When outsourcing, don't forget security, experts say
244524
When outsourcing IT operations offshore, companies often focus on lower costs and more productivity -- and fail to keep in mind the cultural differences that could affect their security, said experts at the Gartner IT Security Summit.
281843
(InfoWorld) - IT security professionals need to take steps to properly manage how employee-owned consumer devices are used in the workplace, analysts warned at Gartner's IT security summit in London this week. With powerful consumer devices becoming increasingly ubiquitous in the enterprise, and homeworking on the increase, Gartner said it was important that technology privileges reflected genuine need to avoid security problems. A survey by Gartner found that 15 percent of businesses will have at least some workers using their own devices by the year-end. Brian Gammage, VP at Gartner, said it was crucial that the management of user-owned technology reflect the needs of staff carrying out day-to-day tasks, rather than simply the person's rank within the organization. Individual requirements of users in completing their work, weighed against the security risks they posed, ought to be the judging factors. "It is vital to set policies on user-owned devices, and for the policies to reflect user profiles," he said. "It is amazing how most companies focus on the technology they own and not on other devices and who is using them." One key area of risk being largely ignored was the technology being used by outsourced workers, in spite of the fact they were often handling sensitive data for the company they were serving and its customers. It was vital this technology was properly managed, Gartner said. "I spoke to one major business that was even considering changing outsourcers to a company that would employ people working at home, on their own machines, handling sensitive information," said John Girard, VP at Gartner. "They asked me what I thought, and I said I'd take a note of their name and make sure not to do business with them." But while it is important to set the right policies, analysts stressed that user-owned devices were no more of a security threat than other employee-controlled devices within the workplace. Gartner said the key questions to ask when setting employee owned technology policies are: -- Who is using the technology? -- How controlled is the PC environment as a whole? -- What are the legal, compliance, and service-level agreement implications? -- Who is responsible for buying software licences and security technology for these machines? -- Who is responsible for updating security? -- Who pays for support? -- How does the company ensure that employees purchase the right machine for the job? -- What level of remuneration there is for employees for handling their own IT? Computerworld UKÂ is an InfoWorld affiliate.
562916
The big bucks companies are spending on security often don't cover the biggest threat, survey finds.
200272
Security pros have their say Anti-Virus vendorsâ¦
649975
com September 28, 2004, 8:37 AM PT. Most IT Managers won&#39;t question the importance of security, but this priority has been sliding between the third and fourth most important focus for companies.
127030
The traditional competition for U.S. offshore outsourcing business was between nations. That's about to change, according to a new study.
676651
(InfoWorld) - The more money that companies spend on securing their IT operations from external attack, the more it seems they become aware that the potential threat posed by their own employees remains their most significant risk. A new study published by consultants Deloitte on Tuesday finds that financial services companies -- among the most advanced and deep-pocketed consumers of security technologies in the world -- are still struggling with the concept of handling the insider threat issue despite all the cash they're dropping on security technologies. In the survey of 100 global financial services firms, Deloitte found that 91 percent of those questioned were concerned about their inability to respond to insider threats, while 79 percent were willing to cite "the human factor" as the root cause for a majority of their security issues. Despite that and all the different types of security tools companies have adopted, the survey found that 22 percent of the companies interviewed hadn't provided any new security training to their workers in the past year, and only 30 percent indicated a belief that their current employees were skilled enough to respond to an emerging security crisis. The apparent lack of faith in their ability to control the insider threat shows that many businesses are aware that they are only just beginning to tackle the problem, report authors said. "The contradictory findings highlight the security paradox financial institutions are facing," Mark Steinhoff, leader of the firm's financial security and privacy services practice, said in the report. "Security training and awareness, along with access and identity management -- of employees, clients, and suppliers alike -- are among organizations' top initiatives this year as they fight to keep pace with the ever-changing threat landscape." Beyond training, more companies are also enlisting the help of additional security systems aimed specifically at thwarting internal attacks and preventing mistaken data breaches. In addition to tools that offer the ability to track IT systems usage more comprehensively -- and create electronic paper trails that give forensics experts a string of clues when investigating any misbehavior or mistake -- enterprise organizations claim that they are also blending physical and IT security to stay abreast of what their workers are up to. "We've been putting cameras on all entrances and exits, looking at using badge numbers for tracking purposes, and keeping a closer eye on what people are doing and where they are going," said Adam Le, director of IT infrastructure at Alliance Imaging, a healthcare testing specialist. "We're also contemplating things like fingerprint scanners and other biometrics and looking at encrypting all data at rest on laptops." Companies walk a fine line in balancing the need to watch over their workers for security purposes and becoming too intrusive, the expert admitted. However, Le said that with businesses like Alliance facing mounting pressure from regulators to lock down every piece of patient data they record, employees must understand that the process is about protecting the firm and not about assessing personal work habits. In another effort to deal with the insider threat, Alliance, which provides outsourced medical imaging capabilities to hospitals and other healthcare organizations, has added new user authentication and monitoring tools made by ConSentry to its IT environment. By increasing security for remote workers and giving the firm a more detailed roadmap of file access activities carried out by its employees and customers, Le said he believes Alliance is finally getting ahead of the insider problem and arming itself with a way to keep everyone honest. One of the most significant issues the company has dealt with in the past are efforts by insiders to view the records of famous or high-profile patients, activities that are directly at odds with the Health Insurance Portability and Accountability Act medical data protection regulation. In some cases, the incidents have been the result of mere nosiness, while in others, the firm suspects that workers may have been looking to share sensitive data with outsiders for a profit. After conducting both technological and physical penetration tests on its operations, Le said that Alliance feels it is making the right moves to address the issue after augmenting its operations as such. "With the threat of data theft for identity fraud or to get information on our high-profile customers, we had to work to get a better picture of who was accessing what files," said Le. "Since putting the tools in place, we've been able to track people down when they do something wrong, and I think that type of response travels among workers by word of mouth; overall those types of issue have almost disappeared now that people know that their activities will be monitored." Data leakage prevention tools become more popular Another angle on preventing insider data breaches is being pursued via the use of so-called DLP (data leakage prevention) tools. At WebEx, the well-known online conferencing applications vendor, Security Engineering and Operations Manager Mike Machado said that the company is using advanced DLP technologies made by Reconnex to ensure that workers aren't walking out of the building with the company's next big idea. "Up until now, we didn't have anything in place that could capture everything that goes over the wire, but the ability to use technology do to do this type of testing, versus doing sampling in the past, has given us a much clearer picture of where data is going on the network and who is touching it," Machado said. "Most of the incidents we find today are people unaware of policies, it's only occasionally that we find something malicious, but typically the result is a simple behavior discussion, and that's helping people expand their own understanding of what they should or shouldn't do," he said. Another advantage to using DLP to keep an eye on all the data being transmitted out of WebEx's network is that the tools serve as another proof point to show external auditors when those groups are testing to see if the firm is employing comprehensive information protection. Perhaps the best use case for the technology yet, however, is when WebEx used the tools to catch an employee attempting to participate in a malware-distribution ring. In addition to joining sides with the malware gang, the employee had also agreed to allow the group to use excess WebEx network capacity to harbor potential attacks -- a problem that would have reflected poorly on the entire company if it were discovered and publicized, said the expert. "It's taught us that a lot that goes on that we know didn't about and verified things we suspected. Overall, it's been a valuable tool for detecting problems and putting us in position to prevent bigger problem down the road," Machado said. "In the rare case we find something to investigate, the technology gives us a much more credible case." The tools have also proven useful for helping the WebEx 's IT security team closer ties with the company's traditional security unit, which has helped the firm coordinate efforts to look for suspicious employee user behavior and policy violations. "Because we were able to help them shed light on some valuable issues, the technology has really closed the loop in that sense," Machado said. "The relationship wasn't always very good, but now, they're willing to be more forthcoming with us, and we can rely on each other more to reach our common goals, which is a big advantage." Some experts contend that companies will spend the next several years loading up on technologies that can help control insider threats now that they have invested so heavily in network defense protections. Brian Contos, chief security officer at ArcSight, an IT security management specialist, said that businesses must consider the insider problem as a dynamic, ever-changing issue, much like protecting against malware, if they hope to stay ahead of major incidents. "The network security side of things has increased at a much faster rate, but it's still the Wild West to a certain extent inside many large companies when it comes to protecting applications, databases, and other systems with a lot of rich data stored in them," said Contos, who previously authored the popular insider threat tome Enemy at the Watercooler. "To be successful, you can't ever be more concerned with internal or external threats. In reality you have the very real chance for either type of attack on a daily basis," he said. "The vast majority of employees, almost all, are not malicious, but you have to constantly watch for that one person who obtains employment deliberately to cause harm or who becomes disgruntled and decides to use what they know against you."
504424
The companies that are having the most success in advancing their data security efforts today are those that are finding a way to protect sensitive information without getting in the way of business users, industry experts maintain.
290406
Indian outsourcing companies should expand their operations to other low-cost countries if they want to maintain their edge, experts said Thursday at an international software conference.
629708
Key factors help determine if outsourcing benefits or hurts Americans.
737583
com September 22, 2004, 4:17 PM PT. Most IT Managers won&#39;t question the importance of security, but this priority has been sliding between the third and fourth most important focus for companies.
163448
Jon Oltsik explains why a new computing security conundrum presents CIOs with a problem that's not given to an easy solution.
602917
CEOs aren&#39;t taking the care that they should with their customers&#39; data when they outsource, according to a new survey of senior management.
709461
Hoping this release will solve all your security headaches? Think again, say the experts.
74792
Global competition can be a drag. It all but guarantees a steady stream of restructuring, outsourcing, and the nagging insecurity that comes from knowing someone out there may be trying to take your job.
372547
The importance these days of protecting your business from security threats is clear. But how to do it well often remains a vexing problem. Major IT vendors have faced this challenge like everyone else -- but with a twist. As providers of security technology and IT systems vulnerable to threats, they've had to stay a step ahead of everyone else. That's why CIOs of technology stalwarts IBM and Intel and security technology provider Symantec have taken on security management as one of their key functions. All three companies have shared their lessons learned with InfoWorld.
186394
Although a company's move to outsourcing can sometimes strike fear in employees who see their jobs as endangered, if done right workers may find that the process provides them with an opportunity to advance their careers and hone their skills, according to the findings of a poll out this week.