Risk
8/24/2007
12:19 PM
Keith Ferrell
Keith Ferrell
Commentary
50%
50%

Weathering The Weather

Watch the news coverage of the Midwest floods and the toll they've taken on families, homes and holdings, and you can't avoid hearing -- and often -- from flood victims who discovered that their insurance didn't cover flood or landslide/mudslide damage. It's no great leap to extend those personal stories to small and mid-size business stories. How covered are you when a natural disaster strikes your business?

Watch the news coverage of the Midwest floods and the toll they've taken on families, homes and holdings, and you can't avoid hearing -- and often -- from flood victims who discovered that their insurance didn't cover flood or landslide/mudslide damage. It's no great leap to extend those personal stories to small and mid-size business stories. How covered are you when a natural disaster strikes your business?Not all the threats your business faces are digital, and not all of them are criminal.

If you don't have a disaster preparation and recovery plan in place for your business -- and, just as crucially, for your remote and mobile employees -- you're running a risk that could catch up with you without warning.

Are all of your business-critical and confidential files backed up and stored on a remote site? What's the date of your most frequent backup?

Do you have a contingency plan in place for running your business -- even minimally -- if your office equipment is destroyed, or if you face an extended period of time without electricity?

Do you carry sufficient insurance to replace that equipment -- and does the insurance cover the likeliest (and, to be safe, the most likely of the unlikely) natural disasters for your region?

Are all of your employees up-to-speed on your disaster and recovery plans?

For that matter, are all of your employees up-to-speed on assistance and support they could offer other employees (first) and your business (once you're sure everyone is all right) in the event of a natural disaster?

Some of you may be experiencing some of this first-hand: in addition to the floods over the past few days, a power outage has knocked out a chunk of Chicago's electric grid as I write.

When natural disaster strikes you'll have plenty to deal with without being distracted -- or heartbroken -- by matters you could have dealt with earlier.

Make sure your overall security planning includes planning for weather and other natural catastrophes as well as digital disasters.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.