From: InfoSec News (alertsinfosecnews.org)
Date: Thu Oct 16 2008 - 03:09:30 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

http://www.cio.com/article/451092/Why_Technology_Isn_t_The_Answer_To_Better_Security

By Kim S. Nash
CIO.com
October 15, 2008

Not to be alarmist, but WAKE UP, PEOPLE! Our information security is, in
many ways, failing.

Ask the 11 alleged hackers charged in August with breaking into TJX and
other retailers by way of insecure Wi-Fi. Forty million credit and debit
card numbers were stolen. Ask the Medicaid claims processor at the
outsourcer EDS. In February she pleaded guilty to stealing Social
Security numbers and dates of birth, and selling them for use on fake
tax returns. Ask the courier hired by the University of Utah Hospital to
take backup tapes to offsite storage. One day in June, he used his own
car instead of his company's secured van. The tapes, containing billing
data for 2.2 million patients, were stolen from his front seat.

Or you could, as we did, ask 7,097 business and technology executives
worldwide about their security troubles. In this, our sixth year of
conducting the "Global State of Information Security" survey with
PricewaterhouseCoopers, we got an earful about the challenges, worries
and wins in security technology, process and personnel.

Quantifying returns on information security projects can be a struggle,
often because it's hard to put a dollar value on a crisis averted. This
year, a bad economy forces decision makers to squint even harder at
proposals. Even so, survey results show companies are buying and
applying technology tools, including software for intrusion detection,
encryption and identity management, at record levels. That's pretty good
news.

However—and this is serious, folks—too many organizations still lack
coherent, enforced and forward-thinking security processes, our survey
shows. While 59 percent of respondents said they have an "overall
information security strategy," that's up just two points from last year
and it's not enough, says Mark Lobel, advisory services principal at
PricewaterhouseCoopers. Two elements, Lobel says, correlate with lower
numbers of security incidents: having a C-level security executive and
developing the aforementioned security strategy. But disappointing
numbers piled up this year. (For additional stats see "The Global State
of Information Security.")

For instance, 56 percent of respondents employ a security executive at
the C level, down 4 percent from last year. You comb network logs for
fishy activity, but just 43 percent of you audit or monitor user
compliance with your security policies (if you have them). This is up 6
percent from 2007, but still "not where we need to be," Lobel says.

As a result, security is still largely reactive, not proactive.
More-sophisticated organizations will funnel data from network logs and
other monitoring tools into business-intelligence systems to predict and
stop security breaches. So along with encryption fanatics and identity
management experts, an infosec team needs statisticians and risk
analysts to stay ahead of trouble and keep the company name off police
blotters.

[...]

__________________________________________________
Register now for HITBSecConf2008 - Malaysia! With
a new triple-track conference featuring 4 keynote
speakers and over 35 international experts, this
is the largest network security event in Asia and
the Middle East!
http://conference.hackinthebox.org/hitbsecconf2008kl/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]