Insights into technology - Preventing data loss

Ryan English

August 1, 2008

A s security threats of corporate networks and databases are at an all-time high, recent studies indicate most data breaches could have been prevented with reasonable security precautions. Corporate executives and security managers mustn't delude themselves into thinking they are secure.

Here are the top IT security threats, and how to guard against them:

1. Web application exposure. Web application vulnerabilities such as broken access controls and failure to properly validate inputs are threats to any organization that has a Web site, especially those that collect confidential consumer data such as credit card, social security, and drivers' license numbers. Employ a qualified security assessor to evaluate the security vulnerabilities of Web applications at least annually or any time there is a new release or major change to the application.

2. Wireless networks. Most wireless networks are installed without wireless access points being properly configured to prevent unauthenticated users from accessing the corporate networks. Become aware of any unauthorized wireless access points and shut those down immediately. Make sure wireless access points are secure. Annual wireless security assessments are recommended.

3. Ineffective firewalls. A firewall that is improperly configured or is more than a year behind in patching is as good as having no intrusion prevention system at all. Organizations should assess the current security, policies and patch levels of firewalls on a routine basis. Install patches as soon as they are available.

4. Server configuration and patching. Externally facing servers often are running older versions of software that are more easily accessible to hackers. Regularly scan all network devices and servers to check current patch levels and identify potential security vulnerabilities. Keeping patches current can lessen the likelihood that a malicious attacker could compromise the device or that they could be infected with malware.

5. Social engineering. Phishing emails and phone calls are all it takes for an attacker to gain the confidence of unsuspecting personnel who will divulge confidential information. Conduct security awareness training with employees once a year to educate personnel on dangers of social engineering, preventing unauthorized access to facilities, and the organization's policies for disseminating confidential information.

6. Malware. Malware is malicious software that infiltrates or damages an organization's computer systems. It includes computer viruses, worms, Trojan horses, rootkits, spyware, dishonest adware, and other malevolent and unwanted software. One industry source estimates that more malware was produced last year than in the previous 20 years. Your organization has exposure to malware if you don't have technology covering anti-virus, anti-spyware, encryption, intrusion detection or malware detection. Organizations should continuously monitor their network devices, firewalls and servers for potential malware. Use monitoring software or outsource the monitoring of security devices to an external security company to identify threats and issue alerts on security events to help identify potential malware attacks.

7. Malicious Web sites. Users can fall victim to phishing attacks or introduce malcode, such as spyware, into their organizations by visiting unauthorized Web sites. Create corporate policies that describe acceptable employee computer usage, such as Web access, downloads, and opening email from unknown senders. Using Web filtering technology will help ensure that users aren't introducing dangerous code into the organization's networks.

8. Mobile devices. Remote and traveling employees pose a major threat and measures should be taken to ensure data loss prevention. Laptops and other mobile devices can be lost or stolen, and along with them go confidential data, and, too often, private customer data. Every mobile device and laptop containing confidential information should be fully encrypted if organizations are to protect fully themselves.

---

Ryan English is VP of product management at Vigilar Inc.

Related Content:

• Insights into financial management - Tripholio™, Part II
• Insights into human capital - Here's how to implement a balanced response in the current economy
• Insights into marketing - Social influence marketing
• Insights into law - The five most common legal mistakes involving commercial Web sites

---