanta

• Entrepreneurs Need to Ask the Right Questions (startupprofessionals.com)
• Great Leaders Ask Great Questions (drivenleaders.com)
• To Lead, Create a Shared Vision (thielst.typepad.com)
• How To Build Accountability Into Your Organization (myventurepad.com)
• A $5,000+ Question (If You're Doing Business with Massachusetts Residents) (myventurepad.com)

Secure Value by Keeping Up with Changes in Social Networking

Image by Jukka Vuokko via Flickr

Security and privacy issues in the social media space are evolving so rapidly it seems impossible to keep up; you need to invest some time to stay informed!

Last May I did a series of public presentations on Social Media.  The Columbus ISACA chapter is co-hosting a session on social media with the local chapter of the IIA called: LinkedWorking: Utilizing Social Media to Advance & Enhance Business.  That session will include a panel discussion on social media which I facilitating.

In reviewing social media through the security and privacy prism these changes have occured in less than a year:

• Twitter lost confidential information stored in GoogleDocs because of poor password discipline
• Bloggers now have disclosure rules based on new regulations from the FTC.
• Facebook has changed its privacy module.
• Twitter has begun to offer Verified Profiles to celebs and VIPs.
• New threats have emerged on the landscape.

What changes do you see in the next 8 months?

State of Ohio Cyber Summit -- February 17, 2010

Image via Wikipedia

The State of Ohio is hosting a Cyber Summit on February 17, 2010.  A session is being held for small business and local government. 

Download CYBER SUMMIT GENERAL_Final

The summit will address the following questions:

• Do you fully understand the risks if you suffer a security lapse?
• Are your employees putting your business at risk?
• Could your brand be tarnished by cyber criminals if they hijacked your system?
• Can good Cyber Security give you a competitive advantage?

I am attending and will blog on the content afterward. 

Should you go?  I can't speak to the content, but I can speak to the importance of knowing the answers to the questions that will be addressed.  Operating without understanding (and managing) the risks facing your business is a recipe for losing value.