Report: Corporate security undermined by lack of cooperation
609479
A lack of communication between information security, physical security and risk management functions could be leaving gaps in corporate security.
212089
European countries are adopting tougher tactics to combat terrorism, but cooperation remains a challenge.
537741
As the TJX Companies data leakage incident seeped its way further toward becoming the Exxon Valdez of corporate information spills this week, researchers reinforced the notion that businesses continue to make a mess of electronic data security because they fail to foster adequate internal communication.A new report from Ponemon Institute -- which has produced a series of studies into corporate data leakage over the last several years -- concluded that the various people in charge of collecting, protecting, and managing sensitive information inside large businesses typically don't collaborate sufficiently. Those constituencies also have widely differing views regarding their respective roles in safeguarding the content, the report contends.Echoing comments made by a number of security policy experts in recent months, the study highlights the fact that companies are likely failing to protect data based on broken business processes -- at least as much as they may be succumbing to complex technological challenges.Just as many software developers complain that their applications are left vulnerable to attack because business teams refuse to wait long enough for the programs' underlying code to be made secure, the results of Ponemon's survey of 3,600 IT security and marketing executives -- located in the United States, the United Kingdom, and Germany -- illustrate a distinct lack of organizational coordination in the name of protecting data.For instance, only 30 percent of the marketing workers interviewed for the study said they actually consult security teams before collecting and using sensitive information, while 80 percent of the IT security employees surveyed indicated a belief that they are typically involved in such decision-making.In addition, while only 53 percent of IT security workers surveyed said their companies have well-coordinated data protection policies, only 32 percent of those workers who handle the information said their employers are doing an adequate job. Some 45 percent of security workers don't feel that their data-handling rules get in the way of business objectives, while only 21 percent of the people using the content feel that such policies represent roadblocks to their productivity.And in yet another blow to the perceptions of security workers, only 21 percent of the marketers using sensitive information interviewed by Ponemon said that security teams play a leading role in defending the content.At the heart of the matter is the issue of poor collaboration between all the involved parties, according to the research firm. Only 29 percent of those interviewed said their companies' current policies would be adequate to handle a major breach within 24 hours of its occurrence.Based on the results, Ponemon contends that organizations with substandard data protection collaboration policies were twice as likely as to have had a data breach within the last two years.Therein lays the ultimate proof of collaboration's impact on data protection, said executives with Microsoft, which sponsored the research report."We expect the data threat environment to continue to evolve, and at the same time, clearly, there's a long way to go based on where we are today," said Brendon Lynch, director of privacy strategy at Microsoft. "There's this major issue around the degree to which marketing professionals consult with these other involved parties; they see the policies as getting in the way of business objectives, and they're not interacting with security or privacy specialists based on that, which undermines the process change that companies are already attempting to enact."As part of its connection with the study, Microsoft is pushing the notion that companies should merge their security and data privacy operations to simplify the process of interaction between the various constituencies.Some 80 percent of all respondents to the Ponemon study said that they would support further combination of those teams to improve coordination of their data defenses."We feel that most companies need to be more holistic and bring these types of roles together," said Lynch. "All of these workers are critically important to better locking down the data, so they need to look at developing appropriate-use cases, and how to better fulfill business objectives while maintaining protection."The study is just the latest expert opinion to highlight the fact that despite the ever-expanding range of security technologies available to enterprises to protect sensitive data, many organizations could be well served to start with a review of their internal policies.In addition to getting business teams to work more closely with security and privacy pros, some experts contend that organizations could improve security risks quickly by merely retrenching the settings of their network and IT systems.Many critical infrastructure systems are installed with the idea of getting an operation up and running first, with plans to bolster security after the fact, and never readdressed, said Paul Williams, chief technology officer at IT security services provider Global Security Management.Reviewing networking gear settings to ensure that they have been sufficiently obscured, along with tweaking the features of other systems crucial to protect external attack is another way that companies can significantly bolster data security with little to no capital investment, he said."Before you learn how to defend a network, you have to take a walk on the wild side and see how you can break in yourself," said Williams. "Most networks can be made more secure by simply taking the time to go back and see how things were installed and whether or not the settings were changed in a way that promotes security; people typically look to technology solutions to address these problems, but they could begin helping themselves significantly at relatively no cost."In a presentation delivered at the Gartner IT Symposium earlier this month, analyst Neil MacDonald told attendees of the show that they could save money on their security projects if they continue to push for a more thorough, process-driven approach to data protection on a high level within their organizations."This can't be about managing a set of projects, it has to be about improving process," MacDonald said. "At the end of the day, the idea of tagging every piece of data in an enterprise for the sake of protecting it is unfeasible; it sounds great on paper, but the problem is a monumental effort with new information coming in all the time, it's not a process that's sustainable."
445333
Despite real threats and little sense of urgency by many company executives, now is not the time for the U.S. government to mandate cybersecurity standards to private industry, a panel of of government officials said.
512818
A report by Congressional auditors says that progress on security is mixed and political reconciliation efforts are not sufficient.
95022
A group representing technology industry chief executives on Tuesday warned that the Bush administration has failed to follow through on its two-year-old strategy for protecting the nation&#39;s
650360
Symantec's primary strategy in the enterprise may currently revolve around the notion of IT risk management, but the company's latest research finds that efforts to refine corporate process unrelated to security technology have become just as popular with customers moving to limit their exposure.According to Symantec's annual survey of 405 businesses, the notion that technologies used to improve IT security serve as the most vital element of corporate risk management currently ranks below other priorities among customers. Respondents to the study rated IT availability management and work on specific regulatory compliance projects as comparable, and in some cases more important, to their ongoing risk mitigation efforts.In addition, fewer businesses are utilizing a strategy that approaches IT risk as a standalone skill set or initiative, according to the Symantec report.One year ago, customers participating in the study indicated that the adoption of security technologies represented the central tenet of their risk management plans. In the 2008 report, 78 percent replied that availability maintenance concerns are now as vital to their exposure mitigation efforts as the installation of security tools.Some 70 percent of respondents replied that security projects are still a critical part of their approach. However, 53 percent of the IT-related incidents experienced by surveyed companies were tied to other issues besides problems with systems defense."IT risk doesn't necessarily equate to security risk. That's a big shift and the key takeaway is that organizations are getting more mature around the portfolio of risks they have to manage," said Samir Kapuria, managing director of Advisory Services at Symantec. "In the past, people looked at one area as discreet, but now they're addressing the four pillars of compliance, security, risk, and performance availability as part of a balanced strategy."Increasing interdependence on IT systems shared between business partners has elevated availability and performance concerns above security issues -- and businesses are more worried about causing a bottleneck in their global supply chain then they are looking to thwart attacks, the expert contends."IT systems availability can have a downstream impact which has had this downward effect," Kapuria said.Spending on compliance-oriented projects also stands as a major piece of most companies' plans, with 68 percent of those people responding stating that their employers rate those efforts as crucial to their risk management strategies.Respondents indicated that high-level risk management projects have become less central to their IT planning, with companies favoring targeted initiatives that address individual problems or regulations.In terms of the participants' expectations to avoid and prevent IT breakdowns, 69 percent said they believe they will encounter at least one minor incident per month, with 63 percent predicting a major IT failure at least once a year.Some 26 percent indicated they expect a failed regulatory compliance incident at least once annually, and 25 percent said that they will experience a data loss event every 12 months."This speaks volumes to the confidence that people have about their overall IT risk posture," said Kapuria. "Part of the problem is that people only do assessments on a bi-annual basis, or they might inventory their assets sporadically; that gap is what often leads to exposure in availability, security, compliance, or performance." All the individual projects involved need to be managed on an ongoing basis, he said.However, the process remains a moving target. Increased adoption of mobile devices and other distributed enterprise trends continue to boost data and compliance risks, while business practices -- including fast-paced mergers and acquisitions -- introduce greater complexity, Kapuria said.More than technological efforts, the Symantec report contends that companies may see faster returns in improving their risk status through greater investment in employee risk education and training.Only 43 percent of respondents rated their training and awareness programs as more than 75 percent effective, showing that companies are well aware of their current shortcomings, Kapuria said. The report shows a decrease of over 50 percent in companies' confidence about their training programs, compared to the year ago survey."The area where most people need to focus on is classifying their data, what it's used for, and what its sensitivity may be," said Kapuria. "Rather than just throwing technology at their problems, companies need to assess, and then apply the appropriate availability, security, and compliance requirements."
718114
A manager for a private security contractor warned executives that he lacked proper equipment in Iraq a day before four of its employees were killed and two were left hanging from a bridge, a House committee disclosed Wednesday.
299317
Many corporate IT operations are underprepared and overconfident about their ability to handle a disaster, survey finds.
137261
The lack of involvement between CIOs and corporate executives in setting strategy -- along with a shortage of business skills -- are constraining IT departments, according to a study by Gartner Inc.
196243
Revelations of corporate fraud are dependent on a wide range of sometimes unlikely players.
381160
Over 75 percent of large enterprises surveyed in a recent Ponemon Institute study say their databases are critical or important to their business, but over half say the measures they use to protect them are inadequate.
483736
No one in the business world wants to be held responsible for a breach of sensitive corporate information, but gaining the level of support necessary to allow DLP (data leakage prevention) technology to work effectively remains tricky, customers and vendors confirm.Unlike traditional security technologies that have operated largely within the confines of IT departments and network management teams, DLP projects must include participation from almost every corner of the organizational chart to succeed, according to experts who have worked with the tools.From all the different business units that need access to protected information to human resources departments tasked with following up on potential violations to the highest levels of business management, the issue of data leakage is so pervasive that nearly everyone in a company needs to be involved on some level for critical content to stay under wraps.For DLP technology to have its intended effect, every employee needs to be continually educated about company policies that must be policed aggressively and attached to real consequences for violators, customers said. Simply throwing products at the problem won't work, they claim, because DLP is as much about building policies as it is about embedding IT controls."We have HIPPA considerations to uphold, we don't want to be in newspaper, and we don't want to be embarrassed in today's world for having exposed data accidentally or otherwise -- but it's not an overnight process," said Charles Hibnick, chief systems security architect at AvMed, a large HMO in Florida. "Even though we've been working with compliance regulations for years, embracing DLP is still a cultural change that demands involvement from a lot of people to work."As part of its effort to roll out its DLP program around technology provided by Palisade Systems, AvMed was forced to create a corporate steering committee that included everyone from C-level executives to its HR and compliance officials and even its external legal counsel.If a business is attempting to create a system where employees are expected to follow specific data-handling rules and be held accountable to real penalties when they have violations, all of those parties must be involved, Hibnick contends. "We in IT had to hook up with HR and compliance to make sure that our plans specifically included a review of how the DLP product would be used and ensure that they were buying into the process," he said. "Then the HR director had to communicate with our external counsel to make sure that we were within our appropriate boundaries with everything that we wanted to do and then run it all by the board."Once the plan had been established and the technology's use was approved, one of AvMed's most visible business vice presidents authored a letter to all of the company's employees informing them of the new policies and how they might be punished for multiple infractions, such as sending out sensitive data repeatedly in unencrypted e-mails.The letter was received by employees with some level of concern over "big brother" type monitoring of their work, but making its policies and penalties clear has been key to AvMed's success in keeping its data better protected, Hibnick maintains."You'll always get feedback from users, but when you have senior executives including the CIO saying this work needs to get done, you're not going to get a lot of kickback," he said. "I'd say the two most important pieces of doing this right are aligning the right team to drive it from the top down and making sure that everyone reads that letter and understands the role they play in helping us protect the data."DLP's cooperation requirement in the real world Since getting its system up-and-running and ensuring that employees knew what was happening over one year ago, the company has experienced only a dozen or so incidents that forced it to warn individual users or send reports to those workers' department heads, the IT leader said.Even vendor representatives, such as Palisade Chief Executive Kurt Shedenhelm, concede that the challenging politics of a DLP project often outweigh the technical issues that come into play when working out all the complex data-handling rules that his company's systems are employed to enforce.Some companies struggle to achieve the right level of executive buy-in to force business unit leaders to play ball, while others don't go to great enough lengths to ensure that workers have been sufficiently re-trained to understand new policies, he said. "This issue of internal politics, of who is responsible for protecting the data, who is responsible for educating the end-user, and who is ultimately responsible for enforcement, that's actually the hard part," Shedenhelm said. "In a lot of companies, I think you might find that it's hard to get the business units, HR, and IT people that need to be involved on the same page, but you can't really do DLP without that."In some companies, especially large enterprises, multiple DLP projects may only be put under the domain of IT security and compliance teams, making it harder for those groups to keep their efforts in step without overwhelming end-users.From the issues relating to which business units ultimately maintain responsibility for specific sets of data and who is tasked with enforcing policies, things can get too complex very quickly, he said. "In larger enterprises, where you often have multiple projects looking at DLP from perspectives of intellectual property, compliance, and customer data and information spanning multiple business units, that's where you run into problems," said Shedenhelm. "One of the biggest issues we see is with trouble discerning who is ultimately responsible for handling violations; sadly, in some cases, people clearly don't want to know if violations are occurring on the business side, because then they will be forced to respond."Other experts agreed that the size of an organization often plays directly into its ability to make DLP work with issues of enforcement standing as central disputes.A tug-of-war can break out between security teams tasked with enforcing DLP and those business unit that want unfettered access to data to help do their jobs, according to some industry players. "That's one of the big problems with DLP in general -- organizations are often quite hesitant in enforcing policies, especially when it comes to any notion of blocking secure content and getting in the way of the business," said Uzi Yair, CEO of DLP vendor GTB Technologies. "Businesses want people to be able do their work and don't want interference, but on the other hand, they know they need to weigh that against any loss, which could cost an organization a lot of money these days," he said. "I think it's always going to be about this tradeoff, enforcement versus the fear of slowing down business opportunities, but people need to understand that they all play a certain role."
687239
A 2002 congressional law adds protection for corporate tattletales, but few of them gain such status from US courts. By Adam Geller / Associated Press.
536580
Managers with outdated notions about controlling workers are misusing technology to monitor and micromanage employees, according to a new report.
683719
Hobbled by inadequate funding, unclear priorities, continuing reorganizations and the absence of an overarching strategy, the Department of Homeland Security is failing to achieve its mission of preventing and responding to terrorist attacks or natural disasters, according to a comprehensive report...
617758
Business & money: Business leaders oppose stronger powers to investigate breaches.