Tag Archives: security
Implementing Threats, Risk and Security Audits
People used to close business deals with a handshake.
They looked one another in the eye. Today, more and more transactions are electronic, anonymous and, in too many cases, fraudulent. Any organization that stores or moves important information on an electronic network is putting its information at risk. A criminal on the other side of the world or an apparently loyal employee may have the ability to wreak havoc, by stealing, deleting or exposing confidential information.
The Computer Crime and Security Survey, conducted by the Computer Security Institute and the Federal Bureau of Investigation, indicates almost two-thirds of the large corporations and government agencies it surveyed lost money when their computer security broke down.
The survey noted that 9 out of 10 respondents had computer security breaches during the previous 12 months. Proprietary information worth $170.8 million was stolen from 41 respondents. Fraud cost 40 respondents $115.8 million.
When only 45 per cent of executives in North America said they conduct security audits on their e-commerce systems, (around the world, fewer than 35 per cent had conducted security audits) it becomes obvious that organizations must improve their defenses quickly.
The first step in protecting information assets is a Threat and Risk Assessment (TRA). Without the information it provides, organizations are in danger of fixing only what is broken and ignoring potential hazards. While the specifics of a TRA will be unique at each organization, a common methodology provides a starting point.
The first step is risk assessment, to identify the most important assets and information: threats and vulnerabilities are identified; solutions are proposed and refined; corporate policies are tightened up; roles and responsibilities are assigned; standards and training are developed.
The next step is the creation of a security plan, with its own procedures, budget and implementation timetable. Once those steps are complete, any new architecture can be rolled out and new procedures put in place. At this point, the new system should be tested from the outside for any remaining weak points.
Finally, to maintain system security, security should be audited on a regular basis to keep pace with both internal changes and evolving external threats. The TRA provides the map, but organizations must make the journey. Consulting companies have identified factors that contribute to the success or failure of an IT security project. Senior managers have to support the project and demonstrate their involvement. Otherwise, their staffs will place a higher priority on other activities.
Business and technical experts should both be involved because solutions that overburden the enterprise are not acceptable. Individual business units should be responsible for their own TRA to prevent foot-dragging during implementation and finger-pointing later. Interestingly, one consultant recommended conducting assessments on a department-by-department basis, rather than all at once. The reasoning is that valuable resources can be narrowly focused, and lessons learned can be carried over to subsequent assessments.
The Threat and Risk Assessment is an important tool. Recent reports show not enough organizations are using it.
Implementing Threats, Risk and Security Audits
People used to close business deals with a handshake.
They looked one another in the eye. Today, more and more transactions are electronic, anonymous and, in too many cases, fraudulent. Any organization that stores or moves important information on an electronic network is putting its information at risk. A criminal on the other side of the world or an apparently loyal employee may have the ability to wreak havoc, by stealing, deleting or exposing confidential information.
The Computer Crime and Security Survey, conducted by the Computer Security Institute and the Federal Bureau of Investigation, indicates almost two-thirds of the large corporations and government agencies it surveyed lost money when their computer security broke down.
The survey noted that 9 out of 10 respondents had computer security breaches during the previous 12 months. Proprietary information worth $170.8 million was stolen from 41 respondents. Fraud cost 40 respondents $115.8 million.
When only 45 per cent of executives in North America said they conduct security audits on their e-commerce systems, (around the world, fewer than 35 per cent had conducted security audits) it becomes obvious that organizations must improve their defenses quickly.
The first step in protecting information assets is a Threat and Risk Assessment (TRA). Without the information it provides, organizations are in danger of fixing only what is broken and ignoring potential hazards. While the specifics of a TRA will be unique at each organization, a common methodology provides a starting point.
The first step is risk assessment, to identify the most important assets and information: threats and vulnerabilities are identified; solutions are proposed and refined; corporate policies are tightened up; roles and responsibilities are assigned; standards and training are developed.
The next step is the creation of a security plan, with its own procedures, budget and implementation timetable. Once those steps are complete, any new architecture can be rolled out and new procedures put in place. At this point, the new system should be tested from the outside for any remaining weak points.
Finally, to maintain system security, security should be audited on a regular basis to keep pace with both internal changes and evolving external threats. The TRA provides the map, but organizations must make the journey. Consulting companies have identified factors that contribute to the success or failure of an IT security project. Senior managers have to support the project and demonstrate their involvement. Otherwise, their staffs will place a higher priority on other activities.
Business and technical experts should both be involved because solutions that overburden the enterprise are not acceptable. Individual business units should be responsible for their own TRA to prevent foot-dragging during implementation and finger-pointing later. Interestingly, one consultant recommended conducting assessments on a department-by-department basis, rather than all at once. The reasoning is that valuable resources can be narrowly focused, and lessons learned can be carried over to subsequent assessments.
The Threat and Risk Assessment is an important tool. Recent reports show not enough organizations are using it.
Business and Internet Security (Page 1 of 2)
Taking chances when it comes to Internet Security is never something to be taken lightly. Though some private and casual computer users will likely do so, business owners who make use of computers to store both business and customer data must consider security a top priority. Having run a business myself I can say with the utmost of confidence that not only must you have some sort of Computer Security set up for your PCs but must also make use of reliable and dependable software. It is an all to common practice in business these days to cut corners in an attempt to save a buck and while I have seen several businesses cut expenses even in security applications to do so is simply folly.
When my partner and I began our business venture a couple of years ago the first thing we did after deciding to start the business was to begin with Security Research. Though we both involved ourselves with finding the very best security software I was tasked with the majority of the project. I was initially disappointed by all of the PC Security Software I had looked at as none seemed to deliver an all in one experience. Being an ample computer user and fairly tech savvy I didnt want to treat my businesses network as I did my home network. Using several different antivirus applications to both eliminate and keep threats at bay wasnt going to cut it in the business world. The program I needed had to bring everything to the table so that I would know Im getting the best bang for my buck and that my business and its confidential information would remain safe.
Ive heard all the horror stories of business being sued and/or shut down due to poor security measures taken by owners who feel penny pinching is the way to solve all problems. I was determined not to be that type of owner nor did I want my business to suffer the effects of that management style. After some exhaustive research and substandard results I felt it was time to consult with those that had gone down this road before me. I actually spoke with my former employer whom I was employed with prior to starting my businesses. She revealed that not only did they take PC Security seriously but that they also went with a company that they found through several internet searches. This company she had chosen and still uses to this day is known as eEye. eEye specializes in creating tools that will allow just about anyone to successfully remove threats from their computers and networks while at the same time keep those same threats out and away from their machines.
This information piqued my curiosity and so I began looking at eEyes website and list of PC Security applications. As I was initially pleased with what I saw I began scouring the internet for opinions and reviews of the said programs. The majority of users said the same things my former employer did and they shared her opinions on the programs as well. After going over the results with my business partner we decided to invest in a couple of eEyes products. We began with Blink® Professional Edition which would allow us to remove and keep all threats out of our computers and do it all in one program. Secondly we ended up with their Security Management Appliance 1505 which would further reduce our exposure to attacks, thus protecting our client and business data. Once things got set up both my partner and I couldnt have been more pleased. Our network and individual PCs have rum smoothly with little to no issues for close to two years. In addition to that, now that we are a much larger company than we were a few years ago weve taken on a small but effective IT staff of which the Director shares our tastes in Endpoint Security software so things continue to run as though weve never had any issues.