Cyber Security Institute

§ Current Worries

Top 3 Worries

  • Regulations
  • Old Firewall Configurations
  • Security Awareness

§ Listening

For the best information

  • The underground
  • Audible
  • Executive Excellence
  • Music (to keep me sane)

§ Watching

For early warnings

  • 150 Security Websites
  • AP Newsfeeds
  • Vendors

Wednesday, October 15, 2008

The Global State of Information Security 2008

Not to be alarmist, but WAKE UP, PEOPLE!  Our information security is, in many ways, failing.  Ask the 11 alleged hackers charged in August with breaking into TJX and other retailers by way of insecure Wi-Fi.  Forty million credit and debit card numbers were stolen.  Ask the Medicaid claims processor at the outsourcer EDS.  In February she pleaded guilty to stealing Social Security numbers and dates of birth, and selling them for use on fake tax returns.  Ask the courier hired by the University of Utah Hospital to take backup tapes to offsite storage.  One day in June, he used his own car instead of his company’s secured van.  The tapes, containing billing data for 2.2 million patients, were stolen from his front seat.  Or you could, as we did, ask 7,097 business and technology executives worldwide about their security troubles.  In this, our sixth year of conducting the “Global State of Information Security” survey with PricewaterhouseCoopers, we got an earful about the challenges, worries and wins in security technology, process and personnel.

Quantifying returns on information security projects can be a struggle, often because it’s hard to put a dollar value on a crisis averted.  This year, a bad economy forces decision makers to squint even harder at proposals.  Even so, survey results show companies are buying and applying technology tools, including software for intrusion detection, encryption and identity management, at record levels.  However—-and this is serious, folks—-too many organizations still lack coherent, enforced and forward-thinking security processes, our survey shows.

While 59 percent of respondents said they have an “overall information security strategy,” that’s up just two points from last year’s survey and it’s not enough, says Mark Lobel, advisory services principal at PricewaterhouseCoopers.  Two elements, Lobel says, correlate with lower numbers of security incidents: having a C-level security executive and developing the aforementioned security strategy. 

But disappointing numbers piled up this year.  For instance, 56 percent of respondents employ a security executive at the C level, down 4 percent from last year.  You comb network logs for fishy activity, but just 43 percent of you audit or monitor user compliance with your security policies (if you have them).  This is up 6 percent from 2007, but still “not where we need to be,” Lobel says.

As a result, security is still largely reactive, not proactive.  More-sophisticated organizations will funnel data from network logs and other monitoring tools into business-intelligence systems to predict and stop security breaches. 

So along with encryption fanatics and identity management experts, an infosec team needs statisticians and risk analysts to stay ahead of trouble and keep the company name off police blotters.  Still, while our survey illuminates continuing problems, in discovering the problems, we also see a path to safer data for companies that, yes, apply technology but also develop processes and make them part of everyone’s everyday work.  What we have to do now is examine our failings, then act.

The Big Picture: Technology Reigns Money really is power, isn’t it?  When asked to indicate any sources of funding for information security, 57 percent of survey respondents named the IT group and 60 percent cited functional areas such as marketing, human resources and legal as major providers.  Just 24 percent indicated a dedicated security department budget.  With the IT group a strong force, technology becomes the answer to many security questions.  To someone with a hammer, everything looks like a nail, according to the old saw.

Divert potential phishing attacks with spam filters.
Stymie laptop thieves by encrypting corporate data.

If there’s a security tool out there, our survey pool uses it.  Companies have realized they must do a better job disposing of outdated computer hardware, for example, wiping disks of data and applications.  Sixty-five percent of respondents now have tools to do that, up from 58 percent last year.

More organizations than ever are encrypting databases (55 percent), laptops (50 percent), backup tapes (47 percent) and other media.

Use of intrusion-detection software also is up: 63 percent this year compared with 59 percent last year.

And installing firewalls to protect individual applications, not just servers and networks, increased to 67 percent from last year’s 62 percent.

Despite these technology-oriented gains, though, disturbing trends continue in the areas of security processes and personnel—-some negate any protection an IT budget can buy.  For example, encrypting sensitive data makes good sense, but such technology can’t stop an employee from flouting policies concerning how that data should be handled.  If the goal is to secure information, to make it truly safe, you’d better develop processes and procedures for putting your nails in the right place before whacking anything with a technology hammer.  Technology must be part of a larger plan to secure information, says Dennis Devlin, chief information security officer at Brandeis University.  Devlin reports to Brandeis’s vice president and provost for libraries and information technology.  He’s seen it at Brandeis, since joining last year, and at Thomson Corp., now called Thomson Reuters, where he was chief security officer for seven years.  For example, employees sometimes fall for e-mail scams and open attachments that unleash malicious software such as key-stroke loggers that record passwords and rootkits that take control of operating systems.

Just 41 percent of those surveyed require employees to undergo training on the corporate privacy policy and practices, up incrementally from last year’s 37 percent.

Checklist Security Regulations such as the Health Insurance Portability and Accountability Act for medical data, Sarbanes-Oxley for financial data and the Payment Card Industry standard for credit card data continue to move executives to action.  For example, 44 percent of respondents say they test their organization for compliance with whatever laws and industry regulations apply, up from 40 percent last year; 43 percent say they monitor user compliance with security policy, a healthy increase from last year’s 37 percent.  Many organizations aren’t doing much beyond checking off the items spelled out in regulations—-and basic safeguards are being ignored, says Karen Worstell, a managing principal at the consulting firm W Risk Group, former chief information security officer at Microsoft, and former CISO and VP of IT risk management at AT&T.

Posted on 10/15