Why
Data Breaches Occur and How You Can Lessen Their Impact
One
of the dirty little secrets about security: there is simply no way to make your
company impervious to a data breach. It's almost a statistical certainty that
you will, at some point or another, be hit with a security scenario that you're
not prepared for. That's why security today is as much about damage control as
it is about breach avoidance.
Consider
the following:
Most
breaches aren't that hard to execute
Attacks
on corporate networks and data occur at alarming frequency. You might think
that's because attackers have become more sophisticated, but that's not
necessarily the case. In fact, the most recent Verizon Security Breach study
suggests a hacker with fairly rudimentary skills could've pulled off the
majority of attacks in 2012.
And
these attacks aren't isolated to large banks and government entities - they're
pervasive across all industries. The bottom line is, if you have important data,
chances are someone else thinks it's important too -- and will do whatever it
takes to get to it.
Compliance
mandates are limited and vague
U.S.
compliance guidelines for data and cyber security are noticeably vague, leaving
it up to corporations to determine best practices for maintaining the privacy
and confidentiality of sensitive data. As a result, organizations typically do
just enough to achieve compliance, when in fact, compliance with HIPAA, FERPA,
FISMA, PCI and others, should actually be the low bar.
When
it comes to sensitive data, you can never be too safe. Let's say an email list
gets breached. This isn't regulated data. You're not going to get fined for
non-compliance, but PII is still compromised. This represents a significant
failure on the part of the responsible corporation, one that ultimately leads to
loss of customer trust.
Big
data is big business
It's
hard to have a conversation about technology where the phrase, "big data"
doesn't come up. For all the advantages associated with capturing large volumes
of diverse data at high speeds, there's an inherent risk in securing lots of
sensitive data in massively distributed databases in the cloud. Each node -- and
big data can have hundreds or even thousands - represents a point of failure
where data can be accessed without authorization.
Don't
forget about BYOD
Earlier
this month, Google Chairman, Eric Schmidt announced there are 500 million
Android devices worldwide, with 1.3 million new activations daily. There are
about 365 million iOS devices in play right now, and a large percentage of those
devices are infiltrating the workplace. In fact, 36% of all email is now being
opened on a phone or tablet, many of which are accessing data inside your
firewall.
Each
of these phones, tablets and mobile devices represent potential security
vulnerabilities. According to a site maintained by the US Department of Health
and Human Services, 72% of data breaches dating back to 2009 stem from stolen,
lost or improperly disposed of devices representing a total of 15.6 million
individual health records. Device theft is pervasive, and the influx of mobile
devices just presents more opportunity for sensitive regulatory and PII data to
go missing.
Security
keys are being mismanaged
Another
concern is around the management of cryptographic keys, SSL certificates and
other "opaque" objects. With the trend toward IT hybridization, organizations
are being buried by a virtual avalanche of encryption keys, data tokens, SSL
certificates, passwords and more.
If
any of these security objects fell into the wrong hands, there's almost nothing
in your corporate environment that wouldn't be at risk. Surprisingly, not a lot
of forethought goes into the security, management, provisioning and revocation
of these keys. In fact, we often hear stories about systems administrators
storing keys in boot files or easily accessible spreadsheets on their hard
drives. Think about it this way: You wouldn't lock your car and leave the keys
in the driver's side door, would you?
The
issues above only scratch the surface. There are still lingering questions and
concerns about cloud security, authentication and ownership of data in SaaS
applications to name a few more. On Monday, we'll look at some small things you
can do that will have a profound impact on your data security profile. Stay
tuned.
For
further information visit: http://cloudcomputing.sys-con.
No comments:
Post a Comment