Mobile

5/9/2017
02:00 PM
John Brenberg
John Brenberg
Commentary
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

Shining a Light on Securitys Grey Areas: Process, People, Technology

The changing distributed and mobile business landscape brings with it new security and privacy risks. Here's how to meet the challenge.

Security and privacy programs are best managed within the boundaries of a company’s people, processes and technologies. But now the lines that define those boundaries are changing – even disappearing.

Today’s workers aren’t isolated to fixed locations and routine schedules. They’re mobile, with virtually anytime, anywhere access to a growing abundance of sensitive information. And data can no longer be expected to be stored and transmitted on premise, but rather through cloud-based and virtual systems.

The transition from well-defined boundaries to these “grey areas” has created greater complexity and confusion when it comes to protecting data. But there are actions companies can take to better understand the risks, and ensure security and privacy programs keep pace with them.

Process: Refreshing Privacy and Security Efforts
Business is changing faster than ever in today’s connected, global economy through traditional means such as acquisitions, organic growth and new market opportunities, as well as more and better data, and connectivity. Both trends are dramatically upending business models, operations, products and services.

As companies change, so should their security and privacy efforts. For example, security and privacy professionals should continually monitor their company’s most valuable assets, such as intellectual property and customer data. From there, they can identify the risks that those assets face, and implement the appropriate safeguards.

People: Managing the Human Factor
The burden of information protection is shifting toward the workers as they become more mobile. Companies must be proactive about providing technology and training to help workers be mindful of their surroundings and the information they access in public places.

These efforts are important. But employee behavior can be hard to change - and will always be prone to human error. That’s why additional safeguards that provide an added level of protection and reduce the burden on the employee can be vital.

Visual hacking prevention is one key example. Visual hacking is the act of viewing or capturing private, sensitive or classified information for unauthorized use. It can be as simple as someone seeing and remembering your company network’s log-in details. Or it can involve using any number of modern technologies to record private organizational or customer information. Employees can – and should – use physical safeguards to block out views of onlookers, who might be looking to glean information from a quick glance or even by recording it with a smartphone camera.

Meanwhile, office workers face increasingly sophisticated attacks. This includes spearphishing, which use social engineering and knowledge about specific workers to target and trick them into clicking on malware-laced links and attachments.

Real-time training, such as with mock phishing services, can test employee performance against these schemes and help companies keep pace with fast-evolving threats. Data-loss prevention technologies can track and restrict employee actions when handling sensitive data, which can help prevent both unintentional and malicious data breaches.

Technology: Addressing New Risks
Security and privacy professionals should revisit their policies when making network and technology infrastructure changes, such as moving from traditional data centers to cloud computing. For instance, security teams will need to identify whether the log-monitoring technologies used in their corporate data centers can be extended to data in the cloud. They may discover they need to incorporate additional security, such as security incident and event management (SIEM) services.

Additionally, a number of security services, such as authentication, file-integrity management and vulnerability scanning, are available through the cloud. This may be more efficient and cost-effective than licensing, installing and managing such services at the company’s on-premise data center.

Either way, whether security services are managed through the cloud or in company-managed data centers, policies and standards should be updated to clearly define an approved approach.

Related Content:

 

John Brenberg has over 30 years of experience spanning new product introduction, system development, infrastructure management and information security and compliance across multiple business segments and processes. He is responsible for leading the IT programs for ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
No SOPA
50%
50%
No SOPA,
User Rank: Ninja
7/31/2017 | 3:57:58 PM
Re: Agreed, process must be revisited
One process area that is in sore need of revision in InfoSec is Requirements Gathering.  While InfoSec should always be a DevOps environment (IMHO), when it isn't (security appliance industry) there must be a more expansive R&D process to fully understand the technology being used to penetrate large enterprises, especially where the most sensitive data is at risk.  We see so many large apps go to market with fancy tools that seem to entirely rely upon the user to configure and make successful.  InfoSec should not be in the business of selling widgets.  Instead, we need more proactive, intelligent and fully operational defenses for users where development keeps up with the underground and is constantly gathering requirements that lend to patches and point releases that can keep pace with the quickly evolving tools of cyber criminals.

 
LMaida
50%
50%
LMaida,
User Rank: Author
7/17/2017 | 3:51:13 PM
Agreed, process must be revisited
Great insights, John. I especailly agree with the idea that organizations need to revisit process, especially around security operations and incident response. Sometimes the process is the problem, and makes organizations reative instead of proactive. 
It Takes an Average of 3 to 6 Months to Fill a Cybersecurity Job
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/12/2019
763M Email Addresses Exposed in Latest Database Misconfiguration Episode
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: LOL  Hope this one wins
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
The State of Cyber Security Incident Response
The State of Cyber Security Incident Response
Organizations are responding to new threats with new processes for detecting and mitigating them. Here's a look at how the discipline of incident response is evolving.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6149
PUBLISHED: 2019-03-18
An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-15509
PUBLISHED: 2019-03-18
Five9 Agent Desktop Plus 10.0.70 has Incorrect Access Control (issue 2 of 2).
CVE-2018-20806
PUBLISHED: 2019-03-17
Phamm (aka PHP LDAP Virtual Hosting Manager) 0.6.8 allows XSS via the login page (the /public/main.php action parameter).
CVE-2019-5616
PUBLISHED: 2019-03-15
CircuitWerkes Sicon-8, a hardware device used for managing electrical devices, ships with a web-based front-end controller and implements an authentication mechanism in JavaScript that is run in the context of a user's web browser.
CVE-2018-17882
PUBLISHED: 2019-03-15
An Integer overflow vulnerability exists in the batchTransfer function of a smart contract implementation for CryptoBotsBattle (CBTB), an Ethereum token. This vulnerability could be used by an attacker to create an arbitrary amount of tokens for any user.