SOCIAL NETWORKING SECURITY CONCERNS TOP OF MIND FOR BUSINESSES
Source: ITbusiness.ca
Posted on October 20, 2009
Today's most compelling technologies are giving you the biggest security headaches. Social networking sites such as Twitter, Facebook and LinkedIn enhance collaboration and help your company connect with customers, but they also make it easier than ever for your employees to share customer data and company secrets with outsiders.
Virtualization and cloud computing let you simplify your physical IT infrastructure and cut overhead costs, but you've only just begun to see the security risks involved. Putting more of your infrastructure in the cloud has left you vulnerable to hackers who have redoubled efforts to launch denial-of-service attacks against the likes of Google, Yahoo and other Internet-based service providers.
A massive Google outage earlier this year illustrates the kind of disruptions cloud-dependent businesses can suffer.
But there's also good news. Even though the worst economic recession in decades has compelled you to spend less on outsourced security services and do more in-house, your security budget is holding steady. And more of you are employing a chief security officer.
Such are the big takeaways from the seventh-annual Global Information Security survey, which CIO and CSO magazines conducted with PricewaterhouseCoopers earlier this year. Nearly 7,300 business and technology executives worldwide responded from a variety of industries, including government, health care, financial services and retail.
These trends are shaping your information security agenda. "Every company worries about protecting their data, especially their client data," says Charles Beard, CIO at Science Applications International Corp. (SAIC). "Under the old business model, everyone had to get together in the same building in the same geographical area.
Now everyone is using the Internet and mobile devices to work with each other. That's where we see the promise of things like social networking. The flip side is we're exposed to the dark side of cyberspace. Adoption of this technology is well ahead of efforts to properly secure and govern it."
Read on to learn what we found.
Top IT Security Priorities
New investments are focused on protecting data, authenticating users:
1. Biometrics
2. Web content filters
3. Data leakage prevention
4. Disposable passwords/smart cards/tokens
5. Reduced or single-sign-on software
6. Voice-over-IP security
7. Web 2.0 security
8. Identity management
9. Encryption of removable media
TREND #1
The Promise and Peril of Social Networking
In less than two years, social networking has gone from an abstract curiosity to a way of life for many people. When someone updates their status on Twitter, Facebook or LinkedIn, they might do it at work by day or on company-owned laptops from home at night.
What gives IT executives heartburn is the ease with which users could share customer data or sensitive company activities while they're telling you what they're having for lunch.
Cyberoutlaws know this and use social networks to launch phishing scams. In one popular attack, they send their victims messages that appear to be coming from a Facebook friend. The "friend" may send along a URL they insist you check out.
It may be pitched as a news story about Michael Jackson's death or a list of stock tips. In reality, the link takes the victim to a shady website that automatically drops malware onto the computer. The malware goes off in search of any valuable data stored on the computer or wider company network, be it customer credit card numbers or the secret recipe for a new cancer-fighting drug.
It's no surprise, then, that every IT leader surveyed admitted they fear social-engineering-based attacks. Forty-five percent specifically fear the phishing schemes against Web 2.0 applications.
Nevertheless, for many company executives, blocking social networking is out of the question because of its potential business benefits. Companies now clamor to get their messages out through these sites, so the challenge for CIOs is to find the right balance between security and usability.
"People are still incredibly naive about how much they should share with others, and we have to do a better job educating them about what is and isn't appropriate to share," says H. Frank Cervone, vice chancellor of information services with Purdue University Calumet. "We have to do a better job of enhancing our understanding of what internal organization information should not be shared."
But in a university setting, it's critical to engage people through social media, Cervone adds. Even in the commercial sector, he doesn't see how organizations can avoid it.
And yet this year--the first in which we asked respondents about social media, only 23 percent said their security efforts now include provisions to defend Web 2.0 technologies and control what can be posted on social networking sites. One positive sign: Every year, more companies dedicate staff to monitoring how employees use online assets--57 percent this year compared to 50 percent last year and 40 percent in 2006. Thirty-six percent of respondents monitor what employees are posting to external blogs and social networking sites.
To prevent sensitive information from escaping, 65 percent of companies use Web content filters to keep data behind the firewall, and 62 percent make sure they are using the most secure version of whichever browser they choose. Forty percent said that when they evaluate security products, support and compatibility for Web 2.0 is essential.
Unfortunately, social networking insecurity isn't something one can fix with just technology, says Mark Lobel, a partner in the security practice at PricewaterhouseCoopers.
"The problems are cultural, not technological. How do you educate people to use these sites intelligently?" he asks. "Historically, security people have come up from the tech path, not the sociologist path. So we have a long way to go in finding the right security balance."
Guy Pace, security administrator with the Washington State Board for Community and Technical Colleges, says his organization takes many of the precautions described above. But he agrees with Lobel that the true battleground is one of office culture, not technology. "The most effective mitigation here is user education and creative, effective security awareness programs," he says.
TREND #2
Jumping into the Cloud, Sans Parachute
Given the expense to maintain a physical IT infrastructure, the thought of replacing server rooms and haphazardly configured appliances with cloud services is simply too hard for many companies to resist. But rushing into the cloud without a security strategy is a recipe for risk.
According to the survey, 43 per cent of respondents are using cloud services such as software as a service or infrastructure as a service. Even more are investing in the virtualization technology that helps to enable cloud computing. Sixty-seven percent of respondents say they now use server, storage and other forms of IT asset virtualization. Among them, 48 percent actually believe their information security has improved, while 42 percent say their security is at about the same level. Only 10 percent say virtualization has created more security holes.
Dark Cloud
Fears about vendors dominate cloud security risks.
What is the greatest security risk to your cloud computing strategy?
Ability to enforce provider security policies: 23 per cent
Inadequate training and IT auditing: 22 per cent
Access control at provider site: 14 per cent
Ability to recover data: 12 per cent
Ability to audit provider: 11 per cent
Proximity of company data to someone else's: 10 per cent
Continued existence of provider: 4 per cent
Provider regulatory compliance: 4 per cent
Security may well have improved for some, but experts like Chris Hoff, director of cloud and virtualization solutions at Cisco Systems, believe that both consumers and providers need to ensure they understand the risks associated with the technical, operational and organizational changes these technologies bring to bear.
"When you look at how people think of virtualization and what it means, the definition of virtualization is either very narrow--that it's about server consolidation, virtualizing your applications and operating systems, and consolidating everything down to fewer physical boxes--or it's about any number of other elements: client-side desktops, storage, networks, security," he says. "Then you add to the confusion with the concept of cloud computing, which is being pushed by Microsoft and a number of smaller, emerging companies. You're left scratching your head wondering what this means to you as a company. How does it impact your infrastructure?"
Fortunately, there's some evidence of companies proceeding with caution. One example is Atmos Energy, which is using Salesforce.com to speed its response time to customers and help the marketing department manage a growing pool of clients, according to CIO Rich Gius.
The endeavor is successful thus far, so Gius is investigating the viability of running company e-mail in the cloud. "It would help us address the growing challenge where e-mail-enabled mobile devices like BlackBerrys are proliferating widely among the workforce," he says. But he's not ready to take such a big step because the risks, including security, remain hard to pin down. One example of the disruption that cloud-dependent companies can experience came in May, when search giant Google--whose content accounts for 5 percent of all Internet traffic--suffered a massive outage. When it went down, many companies that have come to rely on its cloud-based business applications (such as e-mail) were dead in the water.
The outage wasn't caused by hackers, but there are signs that cybercriminals are exploring ways to exploit the cloud for malicious purposes. On the heels of the outage, attackers added insult to injury by flooding Google search results with malicious links, prompting the U.S. Computer Emergency Response Team (U.S. CERT) to issue a warning about potential dangers to cloud-based service sites.
The attack poisoned several thousand legitimate websites by exploiting known flaws in Adobe software to install a malicious program on victims' machines, U.S. CERT says. The program would then steal FTP login credentials from victims and use the information to spread itself further. It also hijacked the victim's browser, replacing Google search results with links chosen by the attackers. Although the victimized sites were not specifically those offering cloud-based services, similar schemes could be directed at cloud services providers.
IT organizations often make an attacker's job easier by configuring physical and cloud-based IT assets so poorly that easy-to-find-and-exploit flaws are left behind. Asked about the potential vulnerabilities in their virtualized environments, 36 percent cited misconfiguration and poor implementation, and 51 percent cited a lack of adequately trained IT staff (whose lack of knowledge leads to configuration glitches). In fact, 22 percent of respondents cited inadequate training, along with insufficient auditing (to uncover vulnerabilities) to be the greatest security risk to their company's cloud computing strategy.
It's this awareness that makes Atmos Energy's Gius proceed with caution. "We have no CSO. If we were a financial services firm it might be a different story, or if we had a huge head count," Gius says. "But we are a small-to-medium-sized company, and the staff limitations make these kinds of implementations more difficult."
Even with the right resources, security in the cloud is a matter of managing a variety of risks across multiple platforms. There's no single cloud. Rather, "there are many clouds, they're not federated, they don't natively interoperate at the application layer and they're all mostly proprietary in their platform and operation," Hoff says. "The notion that we're all running out to put our content and apps in some common [and secure] repository on someone else's infrastructure is unrealistic."
Lobel, with PricewaterhouseCoopers, says perfect security is not possible. "You have to actively focus on the security controls while you are leaping to these services," he says. It's difficult for companies to turn back once they have let their data and applications loose because they are often quick to rid themselves of the hardware and skills they would need to bring the services back in-house.
"If you dive down a well without a rope, you may find the water you wanted, but you're not going to get out of the well without the rope," he says. "What if you have a breach and you need to leave the cloud? Can you get out if you have to?"
Trend #3
Insourcing Security Management
A few years ago, technology analysts were predicting unlimited growth for managed security service providers (MSSPs). Many companies then viewed security as a foreign concept, but laws such as Sarbanes-Oxley, the Health Insurance Portability and Accountability Act and the Gramm-Leach-Bliley Act (affecting financial services) were forcing them to address intrusion defense, patch management, encryption and log management.
Data Dangers
Attacks on data have increased faster than any other security exploit. The top target: databases.
How Attackers Get Your Data
Databases: 57 per cent
File-sharing applications: 46 per cent
Laptops: 39 per cent
Removable Media: 23 per cent
Backup Tapes: 16 per cent
Multiple Responses Allowed
Convinced they couldn't do it on their own, companies chose outsourcers to do it for them. Gartner estimated the MSSP market in North America alone would reach $900 million in 2004 and that it would grow another 18 percent by 2008.
Then came the economic tsunami, which appears to have cast a shadow over outsourcing plans even though security budgets are holding steady. Although 31 percent of respondents this year are relying on outsiders to help them manage day-to-day security functions, only 18 percent said they plan to make security outsourcing a priority in the next 12 months.
When it comes to specific functions, the shift has already begun. Last year, 30 percent of respondents said they were outsourcing management of application firewalls, compared to 16 percent today. Respondents cited similar reductions in outsourcing of network and end-user firewalls. Companies have also cut back on outsourcing encryption management and patch management.
At the same time, more companies are spending money on these and other security functions. Sixty-nine percent said they're budgeting for application firewalls, up slightly compared to the past two years. Meanwhile, more than half of respondents said they are investing in encryption for laptops and other computing devices.
The results surprise Lobel of PricewaterhouseCoopers. "When you think about it logically, some IT organizations have the resources and maturity to manage their operating systems and patches, but many don't," he observes. "Hopefully, the numbers simply mean IT shops have grown more mature in their security understanding."
Security Budgets Hold Steady
More companies are increasing spending than cutting it.
Direction of Spending
Increase: 38 per cent
Stay the Same: 25 per cent
Decrease: 12 per cent
Don't Know: 24 per cent
Numbers may not add up to 100 per cent due to rounding
Gius of Atmos Energy offered another possible explanation: Companies see a lot of chaos in the security market with an avalanche of mergers and acquisitions. One independent security vendor after another has merged with or been acquired by other companies. Examples include BT's acquisition of Counterpane and IBM's acquisition of Internet Security Systems. IT leaders are simply getting out of the way until the industry settles down.
Gius says Atmos Energy is handling most of its security in-house right now. "We pursued a number of open-source and lower-cost solutions to manage it ourselves," he says. "We invested in two people to help ensure we had the skills to manage that environment." But he'd like to outsource more if it makes sense financially. He notes that security is increasingly integrated into the platforms provided by the likes of Microsoft, Cisco and Oracle, as well as telecom providers like Comcast and Verizon. It makes sense to him to have those providers manage the security of their systems.
Beard, with SAIC, says that no matter what drives security spending decisions, companies should understand their specific security strategies and where managed security providers can offer unique value. Smart business executives understand that they must maintain control of the big picture at all times, even if a third party is managing many of the levers. Keeping an eye on security service providers and the risks they are encountering is essential. "CIOs and security officers may outsource certain functions to various degrees, but they should never outsource their responsibility," Beard advises.
Trend #4
A New Corporate Commitment
CIOs may still struggle with the quality of their data security, but the response to this year's survey suggests their executive peers have agreed, finally, that security can't be ignored.
Companies' budget plans tell part of the story. Not only are more companies investing in security technologies, but overall security investments are largely intact, despite the economy.
Twelve percent of respondents expect their security spending to decline in the next 12 months. But 63 percent say their budgets will hold steady or increase (although fewer foresee increases than did last year).
For starters, more companies are hiring CSOs or chief information security officers (CISOs). Eighty-five percent of respondents said their companies now have a security executive, up from 56 percent last year and 43 percent in 2006. Just under one-third of security chiefs report to CIOs, 35 percent to CEOs and 28 percent to boards of directors.
Two factors are influencing companies to maintain security as a corporate priority: Seventy-six percent say the increased risk environment has elevated the importance of cybersecurity among the top brass, while 77 percent said the increasingly tangled web of regulations and industry standards has added to the sense of urgency.
Respondents were asked how important various security strategies had become in the context of harsher economic realities. Seventy percent cited the growing importance of data protection while 68 percent cited the need to strengthen the company's governance, risk and compliance programs.
Notes Mauricio Angée, senior manager of IT security and compliance and CSO at Universal Orlando: "For segregation of duty purposes, it's interesting to see how companies are being asked--by compliance auditors, qualified security assessors and through legislation--to hire IT security managers with a much-more-defined set of roles and responsibilities." Such roles include setting the company's security policy, making the security budget pitch (instead of the CIO) and delegating responsibility among lower-level IT security administrators and engineers.
How Cybercrime Costs You
Losses from incidents average $833,000.
The Business Impact of Security Breaches
Financial Loss: 42 per cent
Brand or Reputation Compromised: 30 per cent
Intellectual Property Theft: 29 per cent
Home Page Altered or Defaced: 20 per cent
Fraud: 17 per cent
Multiple Responses Allowed
None of these developments, however, make a focus on information security a sure bet in the eyes of IT leaders. Just because companies feel they have to spend money on security doesn't mean executives view it as an essential, even beneficial business process instead of a pain-in-the-neck task being forced upon them.
Angée said CIOs and security leaders still have to fight hard for every penny. Meanwhile, security execs don't have the same decision-making power as other C-level leaders in every company, says PricewaterhouseCoopers' Lobel. CIOs can bring in a CSO or CISO without a strategy and budget for that person to work with and end up achieving nothing. If something goes wrong, he concludes, "all you'll have is somebody to blame and fire."
E-Commerce Alerts are issued by Bennett Gold LLP, Chartered Professional Accountants as situations develop. Bookmark this site and check back often. Our e-mail address is: info@BennettGold.ca
In accordance with United States Code, Title 17, Section 107 and Article 10 of The Berne Convention on Literary and Artistic Works, the news clippings on this web site are made available without profit for research and educational purposes.
|
