|
 Not
Just an IT Problem
BY STEPHEN SPOONAMORE & TOM
KELLERMANN
CYBRINTH
Hackers attack every few minutes, stealing company
secrets and even entire databases. An effective security strategy
requires clear goals, policies, procedures—and leadership.
The entire process took just 37 minutes. The employee innocently installed
instant-messaging, or IM, software on his PC. The IM program immediately began
communicating with other IMs, bypassing the corporate firewall. An observant
hacker used the IM gate to install a computer worm that opened up a “back door”
into company systems. A few more hacks, and the perpetrator was stealing
sensitive corporate data.
It happens every few minutes. Nine out of 10 businesses experienced a
cyber-crime in 2005, according to the FBI. In the same time frame, the FTC
reports, 56 million Americans were the victims of electronic identity theft—the
nation’s single largest crime.
The attacks are increasingly refined—and pernicious. In the past, hackers were
content to deface a website or swipe a few credit card numbers. Today, they use
automated “malware” to steal company secrets or blended attacks to copy entire
databases—replete with customer account numbers, passwords and other personal
information.
Customer data is the criminal currency of choice in the new millennium. And for
some unprepared financial services firms and electronic retailers in
particular, the losses are mounting. Yet most corporate executives and general
counsel remain blind to the problem. They assume that the IT department has it
covered. After all, haven’t they invested in firewalls and virus scanners and
intrusion-detection systems?
Yes, they probably have. But today, the threats are more sophisticated. Systems
are more interconnected. Data management is increasingly outsourced. And a
growing number of regulations place responsibility for protecting data squarely
on the shoulders of corporate officers. In short, the risks are greater.
SECURITY LEADERSHIP
Today, data is cash. You need a data custody policy similar to a cash custody
model. Data security needs to be managed as a business risk. It’s not enough
for security fixes to bubble up from IT. Instead, you need a security strategy
at the executive level and then to build a culture of security throughout your
organization.
Start with your business objectives and processes. What information do you need
to manage electronically, and who needs to have access to it? When?
Then quantify the value of that information. What are the consequences if the
data is corrupted or stolen?
Next, estimate the threats to your data stores and your vulnerability to those
threats. Only now does IT begin to enter the picture.
Establish clear goals, policies and procedures, and invest in the technologies
and tools in line with these goals.
Your security strategy needs to be detailed, and it needs to assign roles and
responsibilities. Every employee needs to be aware of it, abide by it and be
accountable for violations. When a breach occurs, training, along with good
systems, will allow you to minimize loss and recover quickly.
Security policies also need to extend to partners that may connect with your
systems or handle your data. Computer systems are increasingly outsourced to
third parties. Have you conducted a risk assessment of your outsourcer? Are
they liable for the integrity and confidentiality of the data they manage?
Finally, you must be able to demonstrate that you’ve taken appropriate steps to
protect your data. Sarbanes-Oxley, Gramm-Leach-Bliley, the Financial
Institution Privacy Protection Act—plus  a growing number of state laws and international mandates—all
set guidelines for developing, enforcing and auditing security policies. They
also specify stiff penalties for organizations—and the responsible
individuals—that fail to do so.
There’s no longer any difference between IT risk and operational risk or
reputational risk. Your business is completely dependent on your computers and
on your ability to protect the information stored on them. You’ll never achieve
100 percent security. But with a carefully constructed strategy, leadership at
the highest levels and data use aligned with business goals, you will operate
at the lowest risk, with the fastest recovery and a minimum of exposures.
CT
STEPHEN SPOONAMORE (in photo on left) is CEO and TOM
KELLERMANN (right) is CKO of Cybrinth, a provider of data security policy and
risk evaluation services.
|