A few years ago I took the decision to turn my tax affairs over to an accountant. Not that I earn that much, but I simply can’t figure out all the boxes, and it means having to read the manual which has never been a particularly strong point.
However I also discovered another benefit when I received a letter from the tax man for the dreaded audit. They wanted to examine my tax returns for the past 5 years! My first reaction was to call the tax office and advise them that I was off to three month business trip where any form of communication would be impossible and that they should contact me next year, but this simply fell on deaf ears. In desperation I called my accountant and he just told me to relax. Get the tax man to call him and it would be taken care off. And sure enough, a month later, a nice letter arrives from the tax man telling me that I'm a wonderful citizen. I breathe a sigh of relief and my accountant has another nice vacation.
So what's the point you might ask. Well as we all know, ignorance is never an excuse when it comes to taxes, and it's also no longer an excuse when it comes to data breaches within our organisations. And the problem is that those who are held responsible frequently have no understanding of the IT related issues, and in most cases those of us responsible for IT security are not aware of the potential implications to our livelihoods, or the consequences of being found out. What if your employment contract included the statement that any administrative access to any system or application that cannot be verified would result in your immediate dismissal, how would you change your method of operation. Over the top you might say – well not really because in today's business climate the potential implications are potentially that serious. And already we have seen companies, particularly in the financial sector adding personal liability clauses to mangers' contracts.
For example how many CEOs are aware that sensitive data within the organisation is visible to everyone from database administrators, developers, and system administrators? How many bank directors are aware that in many cases financial transaction files are sitting in clear text on application servers – a European bank recently fell foul during an external audit when it was discovered that payments being sent to and from a third party payment system where accessible to system administrators, and the bank had no means to control administrator access to the systems, and no way to verify if the file was manually adjusted. And the chances are that if it's true of this bank, it's very likely the case in others since they generally use similar systems. And not only are they not aware, they don't always understand the technical issues involved. Like my accountant and I when we meet – we have these brief conversations where I try to explain what I do, and vice versa, and quite frankly neither of us has any understanding of the other's profession.
Think about the company who is contracted to carry out research and development for many business partners – do management understand how confidential R&D data is shared with business partners? Or how about the financial company that processes payments for non face-to-face businesses including Internet, mail and telephone – does management know how payment files are delivered to and from merchants? The list is endless.
Regulation means that companies have never been as vulnerable to the consequences of data breaches as they are today. The potential damages resulting from loss of reputation, business, and legal costs can be crippling to many businesses. Not only can it affect the day to day business, but it can also impact long-term M&A strategies. The days of dealing with data breaches "in-house" are gone, and the consequences of being caught trying to do this are potentially worse than simply confessing.
So what should you be doing? Well there are a number of steps to consider. And an excellent guideline to follow is the standard, developed by MasterCard and VISA and also being enforced by American Express, and which is designed to protect cardholder information and must be implemented by members, merchants and service providers. So if you fall into any of these categories, and that will apply to most, then this is important.
1. Build and Maintain a Secure Network – Maybe an obvious comment, but it is important to understand what this means. You need to have a firewall configuration to protect data and not use vendor-supplied defaults for system passwords and other security parameters. In order for firewalls to be effective, all communication from untrusted networks or hosts must be blocked, preventing external sources from interfacing with internal ones. An interesting point to note here is that the requirement for the firewall is to "protect data", not to secure the perimeter.
Far too often, administrators use the default passwords on systems as important as servers and network devices for ease of use or simply because they forgot to change them. A list of these default passwords can easily be found on the Internet and are often how hackers access the network. To best meet this requirement, it all starts with a formal password control program that expands upon best-practice policies with technologies that enable companies to have the accessibility and security needed for administrative passwords. This type of program marries policies with controls, changes and audits, to ensure best practices.
2. Protect Data – In order to achieve this goal, it is necessary to ensure that data is protected when it is stored – and wherever it is stored, and that the data is encrypted when being transmitted across public networks. Although most will probably employ some type of VPN technology for transmission, the secure storage is often overlooked. An effective solution will provide a comprehensive environment to securely store sensitive data, featuring strong firewall, strong authentication, session encryption, storage encryption, extensive auditing, access control, dual control and other security measures to ensure the security and confidentiality of data.Data at rest is frequently left sitting without any form of encryption attached to it. If an intruder is able to hack past the firewall or walk off with a server, there is no protection for the data inside if it lays unencrypted. It is essential that the solution selected to meet this requirement features built-in encryption and key management mechanisms that ensure data is always secure, while at rest and while being transmitted.
3. Maintain a Vulnerability Management Program – This is primarily to ensure that you use and regularly update anti-virus software and secondly, that you develop and maintain secure systems and applications. All applications, as well as the network itself, should be protected by an anti-virus solution. And secure systems and applications exclude those that have embedded user credentials, often the case in many database applications.
4. Implement Strong Access Control Measures – This can present a challenge since it does not simply define Identity Management measures but also the need to ensure that data is only accessible on a "need to know" basis. Ensuring that users have access only to the level of data that they need is an important step in preventing data theft, particularly internal data theft. A good solution would store data in a highly departmentalized manner, allowing only authenticated users access to data based on their level of authorization. Every user should be assigned an individual account that easily allows them to access the data they need, while restricting them from accessing additional information.
5. Regularly Monitor and Test Networks - This section requires that you track and monitor all access to network resources and data and regularly test security systems and processes. One of the best ways to do this is to have an automated audit trail to assess who had access to data if a security breach was to occur.
The optimum solution guarantees individual logging, while also recording every successful and unsuccessful event, such as login, data access and administrative activities. Additionally, these audit trails should also be stored in a safe manner and be encrypted and signed and unable to be altered manually. Another key feature to look for is the solution's ability to maintain an audit trail for a predefined period of time, making it impossible to delete the log before the retention period expires.
6. Maintain an Information Security Policy - The responsibility for this falls squarely on your IT department and management team to create, define and enforce an information security policy throughout the organization. The policy should address all relevant rules and regulations defined by regulatory bodies who may have an interest in your activities, and your users should be fully aware of the obligations as well as penalties for non-compliance.
In today's increasingly regulated business environment it's only a matter of time until the phone call comes from someone inviting themselves for a visit, and hopefully you have all your information readily at hand. After all no one doubts that you're an honest businessman, but can you prove it.
The author is European Director for Cyber-Ark
