Breach fatigue
I heard a term yesterday that frightened me – Breach Fatigue (being in the Security business can make one paranoid).
As a leader in Security technology solutions for ERP, we’ve talked to thousands of organizations about their Security protocols. Many get it and are fully committed to implementing technology and best practices to protect from internal and external breach.
I said ‘many’….unfortunately, I can’t say ‘most.’
A consistent position we observe at organizations purportedly interested in adopting new technology can be characterized as – complacent. Earlier this year we met with a large higher education institution’s Associate CIO who told us – I’m paraphrasing – “we’re going to get hacked no matter what so why should we spend lots of money when it won’t stop the inevitable.”
Wow! Textbook on how to snatch defeat from the jaws of victory.
While there’s lots of press and gnashing of teeth over well-publicized breaches, we still don’t see widespread adoption of Two-Factor Authentication and/or Logging for ERP, two amazingly simple and cost effective technologies to implement and manage.
Breach fatigue will serve to distract people. The movie ‘The Interview’ was pulled from release. At what cost? Does anybody really care? 500+ million digital identities have been compromised. FBI Director Comey warned there are 2 types of companies in the US – those that have been breached and those that don’t know they’ve been breached.
Breach fatigue. Complacency. Frightening.
Put the Appsian Security Platform to the Test
Schedule Your Demonstration and see how the Appsian Security Platform can be tailored to your organization’s unique objectives
OHUG Interview With GreyHeller CEO Hendrix H. Bodden
The year has been full of cyber attacks that have left sensitive information ranging from bank accounts to social security numbers exposed and vulnerable.
From data breaches at eBay and Michaels to the recent and devastating attack on Sony, no business is safe from cybercrime though many fail to realize the seriousness of the situation.
And it’s a problem that will only grow in severity. The value of cybercrime is expected to exceed $1 trillion by 2020, and the current market for security technology is more than $40 billion, according to Hendrix H. Bodden, chief executive officer of GreyHeller.
“It is more frightening than anybody actually realizes that isn’t in this business,”Bodden said in an interview. “I think that 2014 has seen so many high profile breaches, even JPMorgan Chase has been breached. They were able to index virtually every node, “virtually every terminal, every Web server on the JPMorgan network. JPMorgan’s CEO Jamie Dimon said they’re at least doubling their cyber-security budget, and I do think that companies are taking it more seriously.I think boards of directors, shareholders, and customers are starting to ask, ‘What are you doing to protect your valuable assets?”
There Are a Wide Variety of Cyber Criminals
“What happens is I’ll click on a link and that link will actually take me to what appears to be a legitimate site and I’ll enter information,” Bodden said. “Once I’ve entered that information, the bad guy’s site will then forward me on to the legitimate site and you’ll never know that there was that intermediate step in between. A lot of this happens and people don’t even know it. The only time they find out is when somebody has bought their credit card number on the black market and all of a sudden they’re seeing purchases at electronic stores or gift cards, which are two of the most favorite ways that cyber criminals monetize stolen identities.”
Mobile Device Management Increasingly Being Used for Protection
“Higher education is especially challenged by cyber criminals because they have by definition very open networks,” Bodden said. “They’re not behind a firewall, so higher education institutions have to have all of their web applications out and accessible in the wild and on the internet. The bad guys know this and so higher education is one of the top industries that is actually targeted by cyber criminals.”
January Webinar to Focus on PeopleSoft HR Systems
The Jan. 14 webinar centers on PeopleSoft human resources systems, which also typically contain sensitive information vulnerable and valuable to hackers.
“Before the human resources systems were mobilized, they could pretty well contain them behind the corporate firewall,” Bodden said. “But now that a lot of these systems have been mobilized so you can access your paycheck, you can change your benefits, you can do a lot of employee self-service and manager self-service from your mobile device, that exposes those systems to the internet and the bad guys know that so they’re going after them.”The third and final webinar on Jan. 21 will be presented alongside Duo and discuss two-factor authentication.
Related Articles.
Put the Appsian Security Platform to the Test
Schedule Your Demonstration and see how the Appsian Security Platform can be tailored to your organization’s unique objectives
Scary UK cybercrime data
Companies, higher education institutions, healthcare organizations are not only fighting organized cybercrime rings (makes the Mafia look like a cottage industry by comparison) but also nation states with virtually unlimited funding.
Data from the UK government’s recently published cybercrime report shows the bad guys are 24×7 omnipresent:
- HMRC (Revenue & Customs) has responded to more than 75,000 phishing reports and taken down more than 4,000 illegal websites
- Worst breaches cost between £65,000 and £115,000 on average and for large organisations between £600,000 and £1.15m
But this is perhaps the scariest: Both of the two top areas for UK cybersecurity spending are a response to an “ongoing hacking epidemic, much of it with either the explicit backing or tacit approval of a nation state”.
Read the article in ZDNet: Cybersecurity Spending: Where the Money Goes
Put the Appsian Security Platform to the Test
Schedule Your Demonstration and see how the Appsian Security Platform can be tailored to your organization’s unique objectives
Sony Knew About Security Vulnerability Before Breach
Really? This has us scratching our heads….no editorializing necessary.
An audit by PriceWaterhouseCoopers over the summer warned Sony – “Security incidents impacting these network or infrastructure devices may not be detected or resolved timely.”
The audit, performed by PricewaterhouseCoopers, found one firewall and more than 100 other devices that were not being monitored by the corporate security team charged with oversight of infrastructure, but rather by the studio’s in-house group, which was tracking activity on logs.
Auditors found that since transitioning from a third-party vendor in September 2013, Sony Pictures had failed to notify the corporate security team to monitor newly added devices, such as web servers and routers. Studio management told the auditors its corporate security team is focused on bolstering devices on the perimeter of Sony’s networks and that it hasn’t applied “the same level of rigor” for other, non-security devices such as routers and web servers.
THIS IS PRICELESS….the irony is that the confidential report was among Sony’s General Counsel Leah Weil’s email correspondence,which hackers released to public file-sharing networks earlier this week. It included recommendations for bolstering security.
Put the Appsian Security Platform to the Test
Schedule Your Demonstration and see how the Appsian Security Platform can be tailored to your organization’s unique objectives
How Data Masking Helps Prevent Cyber Attacks
Data Masking could have helped prevent recent, high-profile destructive cyber attacks.
How?
By scrambling or removing sensitive data from production and non-production systems, Data Masking can prevent compromised privileged user account information from being used to gain access to sensitive data such as Social Security Numbers.
Greg Wendt, GreyHeller’s Executive Director of Security Solutions and Services, said “I’m consistently amazed that more organizations haven’t implemented Data Masking or Two-Factor Authentication.”
Cyber criminals using compromised privileged user account information to access databases would not be able to actually see the data had it been masked. Further, combining Two-Factor Authentication with Data Masking would impose even tighter security on that sensitive data, ensuring that access only occurs once the Two-Factor Authentication challenge was successfully passed, often with an SMS message or secure ID token.
According to Mr. Wendt, “privileged user access is a huge threat vector that can be properly managed with masking and Two-Factor Authentication.”Privileged users are often defined as systems and database administrators in the information technology department who maintain systems and databases that contain sensitive information.
GreyHeller’s software product – ERP Firewall – contains powerful Data Masking and Two-Factor Authentication capabilities and is used by major commercial and higher education institutions to protect their sensitive data from cyber attack.
Additional Resources:
About GreyHeller
San Ramon, California-based GreyHeller serves Oracle® PeopleSoft customers globally across all industries, helping them secure and mobilize their PeopleSoft investment. GreyHeller’s software solutions – PeopleMobile®, ERP Firewall and Single Signon – are in production at nearly 100 PeopleSoft customers. PeopleMobile® renders PeopleSoft responsive across any mobile device and desktop. ERP Firewall and Single Signon protect PeopleSoft customers from criminal and inadvertent breach. For more information about GreyHeller, please visit www.greyheller.com.
Related Articles.
Put the Appsian Security Platform to the Test
Schedule Your Demonstration and see how the Appsian Security Platform can be tailored to your organization’s unique objectives
Allocation of risk in a data breach
We’re getting closer to a tipping point where organizations are going to have to prove conclusively to their customers, lenders, investors, shareholders that they are doing everything they can to secure their sensitive systems/data.
A federal judge recently rejected Target’s bid to dismiss lawsuits by financial institutions that claim Target had played a “key role” in allowing its computer systems to be compromised.
Apparently, Target had installed a $1.6 million advance breach detection systems from FireEye but failed to heed the alarms until after debit/credit card info of 40 million customers and personal info of 110 million customers was stolen.
What this means is that banks can go after merchants if they can prove the merchant was negligent in securing its systems.In the past, liability for breaches was governed by a complex series of agreements between merchants, payment processors and credit card companies.
Separately, consumers are pursuing class-action suits against Target.
If these bank and consumer class-action lawsuits are adjudicated for the plaintiffs, any organization that has its customers/employees/vendors sensitive data compromised could be subject to costly legal action.
And certainly the cost of that legal action will be far greater than the implementation and proper monitoring of security technology.
Put the Appsian Security Platform to the Test
Schedule Your Demonstration and see how the Appsian Security Platform can be tailored to your organization’s unique objectives
Fluid UI– How to Deploy Safely & Securely– Webinar Recording
GreyHeller’s Executive Director of Security Solutions, Greg Wendt, leads a demo-intensive session showing how organizations can deploy fluid transactions safely using the following techniques:
- Location-based security
- Two Factor Authentication
- Field level masking
- Logging and Analysis
- Utilization of Mobile Device Management solutions
Related Articles.
Put the Appsian Security Platform to the Test
Schedule Your Demonstration and see how the Appsian Security Platform can be tailored to your organization’s unique objectives
GreyHeller Presents A Two-Part Webinar
|
|
|
