Some Basics on Data Protection

Verizon recently released a report in which it concluded that data security has not improved since it began its current series of surveys in 2008. It's a short time, but nevertheless, one would hope that there would have been some improvement, especially in view of the widely reported data breaches that have occurred during that period.

Even more surprising is the series of recommendations they put forward. These are recommendations that IT Auditors and security experts have been making for many years. A panel from Computerworld put together  four basic points:

1. Don't just log, monitor - Logging by itself accomplishes nothing; the results need to be monitored.
2. Tweak your network configuration - constant addition of new applications and upgrades can change the system by adding in unexpected defaults. These need to be reviewed and perhaps changed.
3. Educate your users - User understanding of the system its security routines is critical. As is the development of a strong security culture.
4.  Document and monitor access privileges - So fundamental. Security management needs a record of which users have access to sensitive data or functionality and those users need to be monitored. The current Wikileaks case, where a soldier in a remote base downloaded confidential documents to CDs is a case in point.

The Verizon report said that 64% of the data breaches could have been prevented with the use of these simple procedures. When will we ever learn?? Click this link for a report on these four security measures.

Security Holding up Cloud Adoption

The recently announced second annual Mimecast Cloud Barometer Survey, conducted by Loudhouse Research, finds that 74 percent of IT departments surveyed point to the trade-off between cost and IT security, and 62 percent indicate a risk in storing data on servers outside the business. For Canadian companies, the situation is complicated by the US Patriot Act. Most Cloud providers are US based, and many hold their data on servers in the US, which gives the authorities access to it under that act. There are concerns that this violates the provisions of the Canadian Privacy Act (PIPEDA). In any event it adds to the risk for Canadian companies and has contributed to slow cloud adoption, particular in the BI area.

COSO Announces Project to Modernize Internal Control - Integrated Framework

Last week, the COSO committee announced that it would be updating the COSO framework. "The Committee of Sponsoring Organizations of the Treadway Commission (COSO) today (sic) announced a project to review and update the COSO Internal Control - Integrated Framework (Framework). This initiative is expected to make the existing Framework and related evaluation tools more relevant in the increasingly complex business environment so that organizations worldwide can better design, implement, and assess internal control."

The intention is to update the guidance to reflect changes in the environment, such as technological changes and regulator expectations, but not to change the fundamental principles of the framework. PwC has been hired to support the update, which is expected to be released in 2012. For the announcement, click this link.

Honeypots

Often a very useful and efficient intrusion detection device, honeypots have been around for a long time, but now are getting more sophisticated and complex.  Honeypots are devices (often just an old pc), connected to the internet or a network, which contain features designed to lure hackers. For example, they might contain fake bank login information of credit card information resident in places where hackers might look.

Software is available for honeypots, which not only sets up the lures, but also detects and records the activities of intruders. Any intruders are deemed to be suspicous.

Most systems connected to the internet should have honeypots. They are simple to install and cost effective to run, having virtually no maintenance cost.

For a series of excellent articles on honeypots as well as some reviews of current honeypot software, check out this link.

Virtualization and the Cloud

The spread of cloud computing, particularly in the form of Infrastructure as a Service (IAAS), has been accompanied by a growth in virtualization. There has been a great deal written about the security implications of each, but not so much on the implications of both taken together, yet this is a common occurance.

CA has released a white paper that addresses this area. The white paper suggests the following:


"A comprehensive solution for privileged access management is required in order to mitigate the risks associated with the new breed of security considerations and satisfy auditors. Service providers delivering Infrastructure-as-a-Service will need to provide premium visibility and control features to their customers if they want to attract the enterprise market.

An effective solution must ensure limitations on privileged users performing authorized operations on the virtualization infrastructure. This reduces the risk associated with over-privileged accounts or external intrusions which may compromise the gateway to guest images. Machine-to-machine protection through network isolation should be supplemented by access enforcement amongst them."

A copy is available from this link. (Free registration required)

5 tips for effective cloud security


Security in the cloud remains a serious concern for many companies, particularly those who have private or sensitive information on their systems about customers. Overcoming that concern takes some foresight and planning. This article points out the following considerations:

·        1.  Find out as much as you can about a software-as-a-service provider's security measures and infrastructure. If you are going with an infrastructure-as-a-service provider, ask what tools it can provide you to protect your virtual environment.

·        2. Encrypt data at rest and in transit; otherwise, don't put sensitive information in the cloud.

·        3, Divvy up responsibilities between your administrators and the service provider's administrators, so no one has free access across all security layers.

·        4. Check whether a vendor has been accredited as meeting SAS 70 Type 2 and ISO 27001 security standards. If you are an international company, check for European Safe Harbor accreditation as well.

·        5. Go with a high-end service provider with an established security record. "You get what you pay for," says Gartner analyst Jay Heiser.

    

      For the Article, click this link.

IT Internal Audit Effectiveness

An IT Internal Audit department always has the risk of becoming mired in routine computer control functions, which don't change very much and are generally quite controllable anyway. Auditing conventional computer controls by rote can lead to a very ineffective IT audit function.

What is more important is to align the audits with the overall risk assessments of the enterprise. The IT audit function has a lot to offer in this area. It is an interactive process, with the auditors using the risk assessment as a guide and also providing input on areas where it can be improved.

Deloitte has published a series of CEO reports, one of which deals with the effectiveness of an IT Internal Audit (IT IA) function. The booklet provides numerous examples of risk areas that should be considered for inclusion in the audits, They include contract compliance, green IT, adaptability readiness, and readiness for upcoming regulatory changes. The guide also suggest strategies for using continuous monitoring techniques to improve the audits.

It is an excellent guide and is available on the Deloitte website for free download.