Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

5/9/2017
02:00 PM
John Brenberg
John Brenberg
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Shining a Light on Security’s Grey Areas: Process, People, Technology

The changing distributed and mobile business landscape brings with it new security and privacy risks. Here's how to meet the challenge.

Security and privacy programs are best managed within the boundaries of a company’s people, processes and technologies. But now the lines that define those boundaries are changing – even disappearing.

Today’s workers aren’t isolated to fixed locations and routine schedules. They’re mobile, with virtually anytime, anywhere access to a growing abundance of sensitive information. And data can no longer be expected to be stored and transmitted on premise, but rather through cloud-based and virtual systems.

The transition from well-defined boundaries to these “grey areas” has created greater complexity and confusion when it comes to protecting data. But there are actions companies can take to better understand the risks, and ensure security and privacy programs keep pace with them.

Process: Refreshing Privacy and Security Efforts
Business is changing faster than ever in today’s connected, global economy through traditional means such as acquisitions, organic growth and new market opportunities, as well as more and better data, and connectivity. Both trends are dramatically upending business models, operations, products and services.

As companies change, so should their security and privacy efforts. For example, security and privacy professionals should continually monitor their company’s most valuable assets, such as intellectual property and customer data. From there, they can identify the risks that those assets face, and implement the appropriate safeguards.

People: Managing the Human Factor
The burden of information protection is shifting toward the workers as they become more mobile. Companies must be proactive about providing technology and training to help workers be mindful of their surroundings and the information they access in public places.

These efforts are important. But employee behavior can be hard to change - and will always be prone to human error. That’s why additional safeguards that provide an added level of protection and reduce the burden on the employee can be vital.

Visual hacking prevention is one key example. Visual hacking is the act of viewing or capturing private, sensitive or classified information for unauthorized use. It can be as simple as someone seeing and remembering your company network’s log-in details. Or it can involve using any number of modern technologies to record private organizational or customer information. Employees can – and should – use physical safeguards to block out views of onlookers, who might be looking to glean information from a quick glance or even by recording it with a smartphone camera.

Meanwhile, office workers face increasingly sophisticated attacks. This includes spearphishing, which use social engineering and knowledge about specific workers to target and trick them into clicking on malware-laced links and attachments.

Real-time training, such as with mock phishing services, can test employee performance against these schemes and help companies keep pace with fast-evolving threats. Data-loss prevention technologies can track and restrict employee actions when handling sensitive data, which can help prevent both unintentional and malicious data breaches.

Technology: Addressing New Risks
Security and privacy professionals should revisit their policies when making network and technology infrastructure changes, such as moving from traditional data centers to cloud computing. For instance, security teams will need to identify whether the log-monitoring technologies used in their corporate data centers can be extended to data in the cloud. They may discover they need to incorporate additional security, such as security incident and event management (SIEM) services.

Additionally, a number of security services, such as authentication, file-integrity management and vulnerability scanning, are available through the cloud. This may be more efficient and cost-effective than licensing, installing and managing such services at the company’s on-premise data center.

Either way, whether security services are managed through the cloud or in company-managed data centers, policies and standards should be updated to clearly define an approved approach.

Related Content:

 

John Brenberg has over 30 years of experience spanning new product introduction, system development, infrastructure management and information security and compliance across multiple business segments and processes. He is responsible for leading the IT programs for ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
7/31/2017 | 3:57:58 PM
Re: Agreed, process must be revisited
One process area that is in sore need of revision in InfoSec is Requirements Gathering.  While InfoSec should always be a DevOps environment (IMHO), when it isn't (security appliance industry) there must be a more expansive R&D process to fully understand the technology being used to penetrate large enterprises, especially where the most sensitive data is at risk.  We see so many large apps go to market with fancy tools that seem to entirely rely upon the user to configure and make successful.  InfoSec should not be in the business of selling widgets.  Instead, we need more proactive, intelligent and fully operational defenses for users where development keeps up with the underground and is constantly gathering requirements that lend to patches and point releases that can keep pace with the quickly evolving tools of cyber criminals.

 
LMaida
50%
50%
LMaida,
User Rank: Author
7/17/2017 | 3:51:13 PM
Agreed, process must be revisited
Great insights, John. I especailly agree with the idea that organizations need to revisit process, especially around security operations and incident response. Sometimes the process is the problem, and makes organizations reative instead of proactive. 
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
New Attack Campaigns Suggest Emotet Threat Is Far From Over
Jai Vijayan, Contributing Writer,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-20391
PUBLISHED: 2020-01-22
An invalid memory access flaw is present in libyang before v1.0-r3 in the function resolve_feature_value() when an if-feature statement is used inside a bit. Applications that use libyang to parse untrusted input yang files may crash.
CVE-2019-20392
PUBLISHED: 2020-01-22
An invalid memory access flaw is present in libyang before v1.0-r1 in the function resolve_feature_value() when an if-feature statement is used inside a list key node, and the feature used is not defined. Applications that use libyang to parse untrusted input yang files may crash.
CVE-2019-20393
PUBLISHED: 2020-01-22
A double-free is present in libyang before v1.0-r1 in the function yyparse() when an empty description is used. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.
CVE-2019-20394
PUBLISHED: 2020-01-22
A double-free is present in libyang before v1.0-r3 in the function yyparse() when a type statement in used in a notification statement. Applications that use libyang to parse untrusted input yang files may be vulnerable to this flaw, which would cause a crash or potentially code execution.
CVE-2019-20395
PUBLISHED: 2020-01-22
A stack consumption issue is present in libyang before v1.0-r1 due to the self-referential union type containing leafrefs. Applications that use libyang to parse untrusted input yang files may crash.